@xemahq/contracts 0.81.0 → 0.83.0

package/dist/distribution/lib/package-image-trust.d.ts

@@ -0,0 +1,36 @@
+import { SignerKind, type ArtifactSigner, type ArtifactSignerTrust, type OciPlatform } from '../../deployment';
+import { PackageImageRefusalCode, type PackageImageLock } from './package-image-lock';
+export type OidcCertificateArtifactSigner = Extract<ArtifactSigner, {
+    readonly kind: SignerKind.OidcCertificate;
+}>;
+export declare const PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME: "xema-package-images.lock.sigstore.json";
+export declare const COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE: "cosign container image signature";
+export declare function packageImageSignaturePaths(componentKey: string): {
+    readonly bundle: string;
+    readonly payload: string;
+};
+export interface PackageSignatureVerifier {
+    verify(input: {
+        readonly payload: Uint8Array;
+        readonly bundle: Uint8Array;
+        readonly signer: OidcCertificateArtifactSigner;
+    }): Promise<boolean>;
+}
+export type PackageImageTrustVerdict = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: PackageImageRefusalCode;
+    readonly reason: string;
+    readonly componentKey?: string | undefined;
+};
+export interface VerifyPackageImageSignaturesInput {
+    readonly lock: PackageImageLock;
+    readonly trust: ArtifactSignerTrust;
+    readonly readLayer: (path: string) => Uint8Array | undefined;
+    readonly verifier: PackageSignatureVerifier;
+}
+export declare function cosignIdentityRegexp(signer: OidcCertificateArtifactSigner): string;
+export declare function verifyPackageImageSignatures(input: VerifyPackageImageSignaturesInput): Promise<PackageImageTrustVerdict>;
+export declare function gradePackageImagePlatforms(lock: PackageImageLock, nodePlatforms: readonly OciPlatform[] | undefined): PackageImageTrustVerdict;
+//# sourceMappingURL=package-image-trust.d.ts.map

package/dist/distribution/lib/package-image-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-trust.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EAIV,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AA8B9B,MAAM,MAAM,6BAA6B,GAAG,OAAO,CACjD,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAA;CAAE,CAC9C,CAAC;AAGF,eAAO,MAAM,qCAAqC,EAChD,wCAAiD,CAAC;AAGpD,eAAO,MAAM,mCAAmC,EAAG,kCAA2C,CAAC;AAG/F,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAKA;AAQD,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAEpC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAMD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,GAAG,MAAM,CAIlF;AA0CD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,wBAAwB,CAAC,CA+CnC;AAOD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAChD,wBAAwB,CAqB1B"}

package/dist/distribution/lib/package-image-trust.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE = exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME = void 0;
+exports.packageImageSignaturePaths = packageImageSignaturePaths;
+exports.cosignIdentityRegexp = cosignIdentityRegexp;
+exports.verifyPackageImageSignatures = verifyPackageImageSignatures;
+exports.gradePackageImagePlatforms = gradePackageImagePlatforms;
+const deployment_1 = require("../../deployment");
+const package_image_lock_1 = require("./package-image-lock");
+exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME = 'xema-package-images.lock.sigstore.json';
+exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE = 'cosign container image signature';
+function packageImageSignaturePaths(componentKey) {
+    return {
+        bundle: `images/${componentKey}.sigstore.json`,
+        payload: `images/${componentKey}.payload.json`,
+    };
+}
+function cosignIdentityRegexp(signer) {
+    return 'exact' in signer.identity
+        ? `^${signer.identity.exact.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')}$`
+        : signer.identity.regexp;
+}
+function untrusted(reason, componentKey) {
+    return { ok: false, code: package_image_lock_1.PackageImageRefusalCode.ImageSignerUntrusted, reason, componentKey };
+}
+async function signedByAny(signers, payload, bundle, verifier) {
+    for (const signer of signers) {
+        if (await verifier.verify({ payload, bundle, signer })) {
+            return true;
+        }
+    }
+    return false;
+}
+function signedManifestDigest(payload) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(payload));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return undefined;
+    const critical = parsed.critical;
+    if (typeof critical !== 'object' || critical === null)
+        return undefined;
+    const { type, image } = critical;
+    if (type !== exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE)
+        return undefined;
+    if (typeof image !== 'object' || image === null)
+        return undefined;
+    const digest = image['docker-manifest-digest'];
+    return typeof digest === 'string' ? digest : undefined;
+}
+async function verifyPackageImageSignatures(input) {
+    const { lock, readLayer, verifier } = input;
+    const declared = (0, deployment_1.trustedSignersFor)(input.trust, deployment_1.ArtifactSignerScope.StorePackages);
+    const signers = declared.filter((signer) => signer.kind === deployment_1.SignerKind.OidcCertificate);
+    if (signers.length === 0) {
+        return untrusted(declared.length === 0
+            ? `the deployment declares no ${deployment_1.ArtifactSignerScope.StorePackages} signer, so it admits no store package image`
+            : `none of the deployment's ${declared.length} ${deployment_1.ArtifactSignerScope.StorePackages} signer(s) is an ${deployment_1.SignerKind.OidcCertificate} signer, and a ${deployment_1.SignerKind.PublicKey} signer cannot admit a store package image`);
+    }
+    const accepted = signers.map(deployment_1.describeArtifactSigner).join('; ');
+    const lockBundle = readLayer(exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME);
+    if (lockBundle === undefined) {
+        return untrusted(`the package carries no ${exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME}`);
+    }
+    const lockBytes = new TextEncoder().encode((0, package_image_lock_1.serializePackageImageLock)(lock));
+    if (!(await signedByAny(signers, lockBytes, lockBundle, verifier))) {
+        return untrusted(`no trusted signer (${accepted}) signed the image lock`);
+    }
+    for (const entry of lock.entries) {
+        const paths = packageImageSignaturePaths(entry.componentKey);
+        const bundle = readLayer(paths.bundle);
+        const payload = readLayer(paths.payload);
+        if (bundle === undefined || payload === undefined) {
+            return untrusted(`the image of "${entry.componentKey}" carries no signature (${paths.bundle}, ${paths.payload})`, entry.componentKey);
+        }
+        const signed = signedManifestDigest(payload);
+        if (signed !== entry.indexDigest) {
+            return untrusted(`the signature of "${entry.componentKey}" covers ${signed ?? 'no image digest'}, not the sealed ${entry.indexDigest}`, entry.componentKey);
+        }
+        if (!(await signedByAny(signers, payload, bundle, verifier))) {
+            return untrusted(`no trusted signer (${accepted}) signed the image of "${entry.componentKey}"`, entry.componentKey);
+        }
+    }
+    return { ok: true };
+}
+function gradePackageImagePlatforms(lock, nodePlatforms) {
+    if (nodePlatforms === undefined) {
+        return {
+            ok: false,
+            code: package_image_lock_1.PackageImageRefusalCode.ImagePlatformMissing,
+            reason: 'the deployment states no cluster node platforms, so no store package image can be shown to run on it',
+        };
+    }
+    for (const entry of lock.entries) {
+        const served = new Set(entry.platforms.map(deployment_1.ociPlatformIdentity));
+        const missing = nodePlatforms.map(deployment_1.ociPlatformIdentity).filter((id) => !served.has(id));
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                code: package_image_lock_1.PackageImageRefusalCode.ImagePlatformMissing,
+                reason: `the image of "${entry.componentKey}" (${entry.indexDigest}) has no entry for node platform(s) [${missing.join(', ')}]`,
+                componentKey: entry.componentKey,
+            };
+        }
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=package-image-trust.js.map

package/dist/distribution/lib/package-image-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-trust.js","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-trust.ts"],"names":[],"mappings":";;;AAyDA,gEAQC;AAuCD,oDAIC;AA0CD,oEAiDC;AAOD,gEAwBC;AAtOD,iDAS0B;AAC1B,6DAI8B;AAoCjB,QAAA,qCAAqC,GAChD,wCAAiD,CAAC;AAGvC,QAAA,mCAAmC,GAAG,kCAA2C,CAAC;AAG/F,SAAgB,0BAA0B,CAAC,YAAoB;IAI7D,OAAO;QACL,MAAM,EAAE,UAAU,YAAY,gBAAgB;QAC9C,OAAO,EAAE,UAAU,YAAY,eAAe;KAC/C,CAAC;AACJ,CAAC;AAuCD,SAAgB,oBAAoB,CAAC,MAAqC;IACxE,OAAO,OAAO,IAAI,MAAM,CAAC,QAAQ;QAC/B,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG;QACtE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,YAAqB;IACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,4CAAuB,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAiD,EACjD,OAAmB,EACnB,MAAkB,EAClB,QAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAS,oBAAoB,CAAC,OAAmB;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAA+C,CAAC;IACxE,IAAI,IAAI,KAAK,2CAAmC;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAAiC,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAMM,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAA,8BAAiB,EAAC,KAAK,CAAC,KAAK,EAAE,gCAAmB,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,MAAM,EAA2C,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAU,CAAC,eAAe,CAChG,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CACd,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,8BAA8B,gCAAmB,CAAC,aAAa,8CAA8C;YAC/G,CAAC,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,gCAAmB,CAAC,aAAa,oBAAoB,uBAAU,CAAC,eAAe,kBAAkB,uBAAU,CAAC,SAAS,4CAA4C,CACrN,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,6CAAqC,CAAC,CAAC;IACpE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,0BAA0B,6CAAqC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,8CAAyB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,sBAAsB,QAAQ,yBAAyB,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,SAAS,CACd,iBAAiB,KAAK,CAAC,YAAY,2BAA2B,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,EAC/F,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACjC,OAAO,SAAS,CACd,qBAAqB,KAAK,CAAC,YAAY,YAAY,MAAM,IAAI,iBAAiB,oBAAoB,KAAK,CAAC,WAAW,EAAE,EACrH,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CACd,sBAAsB,QAAQ,0BAA0B,KAAK,CAAC,YAAY,GAAG,EAC7E,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAOD,SAAgB,0BAA0B,CACxC,IAAsB,EACtB,aAAiD;IAEjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,4CAAuB,CAAC,oBAAoB;YAClD,MAAM,EAAE,sGAAsG;SAC/G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,gCAAmB,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gCAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,4CAAuB,CAAC,oBAAoB;gBAClD,MAAM,EAAE,iBAAiB,KAAK,CAAC,YAAY,MAAM,KAAK,CAAC,WAAW,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC/H,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/distribution/lib/resolve-unsplit-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-unsplit-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAqC1B,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAE/B,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IAErC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAMlC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AASD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAqE7B"}
+{"version":3,"file":"resolve-unsplit-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAE/B,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IAErC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAMlC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AASD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAwG7B"}

package/dist/distribution/lib/resolve-unsplit-deployment.js

@@ -8,8 +8,12 @@ const authorization_lock_1 = require("./authorization-lock");
 const distribution_lock_1 = require("./distribution-lock");
 const image_lock_1 = require("./image-lock");
 const capability_domain_owner_duplicates_1 = require("./capability-domain-owner-duplicates");
+const event_subscription_admission_1 = require("./event-subscription-admission");
+const installed_operation_ceiling_admission_1 = require("./installed-operation-ceiling-admission");
 const operation_grant_admission_1 = require("./operation-grant-admission");
+const org_context_relay_admission_1 = require("./org-context-relay-admission");
 const organization_sweep_admission_1 = require("./organization-sweep-admission");
+const store_workload_ceiling_admission_1 = require("./store-workload-ceiling-admission");
 async function resolveUnsplitDeployment(input) {
     const lock = (0, distribution_lock_1.parseDistributionLockForReading)(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(input.lockBytes)));
     const imageLock = (0, image_lock_1.parseImageLock)(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(input.imagesLockBytes)));
@@ -32,11 +36,31 @@ async function resolveUnsplitDeployment(input) {
         throw new Error(`resolveUnsplitDeployment: the lock declares operations that cannot be admitted:\n` +
             admission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
     }
+    const ceilingAdmission = (0, installed_operation_ceiling_admission_1.admitInstalledOperationCeiling)(lock);
+    if (ceilingAdmission.refusals.length > 0) {
+        throw new Error(`resolveUnsplitDeployment: the lock requests installed operations that cannot be admitted:\n` +
+            ceilingAdmission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
+    }
+    const eventAdmission = (0, event_subscription_admission_1.admitEventSubscriptions)(lock);
+    if (eventAdmission.refusals.length > 0) {
+        throw new Error(`resolveUnsplitDeployment: the lock declares event subscriptions that cannot be admitted:\n` +
+            eventAdmission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
+    }
+    const storeCeilingAdmission = (0, store_workload_ceiling_admission_1.admitStoreWorkloadCeiling)(lock);
+    if (storeCeilingAdmission.refusals.length > 0) {
+        throw new Error(`resolveUnsplitDeployment: the lock allowlists store-workload domains that cannot be admitted:\n` +
+            storeCeilingAdmission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
+    }
     const sweepAdmission = (0, organization_sweep_admission_1.admitOrganizationSweeps)(lock);
     if (sweepAdmission.refusals.length > 0) {
         throw new Error(`resolveUnsplitDeployment: the lock declares organization sweeps that cannot be admitted:\n` +
             sweepAdmission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
     }
+    const relayAdmission = (0, org_context_relay_admission_1.admitOrgContextRelays)(lock);
+    if (relayAdmission.refusals.length > 0) {
+        throw new Error(`resolveUnsplitDeployment: the lock declares org-context relays that cannot be admitted:\n` +
+            relayAdmission.refusals.map((refusal) => `  - [${refusal.code}] ${refusal.message}`).join('\n'));
+    }
     return deployment_1.ResolvedDeploymentSchema.parse({
         schemaVersion: deployment_1.RESOLVED_DEPLOYMENT_SCHEMA_VERSION,
         deployment: input.deployment,
@@ -58,7 +82,14 @@ async function resolveUnsplitDeployment(input) {
         }),
         serviceAccounts: [],
         operationGrants: admission.grants,
+        ungrantedOptionalOperations: admission.ungrantedOptional,
+        installedOperationCeilings: ceilingAdmission.ceilings,
+        eventSubscriptionGrants: eventAdmission.grants,
+        installedEventSubscriptionCeilings: eventAdmission.installedCeilings,
+        storeWorkloadCeiling: storeCeilingAdmission.ceiling,
+        storeEventCeiling: (0, deployment_1.resolveStoreEventCeiling)(lock.storeEventCeiling),
         organizationSweeps: sweepAdmission.grants,
+        orgContextRelays: relayAdmission.relays,
         provenance: {
             kind: deployment_1.ResolvedDeploymentProvenanceKind.Unsplit,
             resolver: { package: deployment_1.RESOLVER_PACKAGE, version: input.resolverVersion },

package/dist/distribution/lib/resolve-unsplit-deployment.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-unsplit-deployment.js","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":";;AA4EA,4DAuEC;AAnJD,2DAAkD;AAClD,iDAM0B;AAC1B,6DAA4D;AAC5D,6DAAsE;AACtE,2DAAsE;AACtE,6CAA8C;AAC9C,6FAAuF;AACvF,2EAAmE;AACnE,iFAAyE;AA8DlE,KAAK,UAAU,wBAAwB,CAC5C,KAA6B;IAE7B,MAAM,IAAI,GAAG,IAAA,mDAA+B,EAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC9E,CAAC;IACF,MAAM,SAAS,GAAG,IAAA,2BAAc,EAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CACpF,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,mDAA8B,EACtD,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI;QACnC,CAAC,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC;QACzC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,cAAc,CAAC;KAChD,EAAE,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,yBAAyB,cAAc,2BAA2B,IAAI,CAAC,cAAc,IAAI,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAA,oEAA+B,EAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,sDAAuB,EAAC,IAAI,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,qCAAwB,CAAC,KAAK,CAAC;QACpC,aAAa,EAAE,+CAAkC;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,EAAE,EAAE,IAAI,CAAC,cAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,UAAU,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,SAAS,CAAC;YAC5C,gBAAgB,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,eAAe,CAAC;YACxD,uBAAuB,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,sBAAsB,CAAC;YACtE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;SACvB;QACD,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;aACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAEb,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC;QACJ,eAAe,EAAE,EAAE;QACnB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,kBAAkB,EAAE,cAAc,CAAC,MAAM;QACzC,UAAU,EAAE;YACV,IAAI,EAAE,6CAAgC,CAAC,OAAO;YAC9C,QAAQ,EAAE,EAAE,OAAO,EAAE,6BAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE;SACxE;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resolve-unsplit-deployment.js","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":";;AAiFA,4DA0GC;AA3LD,2DAAkD;AAClD,iDAO0B;AAC1B,6DAA4D;AAC5D,6DAAsE;AACtE,2DAAsE;AACtE,6CAA8C;AAC9C,6FAAuF;AACvF,iFAAyE;AACzE,mGAAyF;AACzF,2EAAmE;AACnE,+EAAsE;AACtE,iFAAyE;AACzE,yFAA+E;AA8DxE,KAAK,UAAU,wBAAwB,CAC5C,KAA6B;IAE7B,MAAM,IAAI,GAAG,IAAA,mDAA+B,EAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC9E,CAAC;IACF,MAAM,SAAS,GAAG,IAAA,2BAAc,EAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CACpF,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,mDAA8B,EACtD,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAC3F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI;QACnC,CAAC,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC;QACzC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,cAAc,CAAC;KAChD,EAAE,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,yBAAyB,cAAc,2BAA2B,IAAI,CAAC,cAAc,IAAI,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAA,oEAA+B,EAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAA,sEAA8B,EAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,sDAAuB,EAAC,IAAI,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAA,4DAAyB,EAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,qBAAqB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,iGAAiG;YAC/F,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,sDAAuB,EAAC,IAAI,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAA,mDAAqB,EAAC,IAAI,CAAC,CAAC;IACnD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,2FAA2F;YACzF,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,qCAAwB,CAAC,KAAK,CAAC;QACpC,aAAa,EAAE,+CAAkC;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE;YACP,EAAE,EAAE,IAAI,CAAC,cAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,UAAU,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,SAAS,CAAC;YAC5C,gBAAgB,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,eAAe,CAAC;YACxD,uBAAuB,EAAE,MAAM,IAAA,2BAAS,EAAC,KAAK,CAAC,sBAAsB,CAAC;YACtE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;SACvB;QACD,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;aACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAEb,MAAM,OAAO,GAAG,IAAA,qCAAkB,EAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC;QACJ,eAAe,EAAE,EAAE;QACnB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,2BAA2B,EAAE,SAAS,CAAC,iBAAiB;QACxD,0BAA0B,EAAE,gBAAgB,CAAC,QAAQ;QACrD,uBAAuB,EAAE,cAAc,CAAC,MAAM;QAC9C,kCAAkC,EAAE,cAAc,CAAC,iBAAiB;QACpE,oBAAoB,EAAE,qBAAqB,CAAC,OAAO;QACnD,iBAAiB,EAAE,IAAA,qCAAwB,EAAC,IAAI,CAAC,iBAAiB,CAAC;QACnE,kBAAkB,EAAE,cAAc,CAAC,MAAM;QACzC,gBAAgB,EAAE,cAAc,CAAC,MAAM;QACvC,UAAU,EAAE;YACV,IAAI,EAAE,6CAAgC,CAAC,OAAO;YAC9C,QAAQ,EAAE,EAAE,OAAO,EAAE,6BAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE;SACxE;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/distribution/lib/store-workload-ceiling-admission.d.ts

@@ -0,0 +1,17 @@
+import { type StoreWorkloadCeiling } from '../../deployment';
+import type { DistributionLockReadView } from './distribution-lock';
+export declare enum StoreWorkloadCeilingAdmissionRefusalCode {
+    UnownedDomain = "unowned-domain",
+    ReceiverNotServed = "receiver-not-served"
+}
+export interface StoreWorkloadCeilingAdmissionRefusal {
+    readonly code: StoreWorkloadCeilingAdmissionRefusalCode;
+    readonly domain: string;
+    readonly message: string;
+}
+export interface StoreWorkloadCeilingAdmission {
+    readonly ceiling: StoreWorkloadCeiling;
+    readonly refusals: readonly StoreWorkloadCeilingAdmissionRefusal[];
+}
+export declare function admitStoreWorkloadCeiling(lock: DistributionLockReadView): StoreWorkloadCeilingAdmission;
+//# sourceMappingURL=store-workload-ceiling-admission.d.ts.map

package/dist/distribution/lib/store-workload-ceiling-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-workload-ceiling-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/store-workload-ceiling-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AA4BpE,oBAAY,wCAAwC;IAElD,aAAa,mBAAmB;IAEhC,iBAAiB,wBAAwB;CAC1C;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,IAAI,EAAE,wCAAwC,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAE5C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oCAAoC,EAAE,CAAC;CACpE;AAOD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,wBAAwB,GAAG,6BAA6B,CAwBvG"}

package/dist/distribution/lib/store-workload-ceiling-admission.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreWorkloadCeilingAdmissionRefusalCode = void 0;
+exports.admitStoreWorkloadCeiling = admitStoreWorkloadCeiling;
+const deployment_1 = require("../../deployment");
+const code_unit_order_1 = require("./code-unit-order");
+const operation_grant_admission_1 = require("./operation-grant-admission");
+var StoreWorkloadCeilingAdmissionRefusalCode;
+(function (StoreWorkloadCeilingAdmissionRefusalCode) {
+    StoreWorkloadCeilingAdmissionRefusalCode["UnownedDomain"] = "unowned-domain";
+    StoreWorkloadCeilingAdmissionRefusalCode["ReceiverNotServed"] = "receiver-not-served";
+})(StoreWorkloadCeilingAdmissionRefusalCode || (exports.StoreWorkloadCeilingAdmissionRefusalCode = StoreWorkloadCeilingAdmissionRefusalCode = {}));
+function reservedDomainsOf(index) {
+    return [...new Set([...index.biomeOwnerOf.keys(), ...index.platformOwnerOf.keys()])].sort(code_unit_order_1.compareCodeUnits);
+}
+function admitStoreWorkloadCeiling(lock) {
+    const index = (0, operation_grant_admission_1.indexOperationReceivers)(lock);
+    const receivers = [];
+    const refusals = [];
+    for (const domain of lock.storeWorkloadCeiling?.receiverDomains ?? []) {
+        const resolution = (0, operation_grant_admission_1.resolveDomainReceiver)(index, domain);
+        if (resolution.ok) {
+            receivers.push({ domain, receiver: resolution.receiver });
+        }
+        else {
+            refusals.push({
+                code: resolution.code === operation_grant_admission_1.OperationGrantRefusalCode.UnownedDomain
+                    ? StoreWorkloadCeilingAdmissionRefusalCode.UnownedDomain
+                    : StoreWorkloadCeilingAdmissionRefusalCode.ReceiverNotServed,
+                domain,
+                message: resolution.message,
+            });
+        }
+    }
+    receivers.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.domain, b.domain));
+    refusals.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.domain, b.domain));
+    const ceiling = deployment_1.StoreWorkloadCeilingSchema.parse({ receivers, reservedDomains: reservedDomainsOf(index) });
+    return { ceiling, refusals };
+}
+//# sourceMappingURL=store-workload-ceiling-admission.js.map

package/dist/distribution/lib/store-workload-ceiling-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-workload-ceiling-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/store-workload-ceiling-admission.ts"],"names":[],"mappings":";;;AAuDA,8DAwBC;AA/ED,iDAAyF;AACzF,uDAAqD;AAErD,2EAKqC;AAsBrC,IAAY,wCAKX;AALD,WAAY,wCAAwC;IAElD,4EAAgC,CAAA;IAEhC,qFAAyC,CAAA;AAC3C,CAAC,EALW,wCAAwC,wDAAxC,wCAAwC,QAKnD;AAeD,SAAS,iBAAiB,CAAC,KAA6B;IACtD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kCAAgB,CAAC,CAAC;AAC9G,CAAC;AAGD,SAAgB,yBAAyB,CAAC,IAA8B;IACtE,MAAM,KAAK,GAAG,IAAA,mDAAuB,EAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,IAAA,iDAAqB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;YAClB,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EACF,UAAU,CAAC,IAAI,KAAK,qDAAyB,CAAC,aAAa;oBACzD,CAAC,CAAC,wCAAwC,CAAC,aAAa;oBACxD,CAAC,CAAC,wCAAwC,CAAC,iBAAiB;gBAChE,MAAM;gBACN,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,kCAAgB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,uCAA0B,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/distribution/lib/store-workload-ceiling.d.ts

@@ -0,0 +1,6 @@
+import { z } from 'zod';
+export declare const StoreWorkloadCeilingDeclarationSchema: z.ZodReadonly<z.ZodObject<{
+    receiverDomains: z.ZodReadonly<z.ZodArray<z.ZodType<import("../../capability").CapabilityDomain, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityDomain, unknown>>>>;
+}, z.core.$strict>>;
+export type StoreWorkloadCeilingDeclaration = z.infer<typeof StoreWorkloadCeilingDeclarationSchema>;
+//# sourceMappingURL=store-workload-ceiling.d.ts.map

package/dist/distribution/lib/store-workload-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-workload-ceiling.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/store-workload-ceiling.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,eAAO,MAAM,qCAAqC;;mBAKrC,CAAC;AAEd,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}

package/dist/distribution/lib/store-workload-ceiling.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreWorkloadCeilingDeclarationSchema = void 0;
+const zod_1 = require("zod");
+const capability_1 = require("../../capability");
+const sorted_unique_non_empty_1 = require("./sorted-unique-non-empty");
+exports.StoreWorkloadCeilingDeclarationSchema = zod_1.z
+    .object({
+    receiverDomains: (0, sorted_unique_non_empty_1.sortedUniqueNonEmpty)(capability_1.CapabilityDomainSchema, 'receiverDomains'),
+})
+    .strict()
+    .readonly();
+//# sourceMappingURL=store-workload-ceiling.js.map

package/dist/distribution/lib/store-workload-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-workload-ceiling.js","sourceRoot":"","sources":["../../../src/distribution/lib/store-workload-ceiling.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,iDAA0D;AAC1D,uEAAiE;AAoBpD,QAAA,qCAAqC,GAAG,OAAC;KACnD,MAAM,CAAC;IACN,eAAe,EAAE,IAAA,8CAAoB,EAAC,mCAAsB,EAAE,iBAAiB,CAAC;CACjF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,EAAE,CAAC"}

package/dist/distribution/lib/verify-resolved-deployment.d.ts

@@ -16,11 +16,23 @@ export declare enum ResolvedDeploymentRefusalCode {
     BiomeMissing = "biome-missing",
     BiomeNotInLock = "biome-not-in-lock",
     TrustCeilingMismatch = "trust-ceiling-mismatch",
+    CeilingsMerged = "ceilings-merged",
     UnknownComponent = "unknown-component",
     OperationGrantRefused = "operation-grant-refused",
     OperationGrantsMismatch = "operation-grants-mismatch",
+    UngrantedOptionalOperationsMismatch = "ungranted-optional-operations-mismatch",
+    InstalledOperationCeilingRefused = "installed-operation-ceiling-refused",
+    InstalledOperationCeilingsMismatch = "installed-operation-ceilings-mismatch",
+    EventSubscriptionRefused = "event-subscription-refused",
+    EventSubscriptionGrantsMismatch = "event-subscription-grants-mismatch",
+    InstalledEventSubscriptionCeilingsMismatch = "installed-event-subscription-ceilings-mismatch",
+    StoreWorkloadCeilingRefused = "store-workload-ceiling-refused",
+    StoreWorkloadCeilingMismatch = "store-workload-ceiling-mismatch",
+    StoreEventCeilingMismatch = "store-event-ceiling-mismatch",
     OrganizationSweepRefused = "organization-sweep-refused",
     OrganizationSweepsMismatch = "organization-sweeps-mismatch",
+    OrgContextRelayRefused = "org-context-relay-refused",
+    OrgContextRelaysMismatch = "org-context-relays-mismatch",
     DuplicateCapabilityDomainOwner = "duplicate-capability-domain-owner"
 }
 export interface ResolvedDeploymentRefusal {

package/dist/distribution/lib/verify-resolved-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/verify-resolved-deployment.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,yBAAyB,EAEzB,gCAAgC,EAEjC,MAAM,gCAAgC,CAAC;AAsCxC,oBAAY,4BAA4B;IAEtC,MAAM,WAAW;IAEjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,+BAA+B,CAC9C,CAAC,SAAS,4BAA4B,GAAG,4BAA4B;IAGrE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrB;AAGD,oBAAY,6BAA6B;IAEvC,iBAAiB,uBAAuB;IAExC,kBAAkB,yBAAyB;IAE3C,iBAAiB,wBAAwB;IAEzC,kBAAkB,yBAAyB;IAE3C,aAAa,mBAAmB;IAKhC,iBAAiB,wBAAwB;IAEzC,YAAY,kBAAkB;IAE9B,cAAc,sBAAsB;IAEpC,oBAAoB,2BAA2B;IAE/C,gBAAgB,sBAAsB;IAEtC,qBAAqB,4BAA4B;IAEjD,uBAAuB,8BAA8B;IAErD,wBAAwB,+BAA+B;IAEvD,0BAA0B,iCAAiC;IAE3D,8BAA8B,sCAAsC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAE7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AAED,MAAM,MAAM,8BAA8B,GACtC,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,yBAAyB,CAAC,GACnD,yBAAyB,CAAC;AAE9B,MAAM,MAAM,qCAAqC,GAC7C,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,gCAAgC,CAAC,GAC1D,yBAAyB,CAAC;AA6C9B,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,+BAA+B,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAC7E,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAC3C,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,OAAO,CAAC;CACvD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAAC;AAkLlD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,+BAA+B,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAC7E,OAAO,CAAC,yBAAyB,CAAC,CAAC;AACtC,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,OAAO,CAAC;CACvD,GACA,OAAO,CAAC,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"verify-resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/verify-resolved-deployment.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,yBAAyB,EAEzB,gCAAgC,EAEjC,MAAM,gCAAgC,CAAC;AAsCxC,oBAAY,4BAA4B;IAEtC,MAAM,WAAW;IAEjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,+BAA+B,CAC9C,CAAC,SAAS,4BAA4B,GAAG,4BAA4B;IAGrE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrB;AAGD,oBAAY,6BAA6B;IAEvC,iBAAiB,uBAAuB;IAExC,kBAAkB,yBAAyB;IAE3C,iBAAiB,wBAAwB;IAEzC,kBAAkB,yBAAyB;IAE3C,aAAa,mBAAmB;IAKhC,iBAAiB,wBAAwB;IAEzC,YAAY,kBAAkB;IAE9B,cAAc,sBAAsB;IAEpC,oBAAoB,2BAA2B;IAE/C,cAAc,oBAAoB;IAElC,gBAAgB,sBAAsB;IAEtC,qBAAqB,4BAA4B;IAEjD,uBAAuB,8BAA8B;IAErD,mCAAmC,2CAA2C;IAE9E,gCAAgC,wCAAwC;IAExE,kCAAkC,0CAA0C;IAE5E,wBAAwB,+BAA+B;IAEvD,+BAA+B,uCAAuC;IAEtE,0CAA0C,mDAAmD;IAE7F,2BAA2B,mCAAmC;IAE9D,4BAA4B,oCAAoC;IAEhE,yBAAyB,iCAAiC;IAE1D,wBAAwB,+BAA+B;IAEvD,0BAA0B,iCAAiC;IAE3D,sBAAsB,8BAA8B;IAEpD,wBAAwB,gCAAgC;IAExD,8BAA8B,sCAAsC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAE7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AAED,MAAM,MAAM,8BAA8B,GACtC,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,yBAAyB,CAAC,GACnD,yBAAyB,CAAC;AAE9B,MAAM,MAAM,qCAAqC,GAC7C,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,gCAAgC,CAAC,GAC1D,yBAAyB,CAAC;AA6C9B,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,+BAA+B,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAC7E,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAC3C,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,OAAO,CAAC;CACvD,GACA,OAAO,CAAC,qCAAqC,CAAC,CAAC;AA4RlD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,+BAA+B,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAC7E,OAAO,CAAC,yBAAyB,CAAC,CAAC;AACtC,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,OAAO,CAAC;CACvD,GACA,OAAO,CAAC,gCAAgC,CAAC,CAAC"}

package/dist/distribution/lib/verify-resolved-deployment.js

@@ -6,7 +6,11 @@ exports.assertResolvedDeployment = assertResolvedDeployment;
 const content_address_1 = require("../../content-address");
 const code_unit_order_1 = require("./code-unit-order");
 const capability_domain_owner_duplicates_1 = require("./capability-domain-owner-duplicates");
+const event_subscription_admission_1 = require("./event-subscription-admission");
+const installed_operation_ceiling_admission_1 = require("./installed-operation-ceiling-admission");
+const store_workload_ceiling_admission_1 = require("./store-workload-ceiling-admission");
 const operation_grant_admission_1 = require("./operation-grant-admission");
+const org_context_relay_admission_1 = require("./org-context-relay-admission");
 const organization_sweep_admission_1 = require("./organization-sweep-admission");
 const deployment_1 = require("../../deployment");
 const process_topology_1 = require("../../process-topology");
@@ -27,11 +31,23 @@ var ResolvedDeploymentRefusalCode;
     ResolvedDeploymentRefusalCode["BiomeMissing"] = "biome-missing";
     ResolvedDeploymentRefusalCode["BiomeNotInLock"] = "biome-not-in-lock";
     ResolvedDeploymentRefusalCode["TrustCeilingMismatch"] = "trust-ceiling-mismatch";
+    ResolvedDeploymentRefusalCode["CeilingsMerged"] = "ceilings-merged";
     ResolvedDeploymentRefusalCode["UnknownComponent"] = "unknown-component";
     ResolvedDeploymentRefusalCode["OperationGrantRefused"] = "operation-grant-refused";
     ResolvedDeploymentRefusalCode["OperationGrantsMismatch"] = "operation-grants-mismatch";
+    ResolvedDeploymentRefusalCode["UngrantedOptionalOperationsMismatch"] = "ungranted-optional-operations-mismatch";
+    ResolvedDeploymentRefusalCode["InstalledOperationCeilingRefused"] = "installed-operation-ceiling-refused";
+    ResolvedDeploymentRefusalCode["InstalledOperationCeilingsMismatch"] = "installed-operation-ceilings-mismatch";
+    ResolvedDeploymentRefusalCode["EventSubscriptionRefused"] = "event-subscription-refused";
+    ResolvedDeploymentRefusalCode["EventSubscriptionGrantsMismatch"] = "event-subscription-grants-mismatch";
+    ResolvedDeploymentRefusalCode["InstalledEventSubscriptionCeilingsMismatch"] = "installed-event-subscription-ceilings-mismatch";
+    ResolvedDeploymentRefusalCode["StoreWorkloadCeilingRefused"] = "store-workload-ceiling-refused";
+    ResolvedDeploymentRefusalCode["StoreWorkloadCeilingMismatch"] = "store-workload-ceiling-mismatch";
+    ResolvedDeploymentRefusalCode["StoreEventCeilingMismatch"] = "store-event-ceiling-mismatch";
     ResolvedDeploymentRefusalCode["OrganizationSweepRefused"] = "organization-sweep-refused";
     ResolvedDeploymentRefusalCode["OrganizationSweepsMismatch"] = "organization-sweeps-mismatch";
+    ResolvedDeploymentRefusalCode["OrgContextRelayRefused"] = "org-context-relay-refused";
+    ResolvedDeploymentRefusalCode["OrgContextRelaysMismatch"] = "org-context-relays-mismatch";
     ResolvedDeploymentRefusalCode["DuplicateCapabilityDomainOwner"] = "duplicate-capability-domain-owner";
 })(ResolvedDeploymentRefusalCode || (exports.ResolvedDeploymentRefusalCode = ResolvedDeploymentRefusalCode = {}));
 function acceptanceOf(options) {
@@ -118,6 +134,7 @@ async function verifyResolvedDeployment(resolved, lockBytes, options) {
             });
         }
     }
+    const lockPartition = [];
     for (const biome of artifact.biomes) {
         const locked = lockBiomes.get(biome.id);
         if (locked === undefined) {
@@ -130,6 +147,7 @@ async function verifyResolvedDeployment(resolved, lockBytes, options) {
         }
         const stated = "trustCeiling" in locked ? locked.trustCeiling : undefined;
         const ceiling = stated ?? (0, process_topology_1.defaultTrustDomain)(locked.id, locked.origin);
+        lockPartition.push({ id: biome.id, trustCeiling: ceiling, trustDomain: biome.trustDomain });
         if (biome.trustCeiling !== ceiling) {
             refusals.push({
                 code: ResolvedDeploymentRefusalCode.TrustCeilingMismatch,
@@ -139,6 +157,12 @@ async function verifyResolvedDeployment(resolved, lockBytes, options) {
             });
         }
     }
+    for (const violation of (0, deployment_1.gradeTrustRefinement)(lockPartition)) {
+        refusals.push({
+            code: ResolvedDeploymentRefusalCode.CeilingsMerged,
+            message: violation.message,
+        });
+    }
     for (const account of artifact.serviceAccounts) {
         for (const { biome, component } of account.actsFor) {
             const locked = lockBiomes.get(biome);
@@ -170,11 +194,82 @@ async function verifyResolvedDeployment(resolved, lockBytes, options) {
             });
         }
         if (admission.refusals.length === 0) {
-            const mismatch = describeGrantMismatch(artifact.operationGrants, admission.grants);
+            const mismatch = describeGrantMismatch("operationGrants", artifact.operationGrants, admission.grants);
             if (mismatch !== undefined) {
                 refusals.push({ code: ResolvedDeploymentRefusalCode.OperationGrantsMismatch, message: mismatch });
             }
         }
+        if (admission.refusals.length === 0) {
+            const mismatch = describeRowsMismatch("ungrantedOptionalOperations", artifact.ungrantedOptionalOperations, admission.ungrantedOptional);
+            if (mismatch !== undefined) {
+                refusals.push({ code: ResolvedDeploymentRefusalCode.UngrantedOptionalOperationsMismatch, message: mismatch });
+            }
+        }
+        const ceilingAdmission = (0, installed_operation_ceiling_admission_1.admitInstalledOperationCeiling)(lock);
+        for (const refusal of ceilingAdmission.refusals) {
+            refusals.push({
+                code: ResolvedDeploymentRefusalCode.InstalledOperationCeilingRefused,
+                biome: refusal.biome,
+                message: `[${refusal.code}] ${refusal.message}`,
+            });
+        }
+        if (ceilingAdmission.refusals.length === 0) {
+            const mismatch = describeGrantMismatch("installedOperationCeilings", artifact.installedOperationCeilings, ceilingAdmission.ceilings);
+            if (mismatch !== undefined) {
+                refusals.push({ code: ResolvedDeploymentRefusalCode.InstalledOperationCeilingsMismatch, message: mismatch });
+            }
+        }
+        const eventAdmission = (0, event_subscription_admission_1.admitEventSubscriptions)(lock);
+        for (const refusal of eventAdmission.refusals) {
+            refusals.push({
+                code: ResolvedDeploymentRefusalCode.EventSubscriptionRefused,
+                biome: refusal.biome,
+                message: `[${refusal.code}] ${refusal.message}`,
+            });
+        }
+        if (eventAdmission.refusals.length === 0) {
+            for (const [field, code, stated, admitted] of [
+                [
+                    "eventSubscriptionGrants",
+                    ResolvedDeploymentRefusalCode.EventSubscriptionGrantsMismatch,
+                    artifact.eventSubscriptionGrants,
+                    eventAdmission.grants,
+                ],
+                [
+                    "installedEventSubscriptionCeilings",
+                    ResolvedDeploymentRefusalCode.InstalledEventSubscriptionCeilingsMismatch,
+                    artifact.installedEventSubscriptionCeilings,
+                    eventAdmission.installedCeilings,
+                ],
+            ]) {
+                const mismatch = describeRowsMismatch(field, stated, admitted);
+                if (mismatch !== undefined)
+                    refusals.push({ code, message: mismatch });
+            }
+        }
+        const storeCeilingAdmission = (0, store_workload_ceiling_admission_1.admitStoreWorkloadCeiling)(lock);
+        for (const refusal of storeCeilingAdmission.refusals) {
+            refusals.push({
+                code: ResolvedDeploymentRefusalCode.StoreWorkloadCeilingRefused,
+                message: `[${refusal.code}] ${refusal.message}`,
+            });
+        }
+        if (storeCeilingAdmission.refusals.length === 0 &&
+            JSON.stringify(artifact.storeWorkloadCeiling) !== JSON.stringify(storeCeilingAdmission.ceiling)) {
+            refusals.push({
+                code: ResolvedDeploymentRefusalCode.StoreWorkloadCeilingMismatch,
+                message: "the resolved deployment's storeWorkloadCeiling differs from what the lock admits: " +
+                    `it states ${JSON.stringify(artifact.storeWorkloadCeiling)}, but the lock admits ${JSON.stringify(storeCeilingAdmission.ceiling)}.`,
+            });
+        }
+        const storeEventCeiling = (0, deployment_1.resolveStoreEventCeiling)(lock.storeEventCeiling);
+        if (JSON.stringify(artifact.storeEventCeiling) !== JSON.stringify(storeEventCeiling)) {
+            refusals.push({
+                code: ResolvedDeploymentRefusalCode.StoreEventCeilingMismatch,
+                message: "the resolved deployment's storeEventCeiling differs from the lock's: " +
+                    `it states ${JSON.stringify(artifact.storeEventCeiling)}, but the lock carries ${JSON.stringify(storeEventCeiling)}.`,
+            });
+        }
         const sweepAdmission = (0, organization_sweep_admission_1.admitOrganizationSweeps)(lock);
         for (const refusal of sweepAdmission.refusals) {
             refusals.push({
@@ -190,6 +285,20 @@ async function verifyResolvedDeployment(resolved, lockBytes, options) {
             }
         }
     }
+    const relayAdmission = (0, org_context_relay_admission_1.admitOrgContextRelays)(lock);
+    for (const refusal of relayAdmission.refusals) {
+        refusals.push({
+            code: ResolvedDeploymentRefusalCode.OrgContextRelayRefused,
+            biome: refusal.biome,
+            message: `[${refusal.code}] ${refusal.message}`,
+        });
+    }
+    if (relayAdmission.refusals.length === 0) {
+        const mismatch = describeRelayMismatch(artifact.orgContextRelays, relayAdmission.relays);
+        if (mismatch !== undefined) {
+            refusals.push({ code: ResolvedDeploymentRefusalCode.OrgContextRelaysMismatch, message: mismatch });
+        }
+    }
     if (refusals.length > 0)
         return { ok: false, refusals };
     if (unsplit) {
@@ -222,7 +331,7 @@ function grantText(grant) {
     const receiver = grant.receiver.kind === deployment_1.OperationGrantReceiverKind.Biome ? `biome "${grant.receiver.biome}"` : `platform service "${grant.receiver.service}"`;
     return `${grant.caller.biome}/${grant.caller.component} -> ${grant.operation} on ${receiver}`;
 }
-function describeGrantMismatch(stated, admitted) {
+function describeGrantMismatch(field, stated, admitted) {
     const shared = Math.min(stated.length, admitted.length);
     for (let index = 0; index < shared; index++) {
         const have = stated[index];
@@ -230,12 +339,27 @@ function describeGrantMismatch(stated, admitted) {
         if (have === undefined || want === undefined)
             continue;
         if ((0, deployment_1.compareOperationGrants)(have, want) !== 0 || grantText(have) !== grantText(want)) {
-            return (`the resolved deployment's operationGrants differ from the lock's admitted grants at row ${index}: ` +
+            return (`the resolved deployment's ${field} differ from the lock's admitted rows at row ${index}: ` +
                 `it states "${grantText(have)}", but the lock admits "${grantText(want)}".`);
         }
     }
     if (stated.length !== admitted.length) {
-        return (`the resolved deployment states ${stated.length} operationGrants, but the lock admits ${admitted.length}.`);
+        return (`the resolved deployment states ${stated.length} ${field}, but the lock admits ${admitted.length}.`);
+    }
+    return undefined;
+}
+function describeRowsMismatch(field, stated, admitted) {
+    const shared = Math.min(stated.length, admitted.length);
+    for (let index = 0; index < shared; index++) {
+        const have = JSON.stringify(stated[index]);
+        const want = JSON.stringify(admitted[index]);
+        if (have !== want) {
+            return (`the resolved deployment's ${field} differ from the lock's admitted rows at row ${index}: ` +
+                `it states ${have}, but the lock admits ${want}.`);
+        }
+    }
+    if (stated.length !== admitted.length) {
+        return `the resolved deployment states ${stated.length} ${field}, but the lock admits ${admitted.length}.`;
     }
     return undefined;
 }
@@ -259,4 +383,24 @@ function describeSweepMismatch(stated, admitted) {
     }
     return undefined;
 }
+function relayText(row) {
+    return `${row.caller.biome}/${row.caller.component}`;
+}
+function describeRelayMismatch(stated, admitted) {
+    const shared = Math.min(stated.length, admitted.length);
+    for (let index = 0; index < shared; index++) {
+        const have = stated[index];
+        const want = admitted[index];
+        if (have === undefined || want === undefined)
+            continue;
+        if ((0, deployment_1.compareOrgContextRelays)(have, want) !== 0) {
+            return (`the resolved deployment's orgContextRelays differ from the lock's admitted relays at row ${index}: ` +
+                `it states "${relayText(have)}", but the lock admits "${relayText(want)}".`);
+        }
+    }
+    if (stated.length !== admitted.length) {
+        return `the resolved deployment states ${stated.length} orgContextRelays, but the lock admits ${admitted.length}.`;
+    }
+    return undefined;
+}
 //# sourceMappingURL=verify-resolved-deployment.js.map