@xemahq/contracts 0.82.0 → 0.83.0

package/dist/distribution/lib/operation-grant-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"operation-grant-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/operation-grant-admission.ts"],"names":[],"mappings":";;;AAyEA,oDAEC;AAUD,oDAiEC;AAtJD,iDAK0B;AAIjB,2GARP,uCAA0B,OAQO;AAHnC,uDAAqD;AAgCrD,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IAEnC,6DAAgC,CAAA;IAUhC,sEAAyC,CAAA;IAEzC,6DAAgC,CAAA;AAClC,CAAC,EAfW,yBAAyB,yCAAzB,yBAAyB,QAepC;AAoBD,SAAgB,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAGD,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAKD,SAAgB,oBAAoB,CAAC,IAA8B;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACxF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,wBAAwB,SAAS,mBAAmB,SAAS,iEAAiE,CACjJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,QAAkB,CAAC;gBACvB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAItC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzD,MAAM,CACJ,yBAAyB,CAAC,iBAAiB,EAC3C,aAAa,SAAS,gBAAgB,KAAK,CAAC,EAAE,IAAI,SAAS,uBAAuB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C,CACjO,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,QAAQ,GAAG,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAC3E,CAAC;qBAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBACtC,QAAQ,GAAG,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;gBACzF,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,aAAa,SAAS,gBAAgB,KAAK,CAAC,EAAE,IAAI,SAAS,6BAA6B,MAAM,yDAAyD,CACxJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"operation-grant-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/operation-grant-admission.ts"],"names":[],"mappings":";;;AAsFA,oDAEC;AAgBD,0DAQC;AAyBD,4DA+BC;AAQD,sDAyBC;AAMD,oDAqFC;AApSD,iDAO0B;AAIjB,2GAVP,uCAA0B,OAUO;AAHnC,uDAAqD;AAuCrD,IAAY,yBAiBX;AAjBD,WAAY,yBAAyB;IAEnC,6DAAgC,CAAA;IAUhC,sEAAyC,CAAA;IAEzC,6DAAgC,CAAA;IAEhC,0EAA6C,CAAA;AAC/C,CAAC,EAjBW,yBAAyB,yCAAzB,yBAAyB,QAiBpC;AAsBD,SAAgB,oBAAoB,CAAC,KAAkB;IACrD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAGD,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAWD,SAAgB,uBAAuB,CAAC,IAA8B;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,qBAAqB,IAAI,EAAE;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AACnD,CAAC;AAGD,IAAY,yBAOX;AAPD,WAAY,yBAAyB;IAEnC,kDAAqB,CAAA;IAErB,oDAAuB,CAAA;IAEvB,6DAAgC,CAAA;AAClC,CAAC,EAPW,yBAAyB,yCAAzB,yBAAyB,QAOpC;AAeD,SAAgB,wBAAwB,CACtC,KAA6B,EAC7B,MAA8D,EAC9D,SAAsB,EACtB,QAAmC;IAEnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAI5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;gBACjD,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,uBAAuB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C;aACxP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,yBAAyB,CAAC,aAAa;QAC7C,OAAO,EAAE,aAAa,SAAS,IAAI,QAAQ,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,6BAA6B,MAAM,yDAAyD;KAC/K,CAAC;AACJ,CAAC;AAQD,SAAgB,qBAAqB,CACnC,KAA6B,EAC7B,MAAc;IAEd,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;gBACjD,OAAO,EAAE,sBAAsB,MAAM,wBAAwB,UAAU,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,6CAA6C;aAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,uCAA0B,CAAC,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,yBAAyB,CAAC,aAAa;QAC7C,OAAO,EAAE,sBAAsB,MAAM,6FAA6F;KACnI,CAAC;AACJ,CAAC;AAMD,SAAgB,oBAAoB,CAAC,IAA8B;IACjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,iBAAiB,GAAiC,EAAE,CAAC;IAE3D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACxF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,wBAAwB,SAAS,mBAAmB,SAAS,iEAAiE,CACjJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,wBAAwB,CACzC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAC9B,SAAS,EACT,yBAAyB,CAAC,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;oBACnB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,EAAE,CAAC;YAChG,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,CAAC,IAA+B,EAAE,OAAe,EAAQ,EAAE;oBACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,yBAAyB,CAAC,aAAa,EACvC,UAAU,KAAK,CAAC,EAAE,iCAAiC,SAAS,mBAAmB,SAAS,iEAAiE,CAC1J,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC3E,MAAM,CACJ,yBAAyB,CAAC,mBAAmB,EAC7C,UAAU,KAAK,CAAC,EAAE,gBAAgB,SAAS,qBAAqB,SAAS,iCAAiC,CAC3G,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,wBAAwB,CACzC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAC9B,SAAS,EACT,yBAAyB,CAAC,QAAQ,CACnC,CAAC;gBACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpG,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,yBAAyB,CAAC,aAAa,EAAE,CAAC;oBACvE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBAGN,iBAAiB,CAAC,IAAI,CAAC;wBACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE;wBACtC,SAAS;wBACT,MAAM,EAAE,6CAAgC,CAAC,cAAc;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,iBAAiB,CAAC,IAAI,CAAC,mCAAsB,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AACjD,CAAC"}

package/dist/distribution/lib/org-context-relay-admission.d.ts

@@ -0,0 +1,19 @@
+import { type OrgContextRelay } from '../../deployment';
+import type { DistributionLockReadView } from './distribution-lock';
+export type AdmittedOrgContextRelay = OrgContextRelay;
+export declare enum OrgContextRelayRefusalCode {
+    UnknownCaller = "unknown-caller"
+}
+export interface OrgContextRelayRefusal {
+    readonly code: OrgContextRelayRefusalCode;
+    readonly biome: string;
+    readonly component: string;
+    readonly message: string;
+}
+export interface OrgContextRelayAdmission {
+    readonly relays: readonly AdmittedOrgContextRelay[];
+    readonly refusals: readonly OrgContextRelayRefusal[];
+}
+export declare function admitOrgContextRelays(lock: DistributionLockReadView): OrgContextRelayAdmission;
+export declare function narrowOrgContextRelays(admitted: readonly AdmittedOrgContextRelay[], revoked: readonly OrgContextRelay[]): readonly AdmittedOrgContextRelay[];
+//# sourceMappingURL=org-context-relay-admission.d.ts.map

package/dist/distribution/lib/org-context-relay-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/org-context-relay-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAmBpE,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAGtD,oBAAY,0BAA0B;IAEpC,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACtD;AAGD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,wBAAwB,GAAG,wBAAwB,CA8B9F;AAUD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,EAC5C,OAAO,EAAE,SAAS,eAAe,EAAE,GAClC,SAAS,uBAAuB,EAAE,CAapC"}

package/dist/distribution/lib/org-context-relay-admission.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgContextRelayRefusalCode = void 0;
+exports.admitOrgContextRelays = admitOrgContextRelays;
+exports.narrowOrgContextRelays = narrowOrgContextRelays;
+const deployment_1 = require("../../deployment");
+const code_unit_order_1 = require("./code-unit-order");
+const operation_grant_admission_1 = require("./operation-grant-admission");
+var OrgContextRelayRefusalCode;
+(function (OrgContextRelayRefusalCode) {
+    OrgContextRelayRefusalCode["UnknownCaller"] = "unknown-caller";
+})(OrgContextRelayRefusalCode || (exports.OrgContextRelayRefusalCode = OrgContextRelayRefusalCode = {}));
+function admitOrgContextRelays(lock) {
+    const relays = [];
+    const refusals = [];
+    for (const biome of lock.biomes) {
+        const workloads = (0, operation_grant_admission_1.workloadComponentsOf)(biome);
+        for (const component of biome.orgContextRelayers ?? []) {
+            if (!workloads.has(component)) {
+                refusals.push({
+                    code: OrgContextRelayRefusalCode.UnknownCaller,
+                    biome: biome.id,
+                    component,
+                    message: `Biome "${biome.id}" declares that component "${component}" relays an organization context, but it is not a workload component of that biome in the lock.`,
+                });
+                continue;
+            }
+            relays.push({ caller: { biome: biome.id, component } });
+        }
+    }
+    relays.sort(deployment_1.compareOrgContextRelays);
+    const unique = relays.filter((relay, index) => index === 0 || (0, deployment_1.compareOrgContextRelays)(relays[index - 1], relay) !== 0);
+    refusals.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.biome, b.biome) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.component, b.component) ||
+        (0, code_unit_order_1.compareCodeUnits)(a.code, b.code));
+    return { relays: unique, refusals };
+}
+function narrowOrgContextRelays(admitted, revoked) {
+    const key = (row) => `${row.caller.biome}\u0000${row.caller.component}`;
+    const declared = new Set(admitted.map(key));
+    const undeclared = revoked.filter((row) => !declared.has(key(row)));
+    if (undeclared.length > 0) {
+        throw new Error(`narrowOrgContextRelays: infrastructure revokes the org-context relay of ` +
+            undeclared.map((row) => `"${row.caller.biome}/${row.caller.component}"`).join(', ') +
+            `, which the sealed lock does not declare. Infrastructure may only revoke a relay the lock declares; it can never grant one.`);
+    }
+    const revokedKeys = new Set(revoked.map(key));
+    return admitted.filter((row) => !revokedKeys.has(key(row)));
+}
+//# sourceMappingURL=org-context-relay-admission.js.map

package/dist/distribution/lib/org-context-relay-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-relay-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/org-context-relay-admission.ts"],"names":[],"mappings":";;;AA8CA,sDA8BC;AAUD,wDAgBC;AAtGD,iDAG0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAqBnE,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAEpC,8DAAgC,CAAA;AAClC,CAAC,EAHW,0BAA0B,0CAA1B,0BAA0B,QAGrC;AAgBD,SAAgB,qBAAqB,CAAC,IAA8B;IAClE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,0BAA0B,CAAC,aAAa;oBAC9C,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,SAAS;oBACT,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,8BAA8B,SAAS,iGAAiG;iBACpK,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,oCAAuB,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC,IAAI,IAAA,oCAAuB,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA4B,EAAE,KAAK,CAAC,KAAK,CAAC,CACpG,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAUD,SAAgB,sBAAsB,CACpC,QAA4C,EAC5C,OAAmC;IAEnC,MAAM,GAAG,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACnF,6HAA6H,CAChI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/distribution/lib/organization-sweep-admission.d.ts

@@ -17,4 +17,5 @@ export interface OrganizationSweepAdmission {
     readonly refusals: readonly OrganizationSweepRefusal[];
 }
 export declare function admitOrganizationSweeps(lock: DistributionLockReadView): OrganizationSweepAdmission;
+export declare function retiredOrganizationSweepsOf(grants: readonly AdmittedOrganizationSweep[]): readonly AdmittedOrganizationSweep[];
 //# sourceMappingURL=organization-sweep-admission.d.ts.map

package/dist/distribution/lib/organization-sweep-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-sweep-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAsBpE,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAG/D,oBAAY,4BAA4B;IAEtC,YAAY,kBAAkB;IAE9B,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,0BAA0B,CA8C5B"}
+{"version":3,"file":"organization-sweep-admission.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAsBpE,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAG/D,oBAAY,4BAA4B;IAEtC,YAAY,kBAAkB;IAE9B,aAAa,mBAAmB;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,0BAA0B,CA8C5B;AAUD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,SAAS,yBAAyB,EAAE,GAC3C,SAAS,yBAAyB,EAAE,CAEtC"}

package/dist/distribution/lib/organization-sweep-admission.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrganizationSweepRefusalCode = void 0;
 exports.admitOrganizationSweeps = admitOrganizationSweeps;
+exports.retiredOrganizationSweepsOf = retiredOrganizationSweepsOf;
 const deployment_1 = require("../../deployment");
 const code_unit_order_1 = require("./code-unit-order");
 const operation_grant_admission_1 = require("./operation-grant-admission");
@@ -42,4 +43,7 @@ function admitOrganizationSweeps(lock) {
         (0, code_unit_order_1.compareCodeUnits)(a.code, b.code));
     return { grants: unique, refusals };
 }
+function retiredOrganizationSweepsOf(grants) {
+    return grants.filter((grant) => deployment_1.PLATFORM_SWEEP_RETIRED_ORGANIZATION[grant.sweep]);
+}
 //# sourceMappingURL=organization-sweep-admission.js.map

package/dist/distribution/lib/organization-sweep-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-sweep-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":";;;AAuDA,0DAgDC;AAvGD,iDAI0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAwBnE,IAAY,4BAKX;AALD,WAAY,4BAA4B;IAEtC,8DAA8B,CAAA;IAE9B,gEAAgC,CAAA;AAClC,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAgBD,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAC1C,EAAE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,IAAkC,EAAE,OAAe,EAAQ,EAAE;oBAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,CACJ,4BAA4B,CAAC,YAAY,EACzC,UAAU,KAAK,CAAC,EAAE,qBAAqB,KAAK,oBAAoB,SAAS,oDAAoD,CAC9H,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,4BAA4B,CAAC,aAAa,EAC1C,UAAU,KAAK,CAAC,EAAE,oBAAoB,KAAK,mBAAmB,SAAS,iEAAiE,CACzI,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2CAA8B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC;QACX,IAAA,2CAA8B,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA8B,EAAE,KAAK,CAAC,KAAK,CAAC,CAC9F,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"organization-sweep-admission.js","sourceRoot":"","sources":["../../../src/distribution/lib/organization-sweep-admission.ts"],"names":[],"mappings":";;;AAwDA,0DAgDC;AAUD,kEAIC;AAtHD,iDAK0B;AAC1B,uDAAqD;AAErD,2EAAmE;AAwBnE,IAAY,4BAKX;AALD,WAAY,4BAA4B;IAEtC,8DAA8B,CAAA;IAE9B,gEAAgC,CAAA;AAClC,CAAC,EALW,4BAA4B,4CAA5B,4BAA4B,QAKvC;AAgBD,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,0BAAa,CAAC,CAAC,CAAC;AAGhF,SAAgB,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAA,gDAAoB,EAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAC1C,EAAE,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,IAAkC,EAAE,OAAe,EAAQ,EAAE;oBAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,CACJ,4BAA4B,CAAC,YAAY,EACzC,UAAU,KAAK,CAAC,EAAE,qBAAqB,KAAK,oBAAoB,SAAS,oDAAoD,CAC9H,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,MAAM,CACJ,4BAA4B,CAAC,aAAa,EAC1C,UAAU,KAAK,CAAC,EAAE,oBAAoB,KAAK,mBAAmB,SAAS,iEAAiE,CACzI,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2CAA8B,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,KAAK,KAAK,CAAC;QACX,IAAA,2CAA8B,EAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAA8B,EAAE,KAAK,CAAC,KAAK,CAAC,CAC9F,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC1C,IAAA,kCAAgB,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QAClC,IAAA,kCAAgB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAUD,SAAgB,2BAA2B,CACzC,MAA4C;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gDAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/distribution/lib/package-image-lock.d.ts

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+import { type BiomeManifest } from '../../biome';
+import { ImageSourceHashAlgorithm } from './image-lock';
+export declare const PACKAGE_IMAGE_LOCK_FILENAME: "xema-package-images.lock.json";
+export declare const PACKAGE_IMAGE_LOCK_SCHEMA_VERSION: 1;
+export declare enum PackageImageKind {
+    Service = "service",
+    RuntimeComponent = "runtime-component"
+}
+export declare enum PackageImageRefusalCode {
+    LockMissing = "package-image-lock-missing",
+    LockInvalid = "package-image-lock-invalid",
+    LockIncomplete = "package-image-lock-incomplete",
+    LockMismatch = "package-image-lock-mismatch",
+    ImageSignerUntrusted = "image-signer-untrusted",
+    ImageProvenanceMissing = "image-provenance-missing",
+    ImagePlatformMissing = "image-platform-missing",
+    ImageRegistryNotAllowed = "image-registry-not-allowed",
+    ImagePullCredentialUnavailable = "image-pull-credential-unavailable"
+}
+export declare const PackageImageRefusalCodeSchema: z.ZodEnum<typeof PackageImageRefusalCode>;
+export declare const PackageImagePlatformSchema: z.ZodObject<{
+    os: z.ZodString;
+    architecture: z.ZodString;
+    variant: z.ZodOptional<z.ZodString>;
+    childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+}, z.core.$strict>;
+export type PackageImagePlatform = z.infer<typeof PackageImagePlatformSchema>;
+export declare const PackageImageSourceSchema: z.ZodObject<{
+    repo: z.ZodString;
+    path: z.ZodString;
+    sourceCommit: z.ZodString;
+    sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+    contentHash: z.ZodString;
+}, z.core.$strict>;
+export type PackageImageSource = z.infer<typeof PackageImageSourceSchema>;
+export declare const PackageImageLockEntrySchema: z.ZodObject<{
+    componentKey: z.ZodString;
+    kind: z.ZodEnum<typeof PackageImageKind>;
+    indexDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+    platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        os: z.ZodString;
+        architecture: z.ZodString;
+        variant: z.ZodOptional<z.ZodString>;
+        childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+    }, z.core.$strict>>>;
+    source: z.ZodObject<{
+        repo: z.ZodString;
+        path: z.ZodString;
+        sourceCommit: z.ZodString;
+        sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+        contentHash: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type PackageImageLockEntry = z.infer<typeof PackageImageLockEntrySchema>;
+export declare const PackageImageLockSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    biomeId: z.ZodString;
+    version: z.ZodString;
+    sourceHashAlgorithm: z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV3>;
+    entries: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        componentKey: z.ZodString;
+        kind: z.ZodEnum<typeof PackageImageKind>;
+        indexDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            os: z.ZodString;
+            architecture: z.ZodString;
+            variant: z.ZodOptional<z.ZodString>;
+            childDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        }, z.core.$strict>>>;
+        source: z.ZodObject<{
+            repo: z.ZodString;
+            path: z.ZodString;
+            sourceCommit: z.ZodString;
+            sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
+            contentHash: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type PackageImageLock = z.infer<typeof PackageImageLockSchema>;
+export declare function serializePackageImageLock(lock: PackageImageLock): string;
+export declare function packageImageLockEntryFor(lock: PackageImageLock, componentKey: string): PackageImageLockEntry | undefined;
+export interface RequiredPackageImage {
+    readonly componentKey: string;
+    readonly kind: PackageImageKind;
+}
+export declare function requiredPackageImages(manifest: BiomeManifest): readonly RequiredPackageImage[];
+export type PackageImageLockGrade = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: PackageImageRefusalCode.LockIncomplete | PackageImageRefusalCode.LockMismatch;
+    readonly reason: string;
+    readonly missing: readonly string[];
+    readonly extra: readonly string[];
+    readonly wrongKind: readonly string[];
+};
+export declare function gradePackageImageLock(manifest: BiomeManifest, lock: PackageImageLock): PackageImageLockGrade;
+//# sourceMappingURL=package-image-lock.d.ts.map

package/dist/distribution/lib/package-image-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,wBAAwB,EAA8B,MAAM,cAAc,CAAC;AA4BpF,eAAO,MAAM,2BAA2B,EAAG,+BAAwC,CAAC;AAGpF,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAG5D,oBAAY,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,gBAAgB,sBAAsB;CACvC;AAOD,oBAAY,uBAAuB;IAEjC,WAAW,+BAA+B;IAE1C,WAAW,+BAA+B;IAE1C,cAAc,kCAAkC;IAEhD,YAAY,gCAAgC;IAE5C,oBAAoB,2BAA2B;IAE/C,sBAAsB,6BAA6B;IAEnD,oBAAoB,2BAA2B;IAE/C,uBAAuB,+BAA+B;IAEtD,8BAA8B,sCAAsC;CACrE;AAED,eAAO,MAAM,6BAA6B,2CAAwC,CAAC;AAenF,eAAO,MAAM,0BAA0B;;;;;kBAE5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAG9E,eAAO,MAAM,wBAAwB;;;;;;kBAQ1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAO1E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;kBAyB7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;kBAwBxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAExE;AAGD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,GACnB,qBAAqB,GAAG,SAAS,CAEnC;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AASD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,oBAAoB,EAAE,CAiB9F;AAGD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,cAAc,GAAG,uBAAuB,CAAC,YAAY,CAAC;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,CAAC;AAON,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,qBAAqB,CAsCvB"}

package/dist/distribution/lib/package-image-lock.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageImageLockSchema = exports.PackageImageLockEntrySchema = exports.PackageImageSourceSchema = exports.PackageImagePlatformSchema = exports.PackageImageRefusalCodeSchema = exports.PackageImageRefusalCode = exports.PackageImageKind = exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION = exports.PACKAGE_IMAGE_LOCK_FILENAME = void 0;
+exports.serializePackageImageLock = serializePackageImageLock;
+exports.packageImageLockEntryFor = packageImageLockEntryFor;
+exports.requiredPackageImages = requiredPackageImages;
+exports.gradePackageImageLock = gradePackageImageLock;
+const zod_1 = require("zod");
+const biome_1 = require("../../biome");
+const content_address_1 = require("../../content-address");
+const image_lock_1 = require("./image-lock");
+const kernel_contract_authority_1 = require("./kernel-contract-authority");
+exports.PACKAGE_IMAGE_LOCK_FILENAME = 'xema-package-images.lock.json';
+exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION = 1;
+var PackageImageKind;
+(function (PackageImageKind) {
+    PackageImageKind["Service"] = "service";
+    PackageImageKind["RuntimeComponent"] = "runtime-component";
+})(PackageImageKind || (exports.PackageImageKind = PackageImageKind = {}));
+var PackageImageRefusalCode;
+(function (PackageImageRefusalCode) {
+    PackageImageRefusalCode["LockMissing"] = "package-image-lock-missing";
+    PackageImageRefusalCode["LockInvalid"] = "package-image-lock-invalid";
+    PackageImageRefusalCode["LockIncomplete"] = "package-image-lock-incomplete";
+    PackageImageRefusalCode["LockMismatch"] = "package-image-lock-mismatch";
+    PackageImageRefusalCode["ImageSignerUntrusted"] = "image-signer-untrusted";
+    PackageImageRefusalCode["ImageProvenanceMissing"] = "image-provenance-missing";
+    PackageImageRefusalCode["ImagePlatformMissing"] = "image-platform-missing";
+    PackageImageRefusalCode["ImageRegistryNotAllowed"] = "image-registry-not-allowed";
+    PackageImageRefusalCode["ImagePullCredentialUnavailable"] = "image-pull-credential-unavailable";
+})(PackageImageRefusalCode || (exports.PackageImageRefusalCode = PackageImageRefusalCode = {}));
+exports.PackageImageRefusalCodeSchema = zod_1.z.nativeEnum(PackageImageRefusalCode);
+const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
+const RelativePathSchema = zod_1.z
+    .string()
+    .min(1)
+    .refine((value) => !value.startsWith('/') &&
+    !value.endsWith('/') &&
+    !value.split('/').some((segment) => segment === '' || segment === '.' || segment === '..'), 'must be a repository-relative path without traversal');
+exports.PackageImagePlatformSchema = image_lock_1.RuntimeImagePlatformSchema.extend({
+    childDigest: kernel_contract_authority_1.OciDigestSchema,
+}).strict();
+exports.PackageImageSourceSchema = zod_1.z
+    .object({
+    repo: RelativePathSchema,
+    path: RelativePathSchema,
+    sourceCommit: GitCommitSchema,
+    sourceManifestHash: kernel_contract_authority_1.BiomeSourceManifestHashSchema,
+    contentHash: content_address_1.Sha256HexSchema,
+})
+    .strict();
+function platformIdentity(platform) {
+    return `${platform.os}/${platform.architecture}/${platform.variant ?? ''}`;
+}
+exports.PackageImageLockEntrySchema = zod_1.z
+    .object({
+    componentKey: biome_1.ComponentKeySchema,
+    kind: zod_1.z.nativeEnum(PackageImageKind),
+    indexDigest: kernel_contract_authority_1.OciDigestSchema,
+    platforms: zod_1.z
+        .array(exports.PackageImagePlatformSchema)
+        .min(1)
+        .superRefine((platforms, ctx) => {
+        const seen = new Set();
+        platforms.forEach((platform, index) => {
+            const identity = platformIdentity(platform);
+            if (seen.has(identity)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [index],
+                    message: `platform ${identity} is listed more than once`,
+                });
+            }
+            seen.add(identity);
+        });
+    })
+        .readonly(),
+    source: exports.PackageImageSourceSchema,
+})
+    .strict();
+exports.PackageImageLockSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.PACKAGE_IMAGE_LOCK_SCHEMA_VERSION),
+    biomeId: biome_1.BiomeIdSchema,
+    version: zod_1.z.string().min(1),
+    sourceHashAlgorithm: zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV3),
+    entries: zod_1.z
+        .array(exports.PackageImageLockEntrySchema)
+        .min(1)
+        .superRefine((entries, ctx) => {
+        const seen = new Set();
+        entries.forEach((entry, index) => {
+            if (seen.has(entry.componentKey)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [index, 'componentKey'],
+                    message: `component "${entry.componentKey}" has more than one entry`,
+                });
+            }
+            seen.add(entry.componentKey);
+        });
+    })
+        .readonly(),
+})
+    .strict();
+function serializePackageImageLock(lock) {
+    return (0, content_address_1.canonicalJsonStringify)(lock);
+}
+function packageImageLockEntryFor(lock, componentKey) {
+    return lock.entries.find((entry) => entry.componentKey === componentKey);
+}
+function requiredPackageImages(manifest) {
+    const biomeId = manifest.xema.id;
+    const dispatched = new Set();
+    for (const component of manifest.xema.components) {
+        for (const target of component.dispatchesRuntimeComponents ?? []) {
+            if (target.biomeId === biomeId)
+                dispatched.add(target.componentKey);
+        }
+    }
+    return manifest.xema.components
+        .filter((component) => component.artifact.kind === biome_1.BiomeComponentArtifactKind.OciImage)
+        .map((component) => ({
+        componentKey: component.key,
+        kind: dispatched.has(component.key)
+            ? PackageImageKind.RuntimeComponent
+            : PackageImageKind.Service,
+    }))
+        .sort((a, b) => a.componentKey.localeCompare(b.componentKey));
+}
+function gradePackageImageLock(manifest, lock) {
+    if (lock.biomeId !== manifest.xema.id || lock.version !== manifest.version) {
+        return {
+            ok: false,
+            code: PackageImageRefusalCode.LockMismatch,
+            reason: `the image lock is for ${lock.biomeId}@${lock.version}, ` +
+                `not ${manifest.xema.id}@${manifest.version}`,
+            missing: [],
+            extra: [],
+            wrongKind: [],
+        };
+    }
+    const required = new Map(requiredPackageImages(manifest).map((image) => [image.componentKey, image.kind]));
+    const locked = new Map(lock.entries.map((entry) => [entry.componentKey, entry.kind]));
+    const missing = [...required.keys()].filter((key) => !locked.has(key));
+    const extra = [...locked.keys()].filter((key) => !required.has(key)).sort();
+    const wrongKind = [...required.entries()]
+        .filter(([key, kind]) => locked.has(key) && locked.get(key) !== kind)
+        .map(([key]) => key);
+    if (missing.length === 0 && extra.length === 0 && wrongKind.length === 0) {
+        return { ok: true };
+    }
+    const parts = [
+        missing.length > 0 ? `missing [${missing.join(', ')}]` : '',
+        extra.length > 0 ? `not image-building components [${extra.join(', ')}]` : '',
+        wrongKind.length > 0 ? `wrong kind [${wrongKind.join(', ')}]` : '',
+    ].filter((part) => part.length > 0);
+    return {
+        ok: false,
+        code: PackageImageRefusalCode.LockIncomplete,
+        reason: `the image lock of ${lock.biomeId}@${lock.version} is ${parts.join('; ')}`,
+        missing,
+        extra,
+        wrongKind,
+    };
+}
+//# sourceMappingURL=package-image-lock.js.map

package/dist/distribution/lib/package-image-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-lock.js","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-lock.ts"],"names":[],"mappings":";;;AA6KA,8DAEC;AAGD,4DAKC;AAeD,sDAiBC;AAmBD,sDAyCC;AAnRD,6BAAwB;AAExB,uCAKqB;AACrB,2DAAgF;AAChF,6CAAoF;AACpF,2EAGqC;AAwBxB,QAAA,2BAA2B,GAAG,+BAAwC,CAAC;AAGvE,QAAA,iCAAiC,GAAG,CAAU,CAAC;AAG5D,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAE1B,uCAAmB,CAAA;IAEnB,0DAAsC,CAAA;AACxC,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAOD,IAAY,uBAmBX;AAnBD,WAAY,uBAAuB;IAEjC,qEAA0C,CAAA;IAE1C,qEAA0C,CAAA;IAE1C,2EAAgD,CAAA;IAEhD,uEAA4C,CAAA;IAE5C,0EAA+C,CAAA;IAE/C,8EAAmD,CAAA;IAEnD,0EAA+C,CAAA;IAE/C,iFAAsD,CAAA;IAEtD,+FAAoE,CAAA;AACtE,CAAC,EAnBW,uBAAuB,uCAAvB,uBAAuB,QAmBlC;AAEY,QAAA,6BAA6B,GAAG,OAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAEnF,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;IACtB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;IACpB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAC5F,sDAAsD,CACvD,CAAC;AAGS,QAAA,0BAA0B,GAAG,uCAA0B,CAAC,MAAM,CAAC;IAC1E,WAAW,EAAE,2CAAe;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;AAIC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,yDAA6B;IACjD,WAAW,EAAE,iCAAe;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,SAAS,gBAAgB,CAAC,QAAoD;IAC5E,OAAO,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAC7E,CAAC;AAGY,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,YAAY,EAAE,0BAAkB;IAChC,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,2CAAe;IAC5B,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,kCAA0B,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,YAAY,QAAQ,2BAA2B;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,gCAAwB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC;IAC3D,OAAO,EAAE,qBAAa;IACtB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,mBAAmB,EAAE,OAAC,CAAC,OAAO,CAAC,qCAAwB,CAAC,YAAY,CAAC;IACrE,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,mCAA2B,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;oBAC7B,OAAO,EAAE,cAAc,KAAK,CAAC,YAAY,2BAA2B;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,SAAgB,yBAAyB,CAAC,IAAsB;IAC9D,OAAO,IAAA,wCAAsB,EAAC,IAAa,CAAC,CAAC;AAC/C,CAAC;AAGD,SAAgB,wBAAwB,CACtC,IAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;AAC3E,CAAC;AAeD,SAAgB,qBAAqB,CAAC,QAAuB;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;YACjE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU;SAC5B,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,QAAQ,CAAC;SACtF,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnB,YAAY,EAAE,SAAS,CAAC,GAAG;QAC3B,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YACjC,CAAC,CAAC,gBAAgB,CAAC,gBAAgB;YACnC,CAAC,CAAC,gBAAgB,CAAC,OAAO;KAC7B,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAClE,CAAC;AAmBD,SAAgB,qBAAqB,CACnC,QAAuB,EACvB,IAAsB;IAEtB,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB,CAAC,YAAY;YAC1C,MAAM,EACJ,yBAAyB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI;gBACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC/C,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC7E,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;KACnE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,uBAAuB,CAAC,cAAc;QAC5C,MAAM,EAAE,qBAAqB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAClF,OAAO;QACP,KAAK;QACL,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/distribution/lib/package-image-trust.d.ts

@@ -0,0 +1,36 @@
+import { SignerKind, type ArtifactSigner, type ArtifactSignerTrust, type OciPlatform } from '../../deployment';
+import { PackageImageRefusalCode, type PackageImageLock } from './package-image-lock';
+export type OidcCertificateArtifactSigner = Extract<ArtifactSigner, {
+    readonly kind: SignerKind.OidcCertificate;
+}>;
+export declare const PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME: "xema-package-images.lock.sigstore.json";
+export declare const COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE: "cosign container image signature";
+export declare function packageImageSignaturePaths(componentKey: string): {
+    readonly bundle: string;
+    readonly payload: string;
+};
+export interface PackageSignatureVerifier {
+    verify(input: {
+        readonly payload: Uint8Array;
+        readonly bundle: Uint8Array;
+        readonly signer: OidcCertificateArtifactSigner;
+    }): Promise<boolean>;
+}
+export type PackageImageTrustVerdict = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: PackageImageRefusalCode;
+    readonly reason: string;
+    readonly componentKey?: string | undefined;
+};
+export interface VerifyPackageImageSignaturesInput {
+    readonly lock: PackageImageLock;
+    readonly trust: ArtifactSignerTrust;
+    readonly readLayer: (path: string) => Uint8Array | undefined;
+    readonly verifier: PackageSignatureVerifier;
+}
+export declare function cosignIdentityRegexp(signer: OidcCertificateArtifactSigner): string;
+export declare function verifyPackageImageSignatures(input: VerifyPackageImageSignaturesInput): Promise<PackageImageTrustVerdict>;
+export declare function gradePackageImagePlatforms(lock: PackageImageLock, nodePlatforms: readonly OciPlatform[] | undefined): PackageImageTrustVerdict;
+//# sourceMappingURL=package-image-trust.d.ts.map

package/dist/distribution/lib/package-image-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-trust.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EAIV,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AA8B9B,MAAM,MAAM,6BAA6B,GAAG,OAAO,CACjD,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAA;CAAE,CAC9C,CAAC;AAGF,eAAO,MAAM,qCAAqC,EAChD,wCAAiD,CAAC;AAGpD,eAAO,MAAM,mCAAmC,EAAG,kCAA2C,CAAC;AAG/F,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAKA;AAQD,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;KAChD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAEpC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAMD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,GAAG,MAAM,CAIlF;AA0CD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,wBAAwB,CAAC,CA+CnC;AAOD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAChD,wBAAwB,CAqB1B"}

package/dist/distribution/lib/package-image-trust.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE = exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME = void 0;
+exports.packageImageSignaturePaths = packageImageSignaturePaths;
+exports.cosignIdentityRegexp = cosignIdentityRegexp;
+exports.verifyPackageImageSignatures = verifyPackageImageSignatures;
+exports.gradePackageImagePlatforms = gradePackageImagePlatforms;
+const deployment_1 = require("../../deployment");
+const package_image_lock_1 = require("./package-image-lock");
+exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME = 'xema-package-images.lock.sigstore.json';
+exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE = 'cosign container image signature';
+function packageImageSignaturePaths(componentKey) {
+    return {
+        bundle: `images/${componentKey}.sigstore.json`,
+        payload: `images/${componentKey}.payload.json`,
+    };
+}
+function cosignIdentityRegexp(signer) {
+    return 'exact' in signer.identity
+        ? `^${signer.identity.exact.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')}$`
+        : signer.identity.regexp;
+}
+function untrusted(reason, componentKey) {
+    return { ok: false, code: package_image_lock_1.PackageImageRefusalCode.ImageSignerUntrusted, reason, componentKey };
+}
+async function signedByAny(signers, payload, bundle, verifier) {
+    for (const signer of signers) {
+        if (await verifier.verify({ payload, bundle, signer })) {
+            return true;
+        }
+    }
+    return false;
+}
+function signedManifestDigest(payload) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(payload));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return undefined;
+    const critical = parsed.critical;
+    if (typeof critical !== 'object' || critical === null)
+        return undefined;
+    const { type, image } = critical;
+    if (type !== exports.COSIGN_IMAGE_SIGNATURE_PAYLOAD_TYPE)
+        return undefined;
+    if (typeof image !== 'object' || image === null)
+        return undefined;
+    const digest = image['docker-manifest-digest'];
+    return typeof digest === 'string' ? digest : undefined;
+}
+async function verifyPackageImageSignatures(input) {
+    const { lock, readLayer, verifier } = input;
+    const declared = (0, deployment_1.trustedSignersFor)(input.trust, deployment_1.ArtifactSignerScope.StorePackages);
+    const signers = declared.filter((signer) => signer.kind === deployment_1.SignerKind.OidcCertificate);
+    if (signers.length === 0) {
+        return untrusted(declared.length === 0
+            ? `the deployment declares no ${deployment_1.ArtifactSignerScope.StorePackages} signer, so it admits no store package image`
+            : `none of the deployment's ${declared.length} ${deployment_1.ArtifactSignerScope.StorePackages} signer(s) is an ${deployment_1.SignerKind.OidcCertificate} signer, and a ${deployment_1.SignerKind.PublicKey} signer cannot admit a store package image`);
+    }
+    const accepted = signers.map(deployment_1.describeArtifactSigner).join('; ');
+    const lockBundle = readLayer(exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME);
+    if (lockBundle === undefined) {
+        return untrusted(`the package carries no ${exports.PACKAGE_IMAGE_LOCK_SIGNATURE_FILENAME}`);
+    }
+    const lockBytes = new TextEncoder().encode((0, package_image_lock_1.serializePackageImageLock)(lock));
+    if (!(await signedByAny(signers, lockBytes, lockBundle, verifier))) {
+        return untrusted(`no trusted signer (${accepted}) signed the image lock`);
+    }
+    for (const entry of lock.entries) {
+        const paths = packageImageSignaturePaths(entry.componentKey);
+        const bundle = readLayer(paths.bundle);
+        const payload = readLayer(paths.payload);
+        if (bundle === undefined || payload === undefined) {
+            return untrusted(`the image of "${entry.componentKey}" carries no signature (${paths.bundle}, ${paths.payload})`, entry.componentKey);
+        }
+        const signed = signedManifestDigest(payload);
+        if (signed !== entry.indexDigest) {
+            return untrusted(`the signature of "${entry.componentKey}" covers ${signed ?? 'no image digest'}, not the sealed ${entry.indexDigest}`, entry.componentKey);
+        }
+        if (!(await signedByAny(signers, payload, bundle, verifier))) {
+            return untrusted(`no trusted signer (${accepted}) signed the image of "${entry.componentKey}"`, entry.componentKey);
+        }
+    }
+    return { ok: true };
+}
+function gradePackageImagePlatforms(lock, nodePlatforms) {
+    if (nodePlatforms === undefined) {
+        return {
+            ok: false,
+            code: package_image_lock_1.PackageImageRefusalCode.ImagePlatformMissing,
+            reason: 'the deployment states no cluster node platforms, so no store package image can be shown to run on it',
+        };
+    }
+    for (const entry of lock.entries) {
+        const served = new Set(entry.platforms.map(deployment_1.ociPlatformIdentity));
+        const missing = nodePlatforms.map(deployment_1.ociPlatformIdentity).filter((id) => !served.has(id));
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                code: package_image_lock_1.PackageImageRefusalCode.ImagePlatformMissing,
+                reason: `the image of "${entry.componentKey}" (${entry.indexDigest}) has no entry for node platform(s) [${missing.join(', ')}]`,
+                componentKey: entry.componentKey,
+            };
+        }
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=package-image-trust.js.map

package/dist/distribution/lib/package-image-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-image-trust.js","sourceRoot":"","sources":["../../../src/distribution/lib/package-image-trust.ts"],"names":[],"mappings":";;;AAyDA,gEAQC;AAuCD,oDAIC;AA0CD,oEAiDC;AAOD,gEAwBC;AAtOD,iDAS0B;AAC1B,6DAI8B;AAoCjB,QAAA,qCAAqC,GAChD,wCAAiD,CAAC;AAGvC,QAAA,mCAAmC,GAAG,kCAA2C,CAAC;AAG/F,SAAgB,0BAA0B,CAAC,YAAoB;IAI7D,OAAO;QACL,MAAM,EAAE,UAAU,YAAY,gBAAgB;QAC9C,OAAO,EAAE,UAAU,YAAY,eAAe;KAC/C,CAAC;AACJ,CAAC;AAuCD,SAAgB,oBAAoB,CAAC,MAAqC;IACxE,OAAO,OAAO,IAAI,MAAM,CAAC,QAAQ;QAC/B,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,GAAG;QACtE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,YAAqB;IACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,4CAAuB,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAiD,EACjD,OAAmB,EACnB,MAAkB,EAClB,QAAkC;IAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAS,oBAAoB,CAAC,OAAmB;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAA+C,CAAC;IACxE,IAAI,IAAI,KAAK,2CAAmC;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAAiC,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAMM,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAA,8BAAiB,EAAC,KAAK,CAAC,KAAK,EAAE,gCAAmB,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,MAAM,EAA2C,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAU,CAAC,eAAe,CAChG,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CACd,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,8BAA8B,gCAAmB,CAAC,aAAa,8CAA8C;YAC/G,CAAC,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,gCAAmB,CAAC,aAAa,oBAAoB,uBAAU,CAAC,eAAe,kBAAkB,uBAAU,CAAC,SAAS,4CAA4C,CACrN,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,6CAAqC,CAAC,CAAC;IACpE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,0BAA0B,6CAAqC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,8CAAyB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,sBAAsB,QAAQ,yBAAyB,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,SAAS,CACd,iBAAiB,KAAK,CAAC,YAAY,2BAA2B,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,EAC/F,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACjC,OAAO,SAAS,CACd,qBAAqB,KAAK,CAAC,YAAY,YAAY,MAAM,IAAI,iBAAiB,oBAAoB,KAAK,CAAC,WAAW,EAAE,EACrH,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CACd,sBAAsB,QAAQ,0BAA0B,KAAK,CAAC,YAAY,GAAG,EAC7E,KAAK,CAAC,YAAY,CACnB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAOD,SAAgB,0BAA0B,CACxC,IAAsB,EACtB,aAAiD;IAEjD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,4CAAuB,CAAC,oBAAoB;YAClD,MAAM,EAAE,sGAAsG;SAC/G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,gCAAmB,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gCAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,4CAAuB,CAAC,oBAAoB;gBAClD,MAAM,EAAE,iBAAiB,KAAK,CAAC,YAAY,MAAM,KAAK,CAAC,WAAW,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC/H,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/distribution/lib/resolve-unsplit-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-unsplit-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAqC1B,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAE/B,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IAErC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAMlC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AASD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAqE7B"}
+{"version":3,"file":"resolve-unsplit-deployment.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/resolve-unsplit-deployment.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAE/B,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IAErC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAMlC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AASD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAwG7B"}