@xemahq/contracts 0.81.0 → 0.83.0

package/dist/distribution/lib/operation-grant-admission.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OperationGrantRefusalCode = exports.OperationGrantReceiverKind = void 0;
+exports.OperationReceiverRelation = exports.OperationGrantRefusalCode = exports.OperationGrantReceiverKind = void 0;
 exports.workloadComponentsOf = workloadComponentsOf;
+exports.indexOperationReceivers = indexOperationReceivers;
+exports.resolveOperationReceiver = resolveOperationReceiver;
+exports.resolveDomainReceiver = resolveDomainReceiver;
 exports.admitOperationGrants = admitOperationGrants;
 const deployment_1 = require("../../deployment");
 Object.defineProperty(exports, "OperationGrantReceiverKind", { enumerable: true, get: function () { return deployment_1.OperationGrantReceiverKind; } });
@@ -11,6 +14,7 @@ var OperationGrantRefusalCode;
     OperationGrantRefusalCode["UnownedDomain"] = "unowned-domain";
     OperationGrantRefusalCode["ReceiverNotServed"] = "receiver-not-served";
     OperationGrantRefusalCode["UnknownCaller"] = "unknown-caller";
+    OperationGrantRefusalCode["RequiredAndOptional"] = "required-and-optional";
 })(OperationGrantRefusalCode || (exports.OperationGrantRefusalCode = OperationGrantRefusalCode = {}));
 function workloadComponentsOf(biome) {
     return new Set(biome.services);
@@ -18,7 +22,7 @@ function workloadComponentsOf(biome) {
 function domainOfOperation(operation) {
     return operation.slice(0, operation.indexOf(':'));
 }
-function admitOperationGrants(lock) {
+function indexOperationReceivers(lock) {
     const biomes = new Map(lock.biomes.map((biome) => [biome.id, biome]));
     const biomeOwnerOf = new Map(lock.capabilityDomainOwners.map((row) => [row.domain, row.biomeId]));
     const platformOwnerOf = new Map();
@@ -26,8 +30,66 @@ function admitOperationGrants(lock) {
         for (const domain of service.ownsCapabilityDomains ?? [])
             platformOwnerOf.set(domain, service.name);
     }
+    return { biomes, biomeOwnerOf, platformOwnerOf };
+}
+var OperationReceiverRelation;
+(function (OperationReceiverRelation) {
+    OperationReceiverRelation["Required"] = "required";
+    OperationReceiverRelation["Requested"] = "requested";
+    OperationReceiverRelation["Optional"] = "optionally required";
+})(OperationReceiverRelation || (exports.OperationReceiverRelation = OperationReceiverRelation = {}));
+function resolveOperationReceiver(index, caller, operation, relation) {
+    const domain = domainOfOperation(operation);
+    const ownerBiome = index.biomeOwnerOf.get(domain);
+    const ownerService = index.platformOwnerOf.get(domain);
+    if (ownerBiome !== undefined) {
+        const served = index.biomes.get(ownerBiome);
+        if (served === undefined || served.services.length === 0) {
+            return {
+                ok: false,
+                code: OperationGrantRefusalCode.ReceiverNotServed,
+                message: `Operation ${operation} ${relation} by ${caller.biome}/${caller.component} is owned by biome "${ownerBiome}", which ${served === undefined ? 'is not in this lock' : 'ships no service component'}, so nothing in this deployment exposes it.`,
+            };
+        }
+        return { ok: true, receiver: { kind: deployment_1.OperationGrantReceiverKind.Biome, biome: ownerBiome } };
+    }
+    if (ownerService !== undefined) {
+        return { ok: true, receiver: { kind: deployment_1.OperationGrantReceiverKind.PlatformService, service: ownerService } };
+    }
+    return {
+        ok: false,
+        code: OperationGrantRefusalCode.UnownedDomain,
+        message: `Operation ${operation} ${relation} by ${caller.biome}/${caller.component} is in capability domain "${domain}", which no biome or platform service in the lock owns.`,
+    };
+}
+function resolveDomainReceiver(index, domain) {
+    const ownerBiome = index.biomeOwnerOf.get(domain);
+    const ownerService = index.platformOwnerOf.get(domain);
+    if (ownerBiome !== undefined) {
+        const served = index.biomes.get(ownerBiome);
+        if (served === undefined || served.services.length === 0) {
+            return {
+                ok: false,
+                code: OperationGrantRefusalCode.ReceiverNotServed,
+                message: `Capability domain "${domain}" is owned by biome "${ownerBiome}", which ${served === undefined ? 'is not in this lock' : 'ships no service component'}, so nothing in this deployment exposes it.`,
+            };
+        }
+        return { ok: true, receiver: { kind: deployment_1.OperationGrantReceiverKind.Biome, biome: ownerBiome } };
+    }
+    if (ownerService !== undefined) {
+        return { ok: true, receiver: { kind: deployment_1.OperationGrantReceiverKind.PlatformService, service: ownerService } };
+    }
+    return {
+        ok: false,
+        code: OperationGrantRefusalCode.UnownedDomain,
+        message: `Capability domain "${domain}" is allowlisted for store workloads, but no biome or platform service in the lock owns it.`,
+    };
+}
+function admitOperationGrants(lock) {
+    const index = indexOperationReceivers(lock);
     const grants = [];
     const refusals = [];
+    const ungrantedOptional = [];
     for (const biome of lock.biomes) {
         const workloads = workloadComponentsOf(biome);
         for (const [component, operations] of Object.entries(biome.operationRequirements ?? {})) {
@@ -39,26 +101,41 @@ function admitOperationGrants(lock) {
                     refuse(OperationGrantRefusalCode.UnknownCaller, `Biome "${biome.id}" declares operation ${operation} for component "${component}", which is not a workload component of that biome in the lock.`);
                     continue;
                 }
-                const domain = domainOfOperation(operation);
-                const ownerBiome = biomeOwnerOf.get(domain);
-                const ownerService = platformOwnerOf.get(domain);
-                let receiver;
-                if (ownerBiome !== undefined) {
-                    const served = biomes.get(ownerBiome);
-                    if (served === undefined || served.services.length === 0) {
-                        refuse(OperationGrantRefusalCode.ReceiverNotServed, `Operation ${operation} required by ${biome.id}/${component} is owned by biome "${ownerBiome}", which ${served === undefined ? 'is not in this lock' : 'ships no service component'}, so nothing in this deployment exposes it.`);
-                        continue;
-                    }
-                    receiver = { kind: deployment_1.OperationGrantReceiverKind.Biome, biome: ownerBiome };
+                const resolution = resolveOperationReceiver(index, { biome: biome.id, component }, operation, OperationReceiverRelation.Required);
+                if (!resolution.ok) {
+                    refuse(resolution.code, resolution.message);
+                    continue;
                 }
-                else if (ownerService !== undefined) {
-                    receiver = { kind: deployment_1.OperationGrantReceiverKind.PlatformService, service: ownerService };
+                grants.push({ caller: { biome: biome.id, component }, operation, receiver: resolution.receiver });
+            }
+        }
+        for (const [component, operations] of Object.entries(biome.optionalOperationRequirements ?? {})) {
+            for (const operation of operations) {
+                const refuse = (code, message) => {
+                    refusals.push({ code, biome: biome.id, component, operation, message });
+                };
+                if (!workloads.has(component)) {
+                    refuse(OperationGrantRefusalCode.UnknownCaller, `Biome "${biome.id}" declares optional operation ${operation} for component "${component}", which is not a workload component of that biome in the lock.`);
+                    continue;
                 }
-                else {
-                    refuse(OperationGrantRefusalCode.UnownedDomain, `Operation ${operation} required by ${biome.id}/${component} is in capability domain "${domain}", which no biome or platform service in the lock owns.`);
+                if (biome.operationRequirements?.[component]?.includes(operation) === true) {
+                    refuse(OperationGrantRefusalCode.RequiredAndOptional, `Biome "${biome.id}" component "${component}" lists operation ${operation} as both required and optional.`);
                     continue;
                 }
-                grants.push({ caller: { biome: biome.id, component }, operation, receiver });
+                const resolution = resolveOperationReceiver(index, { biome: biome.id, component }, operation, OperationReceiverRelation.Optional);
+                if (resolution.ok) {
+                    grants.push({ caller: { biome: biome.id, component }, operation, receiver: resolution.receiver });
+                }
+                else if (resolution.code === OperationGrantRefusalCode.UnownedDomain) {
+                    refuse(resolution.code, resolution.message);
+                }
+                else {
+                    ungrantedOptional.push({
+                        caller: { biome: biome.id, component },
+                        operation,
+                        reason: deployment_1.UngrantedOptionalOperationReason.OwnerNotServed,
+                    });
+                }
             }
         }
     }
@@ -67,6 +144,7 @@ function admitOperationGrants(lock) {
         (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
         (0, code_unit_order_1.compareCodeUnits)(a.operation, b.operation) ||
         (0, code_unit_order_1.compareCodeUnits)(a.code, b.code));
-    return { grants, refusals };
+    ungrantedOptional.sort(deployment_1.compareOperationGrants);
+    return { grants, refusals, ungrantedOptional };
 }
 //# sourceMappingURL=operation-grant-admission.js.map

package/dist/distribution/lib/operation-grant-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-grant-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/operation-grant-admission.ts"],"names":[],"mappings":";;;AAyEA,oDAEC;AAUD,oDAiEC;AAtJD,iDAK0B;AAIjB,2GARP,uCAA0B,OAQO;AAHnC,uDAAqD;AAgCrD,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IAEnC,6DAAgC,CAAA;IAUhC,sEAAyC,CAAA;IAEzC,6DAAgC,CAAA;AAClC,CAAC,EAfW,yBAAyB,yCAAzB,yBAAyB,QAepC;AAoBD,SAAgB,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAGD,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAKD,SAAgB,oBAAoB,CAAC,IAA8B;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACxF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,wBAAwB,SAAS,mBAAmB,SAAS,iEAAiE,CACjJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,QAAkB,CAAC;gBACvB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAItC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzD,MAAM,CACJ,yBAAyB,CAAC,iBAAiB,EAC3C,aAAa,SAAS,gBAAgB,KAAK,CAAC,EAAE,IAAI,SAAS,uBAAuB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C,CACjO,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,QAAQ,GAAG,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAC3E,CAAC;qBAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBACtC,QAAQ,GAAG,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,aAAa,SAAS,gBAAgB,KAAK,CAAC,EAAE,IAAI,SAAS,6BAA6B,MAAM,yDAAyD,CACxJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"operation-grant-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/operation-grant-admission.ts"],"names":[],"mappings":";;;AAsFA,oDAEC;AAgBD,0DAQC;AAyBD,4DA+BC;AAQD,sDAyBC;AAMD,oDAqFC;AApSD,iDAO0B;AAIjB,2GAVP,uCAA0B,OAUO;AAHnC,uDAAqD;AAuCrD,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IAEnC,6DAAgC,CAAA;IAUhC,sEAAyC,CAAA;IAEzC,6DAAgC,CAAA;IAEhC,0EAA6C,CAAA;AAC/C,CAAC,EAjBW,yBAAyB,yCAAzB,yBAAyB,QAiBpC;AAsBD,SAAgB,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAGD,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAWD,SAAgB,uBAAuB,CAAC,IAA8B;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AACnD,CAAC;AAGD,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IAEnC,kDAAqB,CAAA;IAErB,oDAAuB,CAAA;IAEvB,6DAAgC,CAAA;AAClC,CAAC,EAPW,yBAAyB,yCAAzB,yBAAyB,QAOpC;AAeD,SAAgB,wBAAwB,CACtC,KAA6B,EAC7B,MAA8D,EAC9D,SAAsB,EACtB,QAAmC;IAEnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAI5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;gBACjD,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,uBAAuB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C;aACxP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,yBAAyB,CAAC,aAAa;QAC7C,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,6BAA6B,MAAM,yDAAyD;KAC/K,CAAC;AACJ,CAAC;AAQD,SAAgB,qBAAqB,CACnC,KAA6B,EAC7B,MAAc;IAEd,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;gBACjD,OAAO,EAAE,sBAAsB,MAAM,wBAAwB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C;aAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,yBAAyB,CAAC,aAAa;QAC7C,OAAO,EAAE,sBAAsB,MAAM,6FAA6F;KACnI,CAAC;AACJ,CAAC;AAMD,SAAgB,oBAAoB,CAAC,IAA8B;IACjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAiC,EAAE,CAAC;IAE3D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACxF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,wBAAwB,SAAS,mBAAmB,SAAS,iEAAiE,CACjJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,wBAAwB,CACzC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAC9B,SAAS,EACT,yBAAyB,CAAC,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;oBACnB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,EAAE,CAAC;YAChG,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,iCAAiC,SAAS,mBAAmB,SAAS,iEAAiE,CAC1J,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC3E,MAAM,CACJ,yBAAyB,CAAC,mBAAmB,EAC7C,UAAU,KAAK,CAAC,EAAE,gBAAgB,SAAS,qBAAqB,SAAS,iCAAiC,CAC3G,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,wBAAwB,CACzC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAC9B,SAAS,EACT,yBAAyB,CAAC,QAAQ,CACnC,CAAC;gBACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpG,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,yBAAyB,CAAC,aAAa,EAAE,CAAC;oBACvE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBAGN,iBAAiB,CAAC,IAAI,CAAC;wBACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE;wBACtC,SAAS;wBACT,MAAM,EAAE,6CAAgC,CAAC,cAAc;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,iBAAiB,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC"}

package/dist/distribution/lib/org-context-relay-admission.d.ts

@@ -0,0 +1,19 @@
+import { type OrgContextRelay } from '../../deployment';
+import type { DistributionLockReadView } from './distribution-lock';
+export type AdmittedOrgContextRelay = OrgContextRelay;
+export declare enum OrgContextRelayRefusalCode {
+    UnknownCaller = "unknown-caller"
+}
+export interface OrgContextRelayRefusal {
+    readonly code: OrgContextRelayRefusalCode;
+    readonly biome: string;
+    readonly component: string;
+    readonly message: string;
+}
+export interface OrgContextRelayAdmission {
+    readonly relays: readonly AdmittedOrgContextRelay[];
+    readonly refusals: readonly OrgContextRelayRefusal[];
+}
+export declare function admitOrgContextRelays(lock: DistributionLockReadView): OrgContextRelayAdmission;
+export declare function narrowOrgContextRelays(admitted: readonly AdmittedOrgContextRelay[], revoked: readonly OrgContextRelay[]): readonly AdmittedOrgContextRelay[];
+//# sourceMappingURL=org-context-relay-admission.d.ts.map

package/dist/distribution/lib/org-context-relay-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/org-context-relay-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAmBpE,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAGtD,oBAAY,0BAA0B;IAEpC,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACtD;AAGD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,wBAAwB,GAAG,wBAAwB,CA8B9F;AAUD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,EAC5C,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,SAAS,uBAAuB,EAAE,CAapC"}

package/dist/distribution/lib/org-context-relay-admission.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgContextRelayRefusalCode = void 0;
+exports.admitOrgContextRelays = admitOrgContextRelays;
+exports.narrowOrgContextRelays = narrowOrgContextRelays;
+const deployment_1 = require("../../deployment");
+const code_unit_order_1 = require("./code-unit-order");
+const operation_grant_admission_1 = require("./operation-grant-admission");
+var OrgContextRelayRefusalCode;
+(function (OrgContextRelayRefusalCode) {
+    OrgContextRelayRefusalCode["UnknownCaller"] = "unknown-caller";
+})(OrgContextRelayRefusalCode || (exports.OrgContextRelayRefusalCode = OrgContextRelayRefusalCode = {}));
+function admitOrgContextRelays(lock) {
+    const relays = [];
+    const refusals = [];
+    for (const biome of lock.biomes) {
+        const workloads = (0, operation_grant_admission_1.workloadComponentsOf)(biome);
+        for (const component of biome.orgContextRelayers ?? []) {
+            if (!workloads.has(component)) {
+                refusals.push({
+                    code: OrgContextRelayRefusalCode.UnknownCaller,
+                    biome: biome.id,
+                    component,
+                    message: `Biome "${biome.id}" declares that component "${component}" relays an organization context, but it is not a workload component of that biome in the lock.`,
+                });
+                continue;
+            }
+            relays.push({ caller: { biome: biome.id, component } });
+        }
+    }
+    relays.sort(deployment_1.compareOrgContextRelays);
+    const unique = relays.filter((relay, index) => index === 0 || (0, deployment_1.compareOrgContextRelays)(relays[index - 1], relay) !== 0);
+    refusals.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.biome, b.biome) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.code, b.code));
+    return { relays: unique, refusals };
+}
+function narrowOrgContextRelays(admitted, revoked) {
+    const key = (row) => `${row.caller.biome}\u0000${row.caller.component}`;
+    const declared = new Set(admitted.map(key));
+    const undeclared = revoked.filter((row) => !declared.has(key(row)));
+    if (undeclared.length > 0) {
+        throw new Error(`narrowOrgContextRelays: infrastructure revokes the org-context relay of ` +
+            undeclared.map((row) => `"${row.caller.biome}/${row.caller.component}"`).join(', ') +
+            `, which the sealed lock does not declare. Infrastructure may only revoke a relay the lock declares; it can never grant one.`);
+    }
+    const revokedKeys = new Set(revoked.map(key));
+    return admitted.filter((row) => !revokedKeys.has(key(row)));
+}
+//# sourceMappingURL=org-context-relay-admission.js.map

package/dist/distribution/lib/org-context-relay-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/org-context-relay-admission.ts"],"names":[],"mappings":";;;AA8CA,sDA8BC;AAUD,wDAgBC;AAtGD,iDAG0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAqBnE,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAEpC,8DAAgC,CAAA;AAClC,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAgBD,SAAgB,qBAAqB,CAAC,IAA8B;IAClE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,0BAA0B,CAAC,aAAa;oBAC9C,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,SAAS;oBACT,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,8BAA8B,SAAS,iGAAiG;iBACpK,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,oCAAuB,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC,IAAI,IAAA,oCAAuB,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA4B,EAAE,KAAK,CAAC,KAAK,CAAC,CACpG,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAUD,SAAgB,sBAAsB,CACpC,QAA4C,EAC5C,OAAmC;IAEnC,MAAM,GAAG,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACnF,6HAA6H,CAChI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/distribution/lib/organization-sweep-admission.d.ts

@@ -17,4 +17,5 @@ export interface OrganizationSweepAdmission {
     readonly refusals: readonly OrganizationSweepRefusal[];
 }
 export declare function admitOrganizationSweeps(lock: DistributionLockReadView): OrganizationSweepAdmission;
+export declare function retiredOrganizationSweepsOf(grants: readonly AdmittedOrganizationSweep[]): readonly AdmittedOrganizationSweep[];
 //# sourceMappingURL=organization-sweep-admission.d.ts.map

package/dist/distribution/lib/organization-sweep-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-sweep-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAsBpE,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAG/D,oBAAY,4BAA4B;IAEtC,YAAY,kBAAkB;IAE9B,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,0BAA0B,CA8C5B"}
+{"version":3,"file":"organization-sweep-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAsBpE,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAG/D,oBAAY,4BAA4B;IAEtC,YAAY,kBAAkB;IAE9B,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,0BAA0B,CA8C5B;AAUD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAC3C,SAAS,yBAAyB,EAAE,CAEtC"}

package/dist/distribution/lib/organization-sweep-admission.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrganizationSweepRefusalCode = void 0;
 exports.admitOrganizationSweeps = admitOrganizationSweeps;
+exports.retiredOrganizationSweepsOf = retiredOrganizationSweepsOf;
 const deployment_1 = require("../../deployment");
 const code_unit_order_1 = require("./code-unit-order");
 const operation_grant_admission_1 = require("./operation-grant-admission");
@@ -42,4 +43,7 @@ function admitOrganizationSweeps(lock) {
         (0, code_unit_order_1.compareCodeUnits)(a.code, b.code));
     return { grants: unique, refusals };
 }
+function retiredOrganizationSweepsOf(grants) {
+    return grants.filter((grant) => deployment_1.PLATFORM_SWEEP_RETIRED_ORGANIZATION[grant.sweep]);
+}
 //# sourceMappingURL=organization-sweep-admission.js.map

package/dist/distribution/lib/organization-sweep-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-sweep-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":";;;AAuDA,0DAgDC;AAvGD,iDAI0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAwBnE,IAAY,4BAKX;AALD,WAAY,4BAA4B;IAEtC,8DAA8B,CAAA;IAE9B,gEAAgC,CAAA;AAClC,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAgBD,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAC1C,EAAE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,IAAkC,EAAE,OAAe,EAAQ,EAAE;oBAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,CACJ,4BAA4B,CAAC,YAAY,EACzC,UAAU,KAAK,CAAC,EAAE,qBAAqB,KAAK,oBAAoB,SAAS,oDAAoD,CAC9H,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,4BAA4B,CAAC,aAAa,EAC1C,UAAU,KAAK,CAAC,EAAE,oBAAoB,KAAK,mBAAmB,SAAS,iEAAiE,CACzI,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2CAA8B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC;QACX,IAAA,2CAA8B,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA8B,EAAE,KAAK,CAAC,KAAK,CAAC,CAC9F,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"organization-sweep-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":";;;AAwDA,0DAgDC;AAUD,kEAIC;AAtHD,iDAK0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAwBnE,IAAY,4BAKX;AALD,WAAY,4BAA4B;IAEtC,8DAA8B,CAAA;IAE9B,gEAAgC,CAAA;AAClC,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAgBD,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAC1C,EAAE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,IAAkC,EAAE,OAAe,EAAQ,EAAE;oBAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,CACJ,4BAA4B,CAAC,YAAY,EACzC,UAAU,KAAK,CAAC,EAAE,qBAAqB,KAAK,oBAAoB,SAAS,oDAAoD,CAC9H,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,4BAA4B,CAAC,aAAa,EAC1C,UAAU,KAAK,CAAC,EAAE,oBAAoB,KAAK,mBAAmB,SAAS,iEAAiE,CACzI,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2CAA8B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC;QACX,IAAA,2CAA8B,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA8B,EAAE,KAAK,CAAC,KAAK,CAAC,CAC9F,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAUD,SAAgB,2BAA2B,CACzC,MAA4C;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gDAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/distribution/lib/package-image-lock.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+import { type BiomeManifest } from '../../biome';
+import { ImageSourceHashAlgorithm } from './image-lock';
+export declare const PACKAGE_IMAGE_LOCK_FILENAME: "xema-package-images.lock.json";
+export declare const PACKAGE_IMAGE_LOCK_SCHEMA_VERSION: 1;
+export declare enum PackageImageKind {
+    Service = "service",
+    RuntimeComponent = "runtime-component"
+}
+export declare enum PackageImageRefusalCode {
+    LockMissing = "package-image-lock-missing",
+    LockInvalid = "package-image-lock-invalid",
+    LockIncomplete = "package-image-lock-incomplete",
+    LockMismatch = "package-image-lock-mismatch",
+    ImageSignerUntrusted = "image-signer-untrusted",
+    ImageProvenanceMissing = "image-provenance-missing",
+    ImagePlatformMissing = "image-platform-missing",
+    ImageRegistryNotAllowed = "image-registry-not-allowed",
+    ImagePullCredentialUnavailable = "image-pull-credential-unavailable"
+}
+export declare const PackageImageRefusalCodeSchema: z.ZodEnum<typeof PackageImageRefusalCode>;
+export declare const PackageImagePlatformSchema: z.ZodObject<{
+    os: z.ZodString;
+    architecture: z.ZodString;
+    variant: z.ZodOptional<z.ZodString>;
+    childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+}, z.core.$strict>;
+export type PackageImagePlatform = z.infer<typeof PackageImagePlatformSchema>;
+export declare const PackageImageSourceSchema: z.ZodObject<{
+    repo: z.ZodString;
+    path: z.ZodString;
+    sourceCommit: z.ZodString;
+    sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+    contentHash: z.ZodString;
+}, z.core.$strict>;
+export type PackageImageSource = z.infer<typeof PackageImageSourceSchema>;
+export declare const PackageImageLockEntrySchema: z.ZodObject<{
+    componentKey: z.ZodString;
+    kind: z.ZodEnum<typeof PackageImageKind>;
+    indexDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+    platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        os: z.ZodString;
+        architecture: z.ZodString;
+        variant: z.ZodOptional<z.ZodString>;
+        childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+    }, z.core.$strict>>>;
+    source: z.ZodObject<{
+        repo: z.ZodString;
+        path: z.ZodString;
+        sourceCommit: z.ZodString;
+        sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+        contentHash: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type PackageImageLockEntry = z.infer<typeof PackageImageLockEntrySchema>;
+export declare const PackageImageLockSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    biomeId: z.ZodString;
+    version: z.ZodString;
+    sourceHashAlgorithm: z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV3>;
+    entries: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        componentKey: z.ZodString;
+        kind: z.ZodEnum<typeof PackageImageKind>;
+        indexDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            os: z.ZodString;
+            architecture: z.ZodString;
+            variant: z.ZodOptional<z.ZodString>;
+            childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        }, z.core.$strict>>>;
+        source: z.ZodObject<{
+            repo: z.ZodString;
+            path: z.ZodString;
+            sourceCommit: z.ZodString;
+            sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+            contentHash: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type PackageImageLock = z.infer<typeof PackageImageLockSchema>;
+export declare function serializePackageImageLock(lock: PackageImageLock): string;
+export declare function packageImageLockEntryFor(lock: PackageImageLock, componentKey: string): PackageImageLockEntry | undefined;
+export interface RequiredPackageImage {
+    readonly componentKey: string;
+    readonly kind: PackageImageKind;
+}
+export declare function requiredPackageImages(manifest: BiomeManifest): readonly RequiredPackageImage[];
+export type PackageImageLockGrade = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: PackageImageRefusalCode.LockIncomplete | PackageImageRefusalCode.LockMismatch;
+    readonly reason: string;
+    readonly missing: readonly string[];
+    readonly extra: readonly string[];
+    readonly wrongKind: readonly string[];
+};
+export declare function gradePackageImageLock(manifest: BiomeManifest, lock: PackageImageLock): PackageImageLockGrade;
+//# sourceMappingURL=package-image-lock.d.ts.map

package/dist/distribution/lib/package-image-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,wBAAwB,EAA8B,MAAM,cAAc,CAAC;AA4BpF,eAAO,MAAM,2BAA2B,EAAG,+BAAwC,CAAC;AAGpF,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAG5D,oBAAY,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,gBAAgB,sBAAsB;CACvC;AAOD,oBAAY,uBAAuB;IAEjC,WAAW,+BAA+B;IAE1C,WAAW,+BAA+B;IAE1C,cAAc,kCAAkC;IAEhD,YAAY,gCAAgC;IAE5C,oBAAoB,2BAA2B;IAE/C,sBAAsB,6BAA6B;IAEnD,oBAAoB,2BAA2B;IAE/C,uBAAuB,+BAA+B;IAEtD,8BAA8B,sCAAsC;CACrE;AAED,eAAO,MAAM,6BAA6B,2CAAwC,CAAC;AAenF,eAAO,MAAM,0BAA0B;;;;;kBAE5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAG9E,eAAO,MAAM,wBAAwB;;;;;;kBAQ1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAO1E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;kBAyB7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;kBAwBxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAExE;AAGD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,qBAAqB,GAAG,SAAS,CAEnC;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AASD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,oBAAoB,EAAE,CAiB9F;AAGD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,cAAc,GAAG,uBAAuB,CAAC,YAAY,CAAC;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,CAAC;AAON,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,qBAAqB,CAsCvB"}

package/dist/distribution/lib/package-image-lock.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageImageLockSchema = exports.PackageImageLockEntrySchema = exports.PackageImageSourceSchema = exports.PackageImagePlatformSchema = exports.PackageImageRefusalCodeSchema = exports.PackageImageRefusalCode = exports.PackageImageKind = exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION = exports.PACKAGE_IMAGE_LOCK_FILENAME = void 0;
+exports.serializePackageImageLock = serializePackageImageLock;
+exports.packageImageLockEntryFor = packageImageLockEntryFor;
+exports.requiredPackageImages = requiredPackageImages;
+exports.gradePackageImageLock = gradePackageImageLock;
+const zod_1 = require("zod");
+const biome_1 = require("../../biome");
+const content_address_1 = require("../../content-address");
+const image_lock_1 = require("./image-lock");
+const kernel_contract_authority_1 = require("./kernel-contract-authority");
+exports.PACKAGE_IMAGE_LOCK_FILENAME = 'xema-package-images.lock.json';
+exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION = 1;
+var PackageImageKind;
+(function (PackageImageKind) {
+    PackageImageKind["Service"] = "service";
+    PackageImageKind["RuntimeComponent"] = "runtime-component";
+})(PackageImageKind || (exports.PackageImageKind = PackageImageKind = {}));
+var PackageImageRefusalCode;
+(function (PackageImageRefusalCode) {
+    PackageImageRefusalCode["LockMissing"] = "package-image-lock-missing";
+    PackageImageRefusalCode["LockInvalid"] = "package-image-lock-invalid";
+    PackageImageRefusalCode["LockIncomplete"] = "package-image-lock-incomplete";
+    PackageImageRefusalCode["LockMismatch"] = "package-image-lock-mismatch";
+    PackageImageRefusalCode["ImageSignerUntrusted"] = "image-signer-untrusted";
+    PackageImageRefusalCode["ImageProvenanceMissing"] = "image-provenance-missing";
+    PackageImageRefusalCode["ImagePlatformMissing"] = "image-platform-missing";
+    PackageImageRefusalCode["ImageRegistryNotAllowed"] = "image-registry-not-allowed";
+    PackageImageRefusalCode["ImagePullCredentialUnavailable"] = "image-pull-credential-unavailable";
+})(PackageImageRefusalCode || (exports.PackageImageRefusalCode = PackageImageRefusalCode = {}));
+exports.PackageImageRefusalCodeSchema = zod_1.z.nativeEnum(PackageImageRefusalCode);
+const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
+const RelativePathSchema = zod_1.z
+    .string()
+    .min(1)
+    .refine((value) => !value.startsWith('/') &&
+    !value.endsWith('/') &&
+    !value.split('/').some((segment) => segment === '' || segment === '.' || segment === '..'), 'must be a repository-relative path without traversal');
+exports.PackageImagePlatformSchema = image_lock_1.RuntimeImagePlatformSchema.extend({
+    childDigest: kernel_contract_authority_1.OciDigestSchema,
+}).strict();
+exports.PackageImageSourceSchema = zod_1.z
+    .object({
+    repo: RelativePathSchema,
+    path: RelativePathSchema,
+    sourceCommit: GitCommitSchema,
+    sourceManifestHash: kernel_contract_authority_1.BiomeSourceManifestHashSchema,
+    contentHash: content_address_1.Sha256HexSchema,
+})
+    .strict();
+function platformIdentity(platform) {
+    return `${platform.os}/${platform.architecture}/${platform.variant ?? ''}`;
+}
+exports.PackageImageLockEntrySchema = zod_1.z
+    .object({
+    componentKey: biome_1.ComponentKeySchema,
+    kind: zod_1.z.nativeEnum(PackageImageKind),
+    indexDigest: kernel_contract_authority_1.OciDigestSchema,
+    platforms: zod_1.z
+        .array(exports.PackageImagePlatformSchema)
+        .min(1)
+        .superRefine((platforms, ctx) => {
+        const seen = new Set();
+        platforms.forEach((platform, index) => {
+            const identity = platformIdentity(platform);
+            if (seen.has(identity)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [index],
+                    message: `platform ${identity} is listed more than once`,
+                });
+            }
+            seen.add(identity);
+        });
+    })
+        .readonly(),
+    source: exports.PackageImageSourceSchema,
+})
+    .strict();
+exports.PackageImageLockSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION),
+    biomeId: biome_1.BiomeIdSchema,
+    version: zod_1.z.string().min(1),
+    sourceHashAlgorithm: zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV3),
+    entries: zod_1.z
+        .array(exports.PackageImageLockEntrySchema)
+        .min(1)
+        .superRefine((entries, ctx) => {
+        const seen = new Set();
+        entries.forEach((entry, index) => {
+            if (seen.has(entry.componentKey)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [index, 'componentKey'],
+                    message: `component "${entry.componentKey}" has more than one entry`,
+                });
+            }
+            seen.add(entry.componentKey);
+        });
+    })
+        .readonly(),
+})
+    .strict();
+function serializePackageImageLock(lock) {
+    return (0, content_address_1.canonicalJsonStringify)(lock);
+}
+function packageImageLockEntryFor(lock, componentKey) {
+    return lock.entries.find((entry) => entry.componentKey === componentKey);
+}
+function requiredPackageImages(manifest) {
+    const biomeId = manifest.xema.id;
+    const dispatched = new Set();
+    for (const component of manifest.xema.components) {
+        for (const target of component.dispatchesRuntimeComponents ?? []) {
+            if (target.biomeId === biomeId)
+                dispatched.add(target.componentKey);
+        }
+    }
+    return manifest.xema.components
+        .filter((component) => component.artifact.kind === biome_1.BiomeComponentArtifactKind.OciImage)
+        .map((component) => ({
+        componentKey: component.key,
+        kind: dispatched.has(component.key)
+            ? PackageImageKind.RuntimeComponent
+            : PackageImageKind.Service,
+    }))
+        .sort((a, b) => a.componentKey.localeCompare(b.componentKey));
+}
+function gradePackageImageLock(manifest, lock) {
+    if (lock.biomeId !== manifest.xema.id || lock.version !== manifest.version) {
+        return {
+            ok: false,
+            code: PackageImageRefusalCode.LockMismatch,
+            reason: `the image lock is for ${lock.biomeId}@${lock.version}, ` +
+                `not ${manifest.xema.id}@${manifest.version}`,
+            missing: [],
+            extra: [],
+            wrongKind: [],
+        };
+    }
+    const required = new Map(requiredPackageImages(manifest).map((image) => [image.componentKey, image.kind]));
+    const locked = new Map(lock.entries.map((entry) => [entry.componentKey, entry.kind]));
+    const missing = [...required.keys()].filter((key) => !locked.has(key));
+    const extra = [...locked.keys()].filter((key) => !required.has(key)).sort();
+    const wrongKind = [...required.entries()]
+        .filter(([key, kind]) => locked.has(key) && locked.get(key) !== kind)
+        .map(([key]) => key);
+    if (missing.length === 0 && extra.length === 0 && wrongKind.length === 0) {
+        return { ok: true };
+    }
+    const parts = [
+        missing.length > 0 ? `missing [${missing.join(', ')}]` : '',
+        extra.length > 0 ? `not image-building components [${extra.join(', ')}]` : '',
+        wrongKind.length > 0 ? `wrong kind [${wrongKind.join(', ')}]` : '',
+    ].filter((part) => part.length > 0);
+    return {
+        ok: false,
+        code: PackageImageRefusalCode.LockIncomplete,
+        reason: `the image lock of ${lock.biomeId}@${lock.version} is ${parts.join('; ')}`,
+        missing,
+        extra,
+        wrongKind,
+    };
+}
+//# sourceMappingURL=package-image-lock.js.map

package/dist/distribution/lib/package-image-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-lock.js","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-lock.ts"],"names":[],"mappings":";;;AA6KA,8DAEC;AAGD,4DAKC;AAeD,sDAiBC;AAmBD,sDAyCC;AAnRD,6BAAwB;AAExB,uCAKqB;AACrB,2DAAgF;AAChF,6CAAoF;AACpF,2EAGqC;AAwBxB,QAAA,2BAA2B,GAAG,+BAAwC,CAAC;AAGvE,QAAA,iCAAiC,GAAG,CAAU,CAAC;AAG5D,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAE1B,uCAAmB,CAAA;IAEnB,0DAAsC,CAAA;AACxC,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAOD,IAAY,uBAmBX;AAnBD,WAAY,uBAAuB;IAEjC,qEAA0C,CAAA;IAE1C,qEAA0C,CAAA;IAE1C,2EAAgD,CAAA;IAEhD,uEAA4C,CAAA;IAE5C,0EAA+C,CAAA;IAE/C,8EAAmD,CAAA;IAEnD,0EAA+C,CAAA;IAE/C,iFAAsD,CAAA;IAEtD,+FAAoE,CAAA;AACtE,CAAC,EAnBW,uBAAuB,uCAAvB,uBAAuB,QAmBlC;AAEY,QAAA,6BAA6B,GAAG,OAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAEnF,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;IACtB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;IACpB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAC5F,sDAAsD,CACvD,CAAC;AAGS,QAAA,0BAA0B,GAAG,uCAA0B,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,2CAAe;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;AAIC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,yDAA6B;IACjD,WAAW,EAAE,iCAAe;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,SAAS,gBAAgB,CAAC,QAAoD;IAC5E,OAAO,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAC7E,CAAC;AAGY,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,YAAY,EAAE,0BAAkB;IAChC,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,2CAAe;IAC5B,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,kCAA0B,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,YAAY,QAAQ,2BAA2B;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,gCAAwB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC;IAC3D,OAAO,EAAE,qBAAa;IACtB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mBAAmB,EAAE,OAAC,CAAC,OAAO,CAAC,qCAAwB,CAAC,YAAY,CAAC;IACrE,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,mCAA2B,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;oBAC7B,OAAO,EAAE,cAAc,KAAK,CAAC,YAAY,2BAA2B;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,SAAgB,yBAAyB,CAAC,IAAsB;IAC9D,OAAO,IAAA,wCAAsB,EAAC,IAAa,CAAC,CAAC;AAC/C,CAAC;AAGD,SAAgB,wBAAwB,CACtC,IAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;AAC3E,CAAC;AAeD,SAAgB,qBAAqB,CAAC,QAAuB;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;YACjE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU;SAC5B,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,QAAQ,CAAC;SACtF,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnB,YAAY,EAAE,SAAS,CAAC,GAAG;QAC3B,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YACjC,CAAC,CAAC,gBAAgB,CAAC,gBAAgB;YACnC,CAAC,CAAC,gBAAgB,CAAC,OAAO;KAC7B,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAmBD,SAAgB,qBAAqB,CACnC,QAAuB,EACvB,IAAsB;IAEtB,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB,CAAC,YAAY;YAC1C,MAAM,EACJ,yBAAyB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI;gBACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC/C,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC7E,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;KACnE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,uBAAuB,CAAC,cAAc;QAC5C,MAAM,EAAE,qBAAqB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAClF,OAAO;QACP,KAAK;QACL,SAAS;KACV,CAAC;AACJ,CAAC"}