@xemahq/contracts 0.81.0 → 0.83.0

package/dist/deployment/lib/event-subscription-grant.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledEventSubscriptionCeilingSchema = exports.EventSubscriptionGrantSchema = exports.EventSubscriptionCallerSchema = void 0;
+exports.compareEventSubscriptionRows = compareEventSubscriptionRows;
+const zod_1 = require("zod");
+const event_subscription_1 = require("../../event-subscription");
+const code_unit_order_1 = require("./code-unit-order");
+const trust_domain_1 = require("./trust-domain");
+exports.EventSubscriptionCallerSchema = zod_1.z
+    .object({
+    biome: zod_1.z.string().regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case'),
+    component: zod_1.z.string().min(1),
+})
+    .strict();
+exports.EventSubscriptionGrantSchema = zod_1.z
+    .object({
+    caller: exports.EventSubscriptionCallerSchema,
+    clauses: (0, event_subscription_1.eventSubscriptionClauseListSchema)(event_subscription_1.EventSubscriptionGrantClauseSchema, 'an eventSubscriptionGrants row', {
+        sorted: true,
+    }).superRefine((clauses, ctx) => {
+        clauses.forEach((clause, index) => {
+            if (clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Realm) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [index, 'scope'],
+                    message: 'an eventSubscriptionGrants clause is realm-scoped; org reach is granted per installation',
+                });
+            }
+        });
+    }),
+})
+    .strict();
+exports.InstalledEventSubscriptionCeilingSchema = zod_1.z
+    .object({
+    caller: exports.EventSubscriptionCallerSchema,
+    clauses: (0, event_subscription_1.eventSubscriptionClauseListSchema)(event_subscription_1.DeclaredEventSubscriptionClauseSchema, 'an installedEventSubscriptionCeilings row', { sorted: true }).superRefine((clauses, ctx) => {
+        clauses.forEach((clause, index) => {
+            if (clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Org) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [index, 'scope'],
+                    message: 'an installedEventSubscriptionCeilings clause is org-scoped; realm reach is never installable',
+                });
+            }
+        });
+    }),
+})
+    .strict();
+function compareEventSubscriptionRows(a, b) {
+    return (0, code_unit_order_1.compareCodeUnits)(a.caller.biome, b.caller.biome) || (0, code_unit_order_1.compareCodeUnits)(a.caller.component, b.caller.component);
+}
+//# sourceMappingURL=event-subscription-grant.js.map

package/dist/deployment/lib/event-subscription-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-subscription-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/event-subscription-grant.ts"],"names":[],"mappings":";;;AAmFA,oEAKC;AAxFD,6BAAwB;AAExB,iEAKkC;AAClC,uDAAqD;AACrD,iDAA+D;AAkBlD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC;IAC/F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,MAAM,EAAE,qCAA6B;IACrC,OAAO,EAAE,IAAA,sDAAiC,EAAC,uDAAkC,EAAE,gCAAgC,EAAE;QAC/G,MAAM,EAAE,IAAI;KACb,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC9B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,KAAK,EAAE,CAAC;gBAC3D,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;oBACtB,OAAO,EAAE,0FAA0F;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,MAAM,EAAE,qCAA6B;IACrC,OAAO,EAAE,IAAA,sDAAiC,EACxC,0DAAqC,EACrC,2CAA2C,EAC3C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,GAAG,EAAE,CAAC;gBACzD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;oBACtB,OAAO,EAAE,8FAA8F;iBACxG,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,SAAgB,4BAA4B,CAC1C,CAA+C,EAC/C,CAA+C;IAE/C,OAAO,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACtH,CAAC"}

package/dist/deployment/lib/installed-event-subscription-grant.d.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+import { EventSubscriptionScopeKind, type DeclaredEventSubscriptionClause, type EventSubscriptionGrantClause } from '../../event-subscription';
+import type { InstalledEventSubscriptionCeiling } from './event-subscription-grant';
+import { InstalledWorkloadGrantState, RevokeReason } from './installed-workload-grant';
+export declare const InstalledEventSubscriptionGrantSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    installationId: z.ZodString;
+    biome: z.ZodString;
+    component: z.ZodString;
+    clause: z.ZodObject<{
+        types: z.ZodArray<z.ZodString>;
+        tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Org>;
+            org: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<EventSubscriptionScopeKind.Realm>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+    biomeVersion: z.ZodString;
+    consentDigest: z.ZodString;
+    state: z.ZodEnum<typeof InstalledWorkloadGrantState>;
+    revokeReason: z.ZodOptional<z.ZodEnum<typeof RevokeReason>>;
+}, z.core.$strict>;
+export type InstalledEventSubscriptionGrant = z.infer<typeof InstalledEventSubscriptionGrantSchema>;
+export interface InstalledEventSubscriptionTarget {
+    readonly component: string;
+    readonly clause: EventSubscriptionGrantClause;
+}
+export declare enum InstalledEventSubscriptionRefusalCode {
+    UnknownComponent = "unknown-component",
+    RealmReachNotInstallable = "realm-reach-not-installable",
+    OutsideCeiling = "outside-ceiling"
+}
+export interface InstalledEventSubscriptionRefusal {
+    readonly code: InstalledEventSubscriptionRefusalCode;
+    readonly component: string;
+    readonly clause: DeclaredEventSubscriptionClause;
+}
+export interface InstalledEventSubscriptionDiff {
+    readonly kept: readonly InstalledEventSubscriptionTarget[];
+    readonly added: readonly InstalledEventSubscriptionTarget[];
+    readonly removed: readonly InstalledEventSubscriptionTarget[];
+}
+export interface InstalledEventSubscriptionAdmissionInput {
+    readonly biome: string;
+    readonly requested: Readonly<Record<string, readonly DeclaredEventSubscriptionClause[]>>;
+    readonly ceiling: readonly InstalledEventSubscriptionCeiling[];
+    readonly installed: readonly InstalledEventSubscriptionGrant[] | undefined;
+    readonly orgId: string;
+}
+export interface InstalledEventSubscriptionAdmission {
+    readonly admitted: readonly InstalledEventSubscriptionTarget[];
+    readonly refused: readonly InstalledEventSubscriptionRefusal[];
+    readonly diff: InstalledEventSubscriptionDiff;
+    readonly consentRequired: boolean;
+}
+export declare function compareInstalledEventSubscriptionTargets(a: InstalledEventSubscriptionTarget, b: InstalledEventSubscriptionTarget): number;
+export declare function admitInstalledEventSubscriptions(input: InstalledEventSubscriptionAdmissionInput): InstalledEventSubscriptionAdmission;
+//# sourceMappingURL=installed-event-subscription-grant.d.ts.map

package/dist/deployment/lib/installed-event-subscription-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-event-subscription-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/installed-event-subscription-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,0BAA0B,EAI1B,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EAClC,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAwBvF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;kBA8B9C,CAAC;AAEL,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAGpG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;CAC/C;AAGD,oBAAY,qCAAqC;IAE/C,gBAAgB,sBAAsB;IAEtC,wBAAwB,gCAAgC;IAExD,cAAc,oBAAoB;CACnC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;CAClD;AAED,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,IAAI,EAAE,SAAS,gCAAgC,EAAE,CAAC;IAE3D,QAAQ,CAAC,KAAK,EAAE,SAAS,gCAAgC,EAAE,CAAC;IAE5D,QAAQ,CAAC,OAAO,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAC/D;AAED,MAAM,WAAW,wCAAwC;IAEvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,+BAA+B,EAAE,CAAC,CAAC,CAAC;IAEzF,QAAQ,CAAC,OAAO,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAE/D,QAAQ,CAAC,SAAS,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;IAE3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mCAAmC;IAElD,QAAQ,CAAC,QAAQ,EAAE,SAAS,gCAAgC,EAAE,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAM9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAGD,wBAAgB,wCAAwC,CACtD,CAAC,EAAE,gCAAgC,EACnC,CAAC,EAAE,gCAAgC,GAClC,MAAM,CAKR;AAKD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,wCAAwC,GAC9C,mCAAmC,CA+DrC"}

package/dist/deployment/lib/installed-event-subscription-grant.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledEventSubscriptionRefusalCode = exports.InstalledEventSubscriptionGrantSchema = void 0;
+exports.compareInstalledEventSubscriptionTargets = compareInstalledEventSubscriptionTargets;
+exports.admitInstalledEventSubscriptions = admitInstalledEventSubscriptions;
+const zod_1 = require("zod");
+const event_subscription_1 = require("../../event-subscription");
+const code_unit_order_1 = require("./code-unit-order");
+const installed_workload_grant_1 = require("./installed-workload-grant");
+const trust_domain_1 = require("./trust-domain");
+exports.InstalledEventSubscriptionGrantSchema = zod_1.z
+    .object({
+    orgId: zod_1.z.string().min(1),
+    installationId: zod_1.z.string().min(1),
+    biome: zod_1.z.string().regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case'),
+    component: zod_1.z.string().min(1),
+    clause: event_subscription_1.EventSubscriptionGrantClauseSchema,
+    biomeVersion: zod_1.z.string().min(1),
+    consentDigest: zod_1.z.string().min(1),
+    state: zod_1.z.nativeEnum(installed_workload_grant_1.InstalledWorkloadGrantState),
+    revokeReason: zod_1.z.nativeEnum(installed_workload_grant_1.RevokeReason).optional(),
+})
+    .strict()
+    .superRefine((row, ctx) => {
+    if (row.clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Org || row.clause.scope.org !== row.orgId) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['clause', 'scope'],
+            message: 'an installed event subscription is scoped to the installing organization',
+        });
+    }
+    const revoked = row.state === installed_workload_grant_1.InstalledWorkloadGrantState.Revoked;
+    if (revoked && row.revokeReason === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['revokeReason'], message: 'a revoked grant states why it was revoked' });
+    }
+    if (!revoked && row.revokeReason !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['revokeReason'], message: 'only a revoked grant states a revokeReason' });
+    }
+});
+var InstalledEventSubscriptionRefusalCode;
+(function (InstalledEventSubscriptionRefusalCode) {
+    InstalledEventSubscriptionRefusalCode["UnknownComponent"] = "unknown-component";
+    InstalledEventSubscriptionRefusalCode["RealmReachNotInstallable"] = "realm-reach-not-installable";
+    InstalledEventSubscriptionRefusalCode["OutsideCeiling"] = "outside-ceiling";
+})(InstalledEventSubscriptionRefusalCode || (exports.InstalledEventSubscriptionRefusalCode = InstalledEventSubscriptionRefusalCode = {}));
+function compareInstalledEventSubscriptionTargets(a, b) {
+    return ((0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
+        (0, code_unit_order_1.compareCodeUnits)((0, event_subscription_1.eventSubscriptionClauseKey)(a.clause), (0, event_subscription_1.eventSubscriptionClauseKey)(b.clause)));
+}
+const keyOf = (target) => `${target.component}\u0000${(0, event_subscription_1.eventSubscriptionClauseKey)(target.clause)}`;
+function admitInstalledEventSubscriptions(input) {
+    const ceilingByComponent = new Map();
+    for (const row of input.ceiling) {
+        if (row.caller.biome !== input.biome)
+            continue;
+        ceilingByComponent.set(row.caller.component, [...(ceilingByComponent.get(row.caller.component) ?? []), ...row.clauses]);
+    }
+    const admitted = [];
+    const refused = [];
+    for (const [component, clauses] of Object.entries(input.requested)) {
+        const ceiling = ceilingByComponent.get(component);
+        for (const clause of (0, event_subscription_1.canonicalEventSubscriptionClauses)(clauses)) {
+            const refuse = (code) => {
+                refused.push({ code, component, clause });
+            };
+            if (ceiling === undefined) {
+                refuse(InstalledEventSubscriptionRefusalCode.UnknownComponent);
+            }
+            else if (clause.scope.kind !== event_subscription_1.EventSubscriptionScopeKind.Org) {
+                refuse(InstalledEventSubscriptionRefusalCode.RealmReachNotInstallable);
+            }
+            else if (!ceiling.some((allowed) => (0, event_subscription_1.eventSubscriptionClauseCovers)(allowed, clause))) {
+                refuse(InstalledEventSubscriptionRefusalCode.OutsideCeiling);
+            }
+            else {
+                admitted.push({
+                    component,
+                    clause: {
+                        types: [...clause.types],
+                        tiers: [...clause.tiers],
+                        scope: { kind: event_subscription_1.EventSubscriptionScopeKind.Org, org: input.orgId },
+                    },
+                });
+            }
+        }
+    }
+    admitted.sort(compareInstalledEventSubscriptionTargets);
+    refused.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
+        (0, code_unit_order_1.compareCodeUnits)((0, event_subscription_1.eventSubscriptionClauseKey)(a.clause), (0, event_subscription_1.eventSubscriptionClauseKey)(b.clause)));
+    const active = (input.installed ?? []).filter((row) => row.biome === input.biome && row.state === installed_workload_grant_1.InstalledWorkloadGrantState.Active);
+    const activeKeys = new Set(active.map((row) => keyOf({ component: row.component, clause: row.clause })));
+    const admittedKeys = new Set(admitted.map(keyOf));
+    const kept = admitted.filter((target) => activeKeys.has(keyOf(target)));
+    const added = admitted.filter((target) => !activeKeys.has(keyOf(target)));
+    const removed = active
+        .map((row) => ({ component: row.component, clause: row.clause }))
+        .filter((target) => !admittedKeys.has(keyOf(target)))
+        .sort(compareInstalledEventSubscriptionTargets);
+    return {
+        admitted,
+        refused,
+        diff: { kept, added, removed },
+        consentRequired: input.installed !== undefined &&
+            added.some((target) => !active.some((held) => held.component === target.component && (0, event_subscription_1.eventSubscriptionClauseCovers)(held.clause, target.clause))),
+    };
+}
+//# sourceMappingURL=installed-event-subscription-grant.js.map

package/dist/deployment/lib/installed-event-subscription-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-event-subscription-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/installed-event-subscription-grant.ts"],"names":[],"mappings":";;;AAiIA,4FAQC;AAKD,4EAiEC;AA/MD,6BAAwB;AAExB,iEAQkC;AAClC,uDAAqD;AAErD,yEAAuF;AACvF,iDAA+D;AAuBlD,QAAA,qCAAqC,GAAG,OAAC;KACnD,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC;IAC/F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,uDAAkC;IAE1C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,OAAC,CAAC,UAAU,CAAC,sDAA2B,CAAC;IAChD,YAAY,EAAE,OAAC,CAAC,UAAU,CAAC,uCAAY,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;QACnG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACzB,OAAO,EAAE,0EAA0E;SACpF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,sDAA2B,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAClH,CAAC;AACH,CAAC,CAAC,CAAC;AAWL,IAAY,qCAOX;AAPD,WAAY,qCAAqC;IAE/C,+EAAsC,CAAA;IAEtC,iGAAwD,CAAA;IAExD,2EAAkC,CAAA;AACpC,CAAC,EAPW,qCAAqC,qDAArC,qCAAqC,QAOhD;AA4CD,SAAgB,wCAAwC,CACtD,CAAmC,EACnC,CAAmC;IAEnC,OAAO,CACL,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,MAAwC,EAAU,EAAE,CACjE,GAAG,MAAM,CAAC,SAAS,SAAS,IAAA,+CAA0B,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAE1E,SAAgB,gCAAgC,CAC9C,KAA+C;IAE/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAwD,CAAC;IAC3F,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,SAAS;QAC/C,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,IAAA,sDAAiC,EAAC,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,CAAC,IAA2C,EAAQ,EAAE;gBACnE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,+CAA0B,CAAC,GAAG,EAAE,CAAC;gBAChE,MAAM,CAAC,qCAAqC,CAAC,wBAAwB,CAAC,CAAC;YACzE,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,kDAA6B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtF,MAAM,CAAC,qCAAqC,CAAC,cAAc,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS;oBACT,MAAM,EAAE;wBACN,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;wBACxB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;wBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,+CAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;qBAClE;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC/F,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,sDAA2B,CAAC,MAAM,CACvF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM;SACnB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;SAChE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAElD,OAAO;QACL,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QAC9B,eAAe,EACb,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,KAAK,CAAC,IAAI,CACR,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,IAAA,kDAA6B,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC3H;KACJ,CAAC;AACJ,CAAC"}

package/dist/deployment/lib/installed-workload-grant.d.ts

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import { type OperationGrant } from './operation-grant';
+import { type OperationId } from './operation-id';
+import type { InstalledEventSubscriptionTarget } from './installed-event-subscription-grant';
+export declare enum InstalledWorkloadGrantState {
+    Active = "active",
+    Revoked = "revoked"
+}
+export declare enum RevokeReason {
+    Uninstalled = "uninstalled",
+    Disabled = "disabled",
+    UpgradeNarrowed = "upgrade-narrowed",
+    CeilingNarrowed = "ceiling-narrowed"
+}
+export declare const InstalledWorkloadGrantSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    installationId: z.ZodString;
+    biome: z.ZodString;
+    component: z.ZodString;
+    operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+    receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<import("./operation-grant").OperationGrantReceiverKind.Biome>;
+        biome: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<import("./operation-grant").OperationGrantReceiverKind.PlatformService>;
+        service: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    biomeVersion: z.ZodString;
+    consentDigest: z.ZodString;
+    state: z.ZodEnum<typeof InstalledWorkloadGrantState>;
+    revokeReason: z.ZodOptional<z.ZodEnum<typeof RevokeReason>>;
+}, z.core.$strict>;
+export type InstalledWorkloadGrant = z.infer<typeof InstalledWorkloadGrantSchema>;
+export interface InstalledWorkloadGrantTarget {
+    readonly component: string;
+    readonly operation: OperationId;
+    readonly receiver: OperationGrant['receiver'];
+}
+export declare enum InstalledWorkloadGrantRefusalCode {
+    OutsideCeiling = "outside-ceiling",
+    UnknownComponent = "unknown-component"
+}
+export interface InstalledWorkloadGrantRefusal {
+    readonly code: InstalledWorkloadGrantRefusalCode;
+    readonly component: string;
+    readonly operation: OperationId;
+}
+export interface InstalledWorkloadGrantDiff {
+    readonly kept: readonly InstalledWorkloadGrantTarget[];
+    readonly added: readonly InstalledWorkloadGrantTarget[];
+    readonly removed: readonly InstalledWorkloadGrantTarget[];
+}
+export interface InstalledWorkloadGrantAdmissionInput {
+    readonly biome: string;
+    readonly requested: Readonly<Record<string, readonly OperationId[]>>;
+    readonly ceiling: readonly OperationGrant[];
+    readonly installed: readonly InstalledWorkloadGrant[] | undefined;
+}
+export interface InstalledWorkloadGrantAdmission {
+    readonly admitted: readonly InstalledWorkloadGrantTarget[];
+    readonly refused: readonly InstalledWorkloadGrantRefusal[];
+    readonly diff: InstalledWorkloadGrantDiff;
+    readonly consentRequired: boolean;
+}
+export declare function admitInstalledWorkloadGrants(input: InstalledWorkloadGrantAdmissionInput): InstalledWorkloadGrantAdmission;
+export interface InstalledEventSubscriptionConsentEntry {
+    readonly component: string;
+    readonly clauses: readonly InstalledEventSubscriptionTarget['clause'][];
+}
+export interface InstalledWorkloadGrantConsentDocument {
+    readonly biome: string;
+    readonly grants: readonly InstalledWorkloadGrantTarget[];
+    readonly eventSubscriptions: readonly InstalledEventSubscriptionConsentEntry[];
+}
+export declare function installedWorkloadGrantConsentDocument(input: {
+    readonly biome: string;
+    readonly admitted: readonly InstalledWorkloadGrantTarget[];
+    readonly admittedEventSubscriptions: readonly InstalledEventSubscriptionTarget[];
+}): InstalledWorkloadGrantConsentDocument;
+//# sourceMappingURL=installed-workload-grant.d.ts.map

package/dist/deployment/lib/installed-workload-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/installed-workload-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAIrE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AAqB7F,oBAAY,2BAA2B;IACrC,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAGD,oBAAY,YAAY;IAEtB,WAAW,gBAAgB;IAE3B,QAAQ,aAAa;IAErB,eAAe,qBAAqB;IAEpC,eAAe,qBAAqB;CACrC;AAKD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;kBAwBrC,CAAC;AAEL,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC/C;AAGD,oBAAY,iCAAiC;IAE3C,cAAc,oBAAoB;IAElC,gBAAgB,sBAAsB;CACvC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;CACjC;AAED,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,IAAI,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAEvD,QAAQ,CAAC,KAAK,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAExD,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC3D;AAED,MAAM,WAAW,oCAAoC;IAEnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC,CAAC;IAErE,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAE5C,QAAQ,CAAC,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC3D,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAO1C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AASD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,oCAAoC,GAC1C,+BAA+B,CA4CjC;AAGD,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,gCAAgC,CAAC,QAAQ,CAAC,EAAE,CAAC;CACzE;AAOD,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACzD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,sCAAsC,EAAE,CAAC;CAChF;AASD,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAClF,GAAG,qCAAqC,CAsBxC"}

package/dist/deployment/lib/installed-workload-grant.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledWorkloadGrantRefusalCode = exports.InstalledWorkloadGrantSchema = exports.RevokeReason = exports.InstalledWorkloadGrantState = void 0;
+exports.admitInstalledWorkloadGrants = admitInstalledWorkloadGrants;
+exports.installedWorkloadGrantConsentDocument = installedWorkloadGrantConsentDocument;
+const zod_1 = require("zod");
+const code_unit_order_1 = require("./code-unit-order");
+const operation_grant_1 = require("./operation-grant");
+const operation_id_1 = require("./operation-id");
+const trust_domain_1 = require("./trust-domain");
+const event_subscription_1 = require("../../event-subscription");
+var InstalledWorkloadGrantState;
+(function (InstalledWorkloadGrantState) {
+    InstalledWorkloadGrantState["Active"] = "active";
+    InstalledWorkloadGrantState["Revoked"] = "revoked";
+})(InstalledWorkloadGrantState || (exports.InstalledWorkloadGrantState = InstalledWorkloadGrantState = {}));
+var RevokeReason;
+(function (RevokeReason) {
+    RevokeReason["Uninstalled"] = "uninstalled";
+    RevokeReason["Disabled"] = "disabled";
+    RevokeReason["UpgradeNarrowed"] = "upgrade-narrowed";
+    RevokeReason["CeilingNarrowed"] = "ceiling-narrowed";
+})(RevokeReason || (exports.RevokeReason = RevokeReason = {}));
+const OrganizationIdSchema = zod_1.z.string().min(1);
+exports.InstalledWorkloadGrantSchema = zod_1.z
+    .object({
+    orgId: OrganizationIdSchema,
+    installationId: zod_1.z.string().min(1),
+    biome: zod_1.z.string().regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case'),
+    component: zod_1.z.string().min(1),
+    operation: operation_id_1.OperationIdSchema,
+    receiver: operation_grant_1.OperationGrantReceiverSchema,
+    biomeVersion: zod_1.z.string().min(1),
+    consentDigest: zod_1.z.string().min(1),
+    state: zod_1.z.nativeEnum(InstalledWorkloadGrantState),
+    revokeReason: zod_1.z.nativeEnum(RevokeReason).optional(),
+})
+    .strict()
+    .superRefine((row, ctx) => {
+    const revoked = row.state === InstalledWorkloadGrantState.Revoked;
+    if (revoked && row.revokeReason === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['revokeReason'], message: 'a revoked grant states why it was revoked' });
+    }
+    if (!revoked && row.revokeReason !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['revokeReason'], message: 'only a revoked grant states a revokeReason' });
+    }
+});
+var InstalledWorkloadGrantRefusalCode;
+(function (InstalledWorkloadGrantRefusalCode) {
+    InstalledWorkloadGrantRefusalCode["OutsideCeiling"] = "outside-ceiling";
+    InstalledWorkloadGrantRefusalCode["UnknownComponent"] = "unknown-component";
+})(InstalledWorkloadGrantRefusalCode || (exports.InstalledWorkloadGrantRefusalCode = InstalledWorkloadGrantRefusalCode = {}));
+function compareTargets(a, b) {
+    return (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) || (0, code_unit_order_1.compareCodeUnits)(a.operation, b.operation);
+}
+const keyOf = (target) => `${target.component}\u0000${target.operation}`;
+function admitInstalledWorkloadGrants(input) {
+    const ceilingRows = input.ceiling.filter((row) => row.caller.biome === input.biome);
+    const ceilingByKey = new Map(ceilingRows.map((row) => [keyOf({ component: row.caller.component, operation: row.operation }), row]));
+    const knownComponents = new Set(ceilingRows.map((row) => row.caller.component));
+    const admitted = [];
+    const refused = [];
+    for (const [component, operations] of Object.entries(input.requested)) {
+        for (const operation of new Set(operations)) {
+            const row = ceilingByKey.get(keyOf({ component, operation }));
+            if (row !== undefined) {
+                admitted.push({ component, operation, receiver: row.receiver });
+            }
+            else {
+                refused.push({
+                    code: knownComponents.has(component)
+                        ? InstalledWorkloadGrantRefusalCode.OutsideCeiling
+                        : InstalledWorkloadGrantRefusalCode.UnknownComponent,
+                    component,
+                    operation,
+                });
+            }
+        }
+    }
+    admitted.sort(compareTargets);
+    refused.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) || (0, code_unit_order_1.compareCodeUnits)(a.operation, b.operation));
+    const active = (input.installed ?? []).filter((row) => row.biome === input.biome && row.state === InstalledWorkloadGrantState.Active);
+    const activeByKey = new Map(active.map((row) => [keyOf(row), row]));
+    const admittedKeys = new Set(admitted.map(keyOf));
+    const kept = admitted.filter((target) => activeByKey.has(keyOf(target)));
+    const added = admitted.filter((target) => !activeByKey.has(keyOf(target)));
+    const removed = active
+        .filter((row) => !admittedKeys.has(keyOf(row)))
+        .map((row) => ({ component: row.component, operation: row.operation, receiver: row.receiver }))
+        .sort(compareTargets);
+    return {
+        admitted,
+        refused,
+        diff: { kept, added, removed },
+        consentRequired: input.installed !== undefined && added.length > 0,
+    };
+}
+function installedWorkloadGrantConsentDocument(input) {
+    const eventSubscriptions = [];
+    for (const target of [...input.admittedEventSubscriptions].sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
+        (0, code_unit_order_1.compareCodeUnits)((0, event_subscription_1.eventSubscriptionClauseKey)(a.clause), (0, event_subscription_1.eventSubscriptionClauseKey)(b.clause)))) {
+        const clause = { types: [...target.clause.types], tiers: [...target.clause.tiers], scope: { ...target.clause.scope } };
+        const last = eventSubscriptions[eventSubscriptions.length - 1];
+        if (last !== undefined && last.component === target.component) {
+            last.clauses.push(clause);
+        }
+        else {
+            eventSubscriptions.push({ component: target.component, clauses: [clause] });
+        }
+    }
+    return {
+        biome: input.biome,
+        grants: [...input.admitted]
+            .sort(compareTargets)
+            .map(({ component, operation, receiver }) => ({ component, operation, receiver })),
+        eventSubscriptions,
+    };
+}
+//# sourceMappingURL=installed-workload-grant.js.map

package/dist/deployment/lib/installed-workload-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-workload-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/installed-workload-grant.ts"],"names":[],"mappings":";;;AA2IA,oEA8CC;AA0BD,sFA0BC;AA7OD,6BAAwB;AAExB,uDAAqD;AACrD,uDAAsF;AACtF,iDAAqE;AACrE,iDAA+D;AAC/D,iEAAsE;AAuBtE,IAAY,2BAGX;AAHD,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,kDAAmB,CAAA;AACrB,CAAC,EAHW,2BAA2B,2CAA3B,2BAA2B,QAGtC;AAGD,IAAY,YASX;AATD,WAAY,YAAY;IAEtB,2CAA2B,CAAA;IAE3B,qCAAqB,CAAA;IAErB,oDAAoC,CAAA;IAEpC,oDAAoC,CAAA;AACtC,CAAC,EATW,YAAY,4BAAZ,YAAY,QASvB;AAED,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAGlC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,KAAK,EAAE,oBAAoB;IAC3B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC;IAC/F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,gCAAiB;IAC5B,QAAQ,EAAE,8CAA4B;IAEtC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,OAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC;IAChD,YAAY,EAAE,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,2BAA2B,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAClH,CAAC;AACH,CAAC,CAAC,CAAC;AAYL,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAE3C,uEAAkC,CAAA;IAElC,2EAAsC,CAAA;AACxC,CAAC,EALW,iCAAiC,iDAAjC,iCAAiC,QAK5C;AA0CD,SAAS,cAAc,CAAC,CAA+B,EAAE,CAA+B;IACtF,OAAO,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,MAAqE,EAAU,EAAE,CAC9F,GAAG,MAAM,CAAC,SAAS,SAAS,MAAM,CAAC,SAAS,EAAE,CAAC;AAEjD,SAAgB,4BAA4B,CAC1C,KAA2C;IAE3C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;wBAClC,CAAC,CAAC,iCAAiC,CAAC,cAAc;wBAClD,CAAC,CAAC,iCAAiC,CAAC,gBAAgB;oBACtD,SAAS;oBACT,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjH,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,2BAA2B,CAAC,MAAM,CACvF,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM;SACnB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;SAC9F,IAAI,CAAC,cAAc,CAAC,CAAC;IAExB,OAAO;QACL,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;QAC9B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;KACnE,CAAC;AACJ,CAAC;AA0BD,SAAgB,qCAAqC,CAAC,KAIrD;IACC,MAAM,kBAAkB,GAA6C,EAAE,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAA,+CAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC/F,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACvH,MAAM,IAAI,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;aACxB,IAAI,CAAC,cAAc,CAAC;aACpB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/dist/deployment/lib/operation-grant.d.ts

@@ -3,6 +3,13 @@ export declare enum OperationGrantReceiverKind {
     Biome = "biome",
     PlatformService = "platform-service"
 }
+export declare const OperationGrantReceiverSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<OperationGrantReceiverKind.Biome>;
+    biome: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<OperationGrantReceiverKind.PlatformService>;
+    service: z.ZodString;
+}, z.core.$strict>], "kind">;
 export declare const OperationGrantSchema: z.ZodObject<{
     caller: z.ZodObject<{
         biome: z.ZodString;
@@ -18,5 +25,17 @@ export declare const OperationGrantSchema: z.ZodObject<{
     }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
 export type OperationGrant = z.infer<typeof OperationGrantSchema>;
+export declare enum UngrantedOptionalOperationReason {
+    OwnerNotServed = "owner-not-served"
+}
+export declare const UngrantedOptionalOperationSchema: z.ZodObject<{
+    caller: z.ZodObject<{
+        biome: z.ZodString;
+        component: z.ZodString;
+    }, z.core.$strict>;
+    operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+    reason: z.ZodEnum<typeof UngrantedOptionalOperationReason>;
+}, z.core.$strict>;
+export type UngrantedOptionalOperation = z.infer<typeof UngrantedOptionalOperationSchema>;
 export declare function compareOperationGrants(a: Pick<OperationGrant, 'caller' | 'operation'>, b: Pick<OperationGrant, 'caller' | 'operation'>): number;
 //# sourceMappingURL=operation-grant.d.ts.map

package/dist/deployment/lib/operation-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/operation-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,oBAAY,0BAA0B;IAEpC,KAAK,UAAU;IAEf,eAAe,qBAAqB;CACrC;AAsBD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;kBAMtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAUlE,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,WAAW,CAAC,EAC/C,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,WAAW,CAAC,GAC9C,MAAM,CAMR"}
+{"version":3,"file":"operation-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/operation-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,oBAAY,0BAA0B;IAEpC,KAAK,UAAU;IAEf,eAAe,qBAAqB;CACrC;AAMD,eAAO,MAAM,4BAA4B;;;;;;4BAavC,CAAC;AAGH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;kBAMtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,oBAAY,gCAAgC;IAE1C,cAAc,qBAAqB;CACpC;AAQD,eAAO,MAAM,gCAAgC;;;;;;;kBAMlC,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,WAAW,CAAC,EAC/C,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,WAAW,CAAC,GAC9C,MAAM,CAMR"}

package/dist/deployment/lib/operation-grant.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OperationGrantSchema = exports.OperationGrantReceiverKind = void 0;
+exports.UngrantedOptionalOperationSchema = exports.UngrantedOptionalOperationReason = exports.OperationGrantSchema = exports.OperationGrantReceiverSchema = exports.OperationGrantReceiverKind = void 0;
 exports.compareOperationGrants = compareOperationGrants;
 const zod_1 = require("zod");
 const operation_id_1 = require("./operation-id");
 const trust_domain_1 = require("./trust-domain");
+const code_unit_order_1 = require("./code-unit-order");
 var OperationGrantReceiverKind;
 (function (OperationGrantReceiverKind) {
     OperationGrantReceiverKind["Biome"] = "biome";
@@ -13,7 +14,7 @@ var OperationGrantReceiverKind;
 const GrantBiomeIdSchema = zod_1.z
     .string()
     .regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case');
-const OperationGrantReceiverSchema = zod_1.z.discriminatedUnion('kind', [
+exports.OperationGrantReceiverSchema = zod_1.z.discriminatedUnion('kind', [
     zod_1.z
         .object({
         kind: zod_1.z.literal(OperationGrantReceiverKind.Biome),
@@ -31,15 +32,23 @@ exports.OperationGrantSchema = zod_1.z
     .object({
     caller: zod_1.z.object({ biome: GrantBiomeIdSchema, component: zod_1.z.string().min(1) }).strict(),
     operation: operation_id_1.OperationIdSchema,
-    receiver: OperationGrantReceiverSchema,
+    receiver: exports.OperationGrantReceiverSchema,
+})
+    .strict();
+var UngrantedOptionalOperationReason;
+(function (UngrantedOptionalOperationReason) {
+    UngrantedOptionalOperationReason["OwnerNotServed"] = "owner-not-served";
+})(UngrantedOptionalOperationReason || (exports.UngrantedOptionalOperationReason = UngrantedOptionalOperationReason = {}));
+exports.UngrantedOptionalOperationSchema = zod_1.z
+    .object({
+    caller: zod_1.z.object({ biome: GrantBiomeIdSchema, component: zod_1.z.string().min(1) }).strict(),
+    operation: operation_id_1.OperationIdSchema,
+    reason: zod_1.z.nativeEnum(UngrantedOptionalOperationReason),
 })
     .strict();
-function compareCodeUnits(a, b) {
-    return a < b ? -1 : a > b ? 1 : 0;
-}
 function compareOperationGrants(a, b) {
-    return (compareCodeUnits(a.caller.biome, b.caller.biome) ||
-        compareCodeUnits(a.caller.component, b.caller.component) ||
-        compareCodeUnits(a.operation, b.operation));
+    return ((0, code_unit_order_1.compareCodeUnits)(a.caller.biome, b.caller.biome) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.caller.component, b.caller.component) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.operation, b.operation));
 }
 //# sourceMappingURL=operation-grant.js.map

package/dist/deployment/lib/operation-grant.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/operation-grant.ts"],"names":[],"mappings":";;;AA+DA,wDASC;AAxED,6BAAwB;AAExB,iDAAmD;AACnD,iDAA+D;AAe/D,IAAY,0BAKX;AALD,WAAY,0BAA0B;IAEpC,6CAAe,CAAA;IAEf,kEAAoC,CAAA;AACtC,CAAC,EALW,0BAA0B,0CAA1B,0BAA0B,QAKrC;AAED,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEjF,MAAM,4BAA4B,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,KAAK,EAAE,kBAAkB;KAC1B,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAGU,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACtF,SAAS,EAAE,gCAAiB;IAC5B,QAAQ,EAAE,4BAA4B;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAMD,SAAgB,sBAAsB,CACpC,CAA+C,EAC/C,CAA+C;IAE/C,OAAO,CACL,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAChD,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"operation-grant.js","sourceRoot":"","sources":["../../../src/deployment/lib/operation-grant.ts"],"names":[],"mappings":";;;AAkFA,wDASC;AA3FD,6BAAwB;AAExB,iDAAmD;AACnD,iDAA+D;AAC/D,uDAAqD;AAerD,IAAY,0BAKX;AALD,WAAY,0BAA0B;IAEpC,6CAAe,CAAA;IAEf,kEAAoC,CAAA;AACtC,CAAC,EALW,0BAA0B,0CAA1B,0BAA0B,QAKrC;AAED,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEpE,QAAA,4BAA4B,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACvE,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC;QACjD,KAAK,EAAE,kBAAkB;KAC1B,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,eAAe,CAAC;QAC3D,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAGU,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACtF,SAAS,EAAE,gCAAiB;IAC5B,QAAQ,EAAE,oCAA4B;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAE1C,uEAAmC,CAAA;AACrC,CAAC,EAHW,gCAAgC,gDAAhC,gCAAgC,QAG3C;AAQY,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACtF,SAAS,EAAE,gCAAiB;IAC5B,MAAM,EAAE,OAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,SAAgB,sBAAsB,CACpC,CAA+C,EAC/C,CAA+C;IAE/C,OAAO,CACL,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAChD,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC"}

package/dist/deployment/lib/org-context-relay.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export declare const OrgContextRelaySchema: z.ZodObject<{
+    caller: z.ZodObject<{
+        biome: z.ZodString;
+        component: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OrgContextRelay = z.infer<typeof OrgContextRelaySchema>;
+export declare function compareOrgContextRelays(a: OrgContextRelay, b: OrgContextRelay): number;
+//# sourceMappingURL=org-context-relay.d.ts.map

package/dist/deployment/lib/org-context-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/org-context-relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,eAAO,MAAM,qBAAqB;;;;;kBAIvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAOpE,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAKtF"}

package/dist/deployment/lib/org-context-relay.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgContextRelaySchema = void 0;
+exports.compareOrgContextRelays = compareOrgContextRelays;
+const zod_1 = require("zod");
+const trust_domain_1 = require("./trust-domain");
+const RelayBiomeIdSchema = zod_1.z
+    .string()
+    .regex(trust_domain_1.TRUST_DOMAIN_BIOME_ID_PATTERN, 'biome id must be lowercase kebab-case');
+exports.OrgContextRelaySchema = zod_1.z
+    .object({
+    caller: zod_1.z.object({ biome: RelayBiomeIdSchema, component: zod_1.z.string().min(1) }).strict(),
+})
+    .strict();
+function compareCodeUnits(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function compareOrgContextRelays(a, b) {
+    return (compareCodeUnits(a.caller.biome, b.caller.biome) ||
+        compareCodeUnits(a.caller.component, b.caller.component));
+}
+//# sourceMappingURL=org-context-relay.js.map

package/dist/deployment/lib/org-context-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay.js","sourceRoot":"","sources":["../../../src/deployment/lib/org-context-relay.ts"],"names":[],"mappings":";;;AAmCA,0DAKC;AAxCD,6BAAwB;AAExB,iDAA+D;AAe/D,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAGpE,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACvF,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAGD,SAAgB,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IAC5E,OAAO,CACL,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAChD,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CACzD,CAAC;AACJ,CAAC"}

package/dist/deployment/lib/organization-sweep-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-sweep-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/organization-sweep-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAoB3E,eAAO,MAAM,4BAA4B;;;;;;kBAK9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAUlF,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAA;CAAE,EAChG,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAA;CAAE,GAC/F,MAAM,CAMR"}
+{"version":3,"file":"organization-sweep-grant.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/organization-sweep-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAqB3E,eAAO,MAAM,4BAA4B;;;;;;kBAK9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAA;CAAE,EAChG,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAA;CAAE,GAC/F,MAAM,CAMR"}