@xemahq/contracts 0.82.0 → 0.84.0

package/dist/deployment/lib/platform-sweep.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PlatformSweepSchema = exports.PlatformSweep = void 0;
+exports.PLATFORM_SWEEP_RETIRED_ORGANIZATION = exports.PlatformSweepSchema = exports.PlatformSweep = void 0;
 const zod_1 = require("zod");
 var PlatformSweep;
 (function (PlatformSweep) {
@@ -16,6 +16,22 @@ var PlatformSweep;
     PlatformSweep["ScmProjectBindingMaintenance"] = "scm-project-binding-maintenance";
     PlatformSweep["ContributionConvergence"] = "contribution-convergence";
     PlatformSweep["RetentionExpiryErasure"] = "retention-expiry-erasure";
+    PlatformSweep["InstallationCleanup"] = "installation-cleanup";
 })(PlatformSweep || (exports.PlatformSweep = PlatformSweep = {}));
 exports.PlatformSweepSchema = zod_1.z.enum(PlatformSweep);
+exports.PLATFORM_SWEEP_RETIRED_ORGANIZATION = {
+    [PlatformSweep.EraseSweep]: true,
+    [PlatformSweep.OrgErasure]: true,
+    [PlatformSweep.AppErasure]: true,
+    [PlatformSweep.IndexMaintenance]: false,
+    [PlatformSweep.ConnectorSecretCustody]: false,
+    [PlatformSweep.CredentialRefresh]: false,
+    [PlatformSweep.ConnectionHealthProbe]: false,
+    [PlatformSweep.MemberNotification]: false,
+    [PlatformSweep.EndedHolderErasure]: false,
+    [PlatformSweep.ScmProjectBindingMaintenance]: false,
+    [PlatformSweep.ContributionConvergence]: false,
+    [PlatformSweep.RetentionExpiryErasure]: false,
+    [PlatformSweep.InstallationCleanup]: false,
+};
 //# sourceMappingURL=platform-sweep.js.map

package/dist/deployment/lib/platform-sweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/deployment/lib/platform-sweep.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAuBxB,IAAY,aAsFX;AAtFD,WAAY,aAAa;IAUvB,2CAA0B,CAAA;IAO1B,2CAA0B,CAAA;IAK1B,2CAA0B,CAAA;IAM1B,uDAAsC,CAAA;IAKtC,oEAAmD,CAAA;IAKnD,yDAAwC,CAAA;IAMxC,kEAAiD,CAAA;IAOjD,2DAA0C,CAAA;IAU1C,4DAA2C,CAAA;IAU3C,iFAAgE,CAAA;IAMhE,qEAAoD,CAAA;IAQpD,oEAAmD,CAAA;AACrD,CAAC,EAtFW,aAAa,6BAAb,aAAa,QAsFxB;AAGY,QAAA,mBAAmB,GAAG,OAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"platform-sweep.js","sourceRoot":"","sources":["../../../src/deployment/lib/platform-sweep.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAuBxB,IAAY,aAgGX;AAhGD,WAAY,aAAa;IAUvB,2CAA0B,CAAA;IAO1B,2CAA0B,CAAA;IAK1B,2CAA0B,CAAA;IAM1B,uDAAsC,CAAA;IAKtC,oEAAmD,CAAA;IAKnD,yDAAwC,CAAA;IAMxC,kEAAiD,CAAA;IAOjD,2DAA0C,CAAA;IAU1C,4DAA2C,CAAA;IAU3C,iFAAgE,CAAA;IAMhE,qEAAoD,CAAA;IAQpD,oEAAmD,CAAA;IAUnD,6DAA4C,CAAA;AAC9C,CAAC,EAhGW,aAAa,6BAAb,aAAa,QAgGxB;AAGY,QAAA,mBAAmB,GAAG,OAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAU5C,QAAA,mCAAmC,GAA6C;IAC3F,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI;IAChC,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI;IAChC,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI;IAChC,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,KAAK;IACvC,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE,KAAK;IAC7C,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,KAAK;IACxC,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE,KAAK;IAC5C,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,KAAK;IACzC,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,KAAK;IACzC,CAAC,aAAa,CAAC,4BAA4B,CAAC,EAAE,KAAK;IACnD,CAAC,aAAa,CAAC,uBAAuB,CAAC,EAAE,KAAK;IAC9C,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE,KAAK;IAC7C,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,KAAK;CAC3C,CAAC"}

package/dist/deployment/lib/resolved-deployment.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { OperationGrantReceiverKind } from './operation-grant';
-export declare const RESOLVED_DEPLOYMENT_SCHEMA_VERSION: 3;
+export declare const RESOLVED_DEPLOYMENT_SCHEMA_VERSION: 4;
 export declare const RESOLVER_PACKAGE: "@xemahq/contracts";
 export declare enum ResolvedDeploymentProvenanceKind {
     Engine = "engine",
@@ -9,8 +9,25 @@ export declare enum ResolvedDeploymentProvenanceKind {
 export declare const DNS_LABEL_PATTERN: RegExp;
 export declare const EDITION_OCI_REF_PATTERN: RegExp;
 export declare const EditionOciRefSchema: z.ZodString;
+export declare const OciPlatformSchema: z.ZodObject<{
+    os: z.ZodString;
+    architecture: z.ZodString;
+    variant: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OciPlatform = z.infer<typeof OciPlatformSchema>;
+export declare function ociPlatformIdentity(platform: OciPlatform): string;
+export declare const ResolvedClusterSchema: z.ZodObject<{
+    nodePlatforms: z.ZodArray<z.ZodObject<{
+        os: z.ZodString;
+        architecture: z.ZodString;
+        variant: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    allowedImageRegistries: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ResolvedCluster = z.infer<typeof ResolvedClusterSchema>;
+export declare function isAllowedImageRepository(repository: string, allowed: readonly string[]): boolean;
 export declare const ResolvedDeploymentSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     deployment: z.ZodString;
     runtimeNamespace: z.ZodString;
     edition: z.ZodObject<{
@@ -49,6 +66,76 @@ export declare const ResolvedDeploymentSchema: z.ZodObject<{
             service: z.ZodString;
         }, z.core.$strict>], "kind">;
     }, z.core.$strict>>;
+    ungrantedOptionalOperations: z.ZodArray<z.ZodObject<{
+        caller: z.ZodObject<{
+            biome: z.ZodString;
+            component: z.ZodString;
+        }, z.core.$strict>;
+        operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+        reason: z.ZodEnum<typeof import("./operation-grant").UngrantedOptionalOperationReason>;
+    }, z.core.$strict>>;
+    installedOperationCeilings: z.ZodArray<z.ZodObject<{
+        caller: z.ZodObject<{
+            biome: z.ZodString;
+            component: z.ZodString;
+        }, z.core.$strict>;
+        operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
+        receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<OperationGrantReceiverKind.Biome>;
+            biome: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<OperationGrantReceiverKind.PlatformService>;
+            service: z.ZodString;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>>;
+    eventSubscriptionGrants: z.ZodArray<z.ZodObject<{
+        caller: z.ZodObject<{
+            biome: z.ZodString;
+            component: z.ZodString;
+        }, z.core.$strict>;
+        clauses: z.ZodArray<z.ZodObject<{
+            types: z.ZodArray<z.ZodString>;
+            tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<import("../../event-subscription").EventSubscriptionScopeKind.Org>;
+                org: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("../../event-subscription").EventSubscriptionScopeKind.Realm>;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    installedEventSubscriptionCeilings: z.ZodArray<z.ZodObject<{
+        caller: z.ZodObject<{
+            biome: z.ZodString;
+            component: z.ZodString;
+        }, z.core.$strict>;
+        clauses: z.ZodArray<z.ZodObject<{
+            types: z.ZodArray<z.ZodString>;
+            tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<import("../../event-subscription").EventSubscriptionScopeKind.Org>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<import("../../event-subscription").EventSubscriptionScopeKind.Realm>;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    storeWorkloadCeiling: z.ZodObject<{
+        receivers: z.ZodArray<z.ZodObject<{
+            domain: z.ZodType<import("../../capability-domain").CapabilityDomain, unknown, z.core.$ZodTypeInternals<import("../../capability-domain").CapabilityDomain, unknown>>;
+            receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<OperationGrantReceiverKind.Biome>;
+                biome: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<OperationGrantReceiverKind.PlatformService>;
+                service: z.ZodString;
+            }, z.core.$strict>], "kind">;
+        }, z.core.$strict>>;
+        reservedDomains: z.ZodArray<z.ZodType<import("../../capability-domain").CapabilityDomain, unknown, z.core.$ZodTypeInternals<import("../../capability-domain").CapabilityDomain, unknown>>>;
+    }, z.core.$strict>;
+    storeEventCeiling: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        types: z.ZodArray<z.ZodString>;
+        tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+    }, z.core.$strict>>>;
     organizationSweeps: z.ZodArray<z.ZodObject<{
         caller: z.ZodObject<{
             biome: z.ZodString;
@@ -56,6 +143,12 @@ export declare const ResolvedDeploymentSchema: z.ZodObject<{
         }, z.core.$strict>;
         sweep: z.ZodEnum<typeof import("./platform-sweep").PlatformSweep>;
     }, z.core.$strict>>;
+    orgContextRelays: z.ZodArray<z.ZodObject<{
+        caller: z.ZodObject<{
+            biome: z.ZodString;
+            component: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
     provenance: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodOptional<z.ZodLiteral<ResolvedDeploymentProvenanceKind.Engine>>;
         topologyInputHash: z.ZodString;
@@ -71,6 +164,32 @@ export declare const ResolvedDeploymentSchema: z.ZodObject<{
             version: z.ZodString;
         }, z.core.$strict>;
     }, z.core.$strict>]>;
+    cluster: z.ZodOptional<z.ZodObject<{
+        nodePlatforms: z.ZodArray<z.ZodObject<{
+            os: z.ZodString;
+            architecture: z.ZodString;
+            variant: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        allowedImageRegistries: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    artifactSignerTrust: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<import("./artifact-signer-trust").SignerKind.OidcCertificate>;
+        scope: z.ZodEnum<typeof import("./artifact-signer-trust").ArtifactSignerScope>;
+        oidcIssuer: z.ZodString;
+        identity: z.ZodUnion<readonly [z.ZodObject<{
+            exact: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            regexp: z.ZodString;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<import("./artifact-signer-trust").SignerKind.PublicKey>;
+        scope: z.ZodEnum<typeof import("./artifact-signer-trust").ArtifactSignerScope>;
+        publicKey: z.ZodObject<{
+            pem: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        transparencyLog: z.ZodEnum<typeof import("./artifact-signer-trust").TransparencyLog>;
+    }, z.core.$strict>], "kind">>>;
 }, z.core.$strict>;
 export type ResolvedDeployment = z.infer<typeof ResolvedDeploymentSchema>;
 export type UnsplitResolvedDeployment = ResolvedDeployment & {

package/dist/deployment/lib/resolved-deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EACL,0BAA0B,EAG3B,MAAM,mBAAmB,CAAC;AA0E3B,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAG7D,eAAO,MAAM,gBAAgB,EAAG,mBAA4B,CAAC;AAM7D,oBAAY,gCAAgC;IAK1C,MAAM,WAAW;IAOjB,OAAO,YAAY;CACpB;AAMD,eAAO,MAAM,iBAAiB,QAAoC,CAAC;AAoBnE,eAAO,MAAM,uBAAuB,QAGnC,CAAC;AAEF,eAAO,MAAM,mBAAmB,aAK7B,CAAC;AA2DJ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+IjC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG;IAC3D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,kBAAkB,CAAC,YAAY,CAAC,EAChC;QAAE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAA;KAAE,CACnD,CAAC;CACH,CAAC;AAGF,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG;IAC1D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,kBAAkB,CAAC,YAAY,CAAC,EAChC;QAAE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAA;KAAE,CACnD,CAAC;CACH,CAAC;AASF,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,GAC3B,QAAQ,IAAI,yBAAyB,CAEvC"}
+{"version":3,"file":"resolved-deployment.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,OAAO,EACL,0BAA0B,EAI3B,MAAM,mBAAmB,CAAC;AAsG3B,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAG7D,eAAO,MAAM,gBAAgB,EAAG,mBAA4B,CAAC;AAM7D,oBAAY,gCAAgC;IAK1C,MAAM,WAAW;IAOjB,OAAO,YAAY;CACpB;AAMD,eAAO,MAAM,iBAAiB,QAAoC,CAAC;AAoBnE,eAAO,MAAM,uBAAuB,QAGnC,CAAC;AAEF,eAAO,MAAM,mBAAmB,aAK7B,CAAC;AA4BJ,eAAO,MAAM,iBAAiB;;;;kBAMnB,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAIjE;AAiBD,eAAO,MAAM,qBAAqB;;;;;;;kBA6B9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAOpE,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAET;AAoCD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwOjC,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG;IAC3D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,kBAAkB,CAAC,YAAY,CAAC,EAChC;QAAE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAA;KAAE,CACnD,CAAC;CACH,CAAC;AAGF,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG;IAC1D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,kBAAkB,CAAC,YAAY,CAAC,EAChC;QAAE,IAAI,EAAE,gCAAgC,CAAC,OAAO,CAAA;KAAE,CACnD,CAAC;CACH,CAAC;AASF,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,GAC3B,QAAQ,IAAI,yBAAyB,CAEvC"}

package/dist/deployment/lib/resolved-deployment.js

@@ -1,15 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ResolvedDeploymentSchema = exports.EditionOciRefSchema = exports.EDITION_OCI_REF_PATTERN = exports.DNS_LABEL_PATTERN = exports.ResolvedDeploymentProvenanceKind = exports.RESOLVER_PACKAGE = exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = void 0;
+exports.ResolvedDeploymentSchema = exports.ResolvedClusterSchema = exports.OciPlatformSchema = exports.EditionOciRefSchema = exports.EDITION_OCI_REF_PATTERN = exports.DNS_LABEL_PATTERN = exports.ResolvedDeploymentProvenanceKind = exports.RESOLVER_PACKAGE = exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = void 0;
+exports.ociPlatformIdentity = ociPlatformIdentity;
+exports.isAllowedImageRepository = isAllowedImageRepository;
 exports.isUnsplitResolvedDeployment = isUnsplitResolvedDeployment;
 const zod_1 = require("zod");
 const content_address_1 = require("../../content-address");
+const artifact_signer_trust_1 = require("./artifact-signer-trust");
 const deployment_id_1 = require("./deployment-id");
+const store_event_ceiling_1 = require("./store-event-ceiling");
+const store_workload_grant_ceiling_1 = require("./store-workload-grant-ceiling");
+const event_subscription_grant_1 = require("./event-subscription-grant");
 const organization_sweep_grant_1 = require("./organization-sweep-grant");
+const org_context_relay_1 = require("./org-context-relay");
 const operation_grant_1 = require("./operation-grant");
 const trust_domain_1 = require("./trust-domain");
 const trust_partition_1 = require("./trust-partition");
-exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = 3;
+exports.RESOLVED_DEPLOYMENT_SCHEMA_VERSION = 4;
 exports.RESOLVER_PACKAGE = '@xemahq/contracts';
 var ResolvedDeploymentProvenanceKind;
 (function (ResolvedDeploymentProvenanceKind) {
@@ -46,6 +53,53 @@ const ResolvedServiceAccountSchema = zod_1.z
         .min(1),
 })
     .strict();
+const PlatformTokenSchema = zod_1.z.string().regex(/^[a-z0-9][a-z0-9._-]*$/);
+exports.OciPlatformSchema = zod_1.z
+    .object({
+    os: PlatformTokenSchema,
+    architecture: PlatformTokenSchema,
+    variant: PlatformTokenSchema.optional(),
+})
+    .strict();
+function ociPlatformIdentity(platform) {
+    return platform.variant === undefined
+        ? `${platform.os}/${platform.architecture}`
+        : `${platform.os}/${platform.architecture}/${platform.variant}`;
+}
+const ImageRegistryPrefixSchema = zod_1.z
+    .string()
+    .regex(/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[0-9]+)?(\/[a-z0-9]([a-z0-9._-]*[a-z0-9])?)*$/, 'must be a registry host with optional repository path segments, without a tag, digest or scheme');
+exports.ResolvedClusterSchema = zod_1.z
+    .object({
+    nodePlatforms: zod_1.z.array(exports.OciPlatformSchema).min(1),
+    allowedImageRegistries: zod_1.z.array(ImageRegistryPrefixSchema).min(1),
+})
+    .strict()
+    .superRefine((cluster, ctx) => {
+    cluster.nodePlatforms.forEach((platform, index) => {
+        const previous = cluster.nodePlatforms[index - 1];
+        if (previous !== undefined && !(ociPlatformIdentity(previous) < ociPlatformIdentity(platform))) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['nodePlatforms', index],
+                message: 'nodePlatforms must be unique and sorted by os/architecture/variant',
+            });
+        }
+    });
+    cluster.allowedImageRegistries.forEach((prefix, index) => {
+        const previous = cluster.allowedImageRegistries[index - 1];
+        if (previous !== undefined && !(previous < prefix)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['allowedImageRegistries', index],
+                message: 'allowedImageRegistries must be unique and sorted',
+            });
+        }
+    });
+});
+function isAllowedImageRepository(repository, allowed) {
+    return allowed.some((prefix) => repository === prefix || repository.startsWith(`${prefix}/`));
+}
 const ResolverSchema = zod_1.z
     .object({
     package: zod_1.z.literal(exports.RESOLVER_PACKAGE),
@@ -87,8 +141,17 @@ exports.ResolvedDeploymentSchema = zod_1.z
     biomes: zod_1.z.array(ResolvedBiomeSchema).min(1),
     serviceAccounts: zod_1.z.array(ResolvedServiceAccountSchema),
     operationGrants: zod_1.z.array(operation_grant_1.OperationGrantSchema),
+    ungrantedOptionalOperations: zod_1.z.array(operation_grant_1.UngrantedOptionalOperationSchema),
+    installedOperationCeilings: zod_1.z.array(operation_grant_1.OperationGrantSchema),
+    eventSubscriptionGrants: zod_1.z.array(event_subscription_grant_1.EventSubscriptionGrantSchema),
+    installedEventSubscriptionCeilings: zod_1.z.array(event_subscription_grant_1.InstalledEventSubscriptionCeilingSchema),
+    storeWorkloadCeiling: store_workload_grant_ceiling_1.StoreWorkloadCeilingSchema,
+    storeEventCeiling: store_event_ceiling_1.StoreEventCeilingDeclarationSchema,
     organizationSweeps: zod_1.z.array(organization_sweep_grant_1.OrganizationSweepGrantSchema),
+    orgContextRelays: zod_1.z.array(org_context_relay_1.OrgContextRelaySchema),
     provenance: zod_1.z.union([EngineProvenanceSchema, UnsplitProvenanceSchema]),
+    cluster: exports.ResolvedClusterSchema.optional(),
+    artifactSignerTrust: artifact_signer_trust_1.ArtifactSignerTrustSchema.optional(),
 })
     .strict()
     .superRefine((resolved, ctx) => {
@@ -124,27 +187,74 @@ exports.ResolvedDeploymentSchema = zod_1.z
         }
     });
     const placedBiomes = new Set(resolved.biomes.map((biome) => biome.id));
-    resolved.operationGrants.forEach((grant, index) => {
-        const previous = resolved.operationGrants[index - 1];
-        if (previous !== undefined && (0, operation_grant_1.compareOperationGrants)(previous, grant) >= 0) {
+    for (const field of ['operationGrants', 'installedOperationCeilings']) {
+        resolved[field].forEach((grant, index) => {
+            const previous = resolved[field][index - 1];
+            if (previous !== undefined && (0, operation_grant_1.compareOperationGrants)(previous, grant) >= 0) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [field, index],
+                    message: `${field} must be unique and sorted by caller biome, caller component, operation`,
+                });
+            }
+            if (!placedBiomes.has(grant.caller.biome)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'caller', 'biome'],
+                    message: `"${grant.caller.biome}" is not a biome of this deployment`,
+                });
+            }
+            if (grant.receiver.kind === operation_grant_1.OperationGrantReceiverKind.Biome && !placedBiomes.has(grant.receiver.biome)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'receiver', 'biome'],
+                    message: `"${grant.receiver.biome}" is not a biome of this deployment`,
+                });
+            }
+        });
+    }
+    resolved.ungrantedOptionalOperations.forEach((row, index) => {
+        const previous = resolved.ungrantedOptionalOperations[index - 1];
+        if (previous !== undefined && (0, operation_grant_1.compareOperationGrants)(previous, row) >= 0) {
             ctx.addIssue({
                 code: 'custom',
-                path: ['operationGrants', index],
-                message: 'operationGrants must be unique and sorted by caller biome, caller component, operation',
+                path: ['ungrantedOptionalOperations', index],
+                message: 'ungrantedOptionalOperations must be unique and sorted by caller biome, caller component, operation',
             });
         }
-        if (!placedBiomes.has(grant.caller.biome)) {
+        if (!placedBiomes.has(row.caller.biome)) {
             ctx.addIssue({
                 code: 'custom',
-                path: ['operationGrants', index, 'caller', 'biome'],
-                message: `"${grant.caller.biome}" is not a biome of this deployment`,
+                path: ['ungrantedOptionalOperations', index, 'caller', 'biome'],
+                message: `"${row.caller.biome}" is not a biome of this deployment`,
             });
         }
-        if (grant.receiver.kind === operation_grant_1.OperationGrantReceiverKind.Biome && !placedBiomes.has(grant.receiver.biome)) {
+    });
+    for (const field of ['eventSubscriptionGrants', 'installedEventSubscriptionCeilings']) {
+        resolved[field].forEach((row, index) => {
+            const previous = resolved[field][index - 1];
+            if (previous !== undefined && (0, event_subscription_grant_1.compareEventSubscriptionRows)(previous, row) >= 0) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [field, index],
+                    message: `${field} must be unique and sorted by caller biome, caller component`,
+                });
+            }
+            if (!placedBiomes.has(row.caller.biome)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'caller', 'biome'],
+                    message: `"${row.caller.biome}" is not a biome of this deployment`,
+                });
+            }
+        });
+    }
+    resolved.storeWorkloadCeiling.receivers.forEach((row, index) => {
+        if (row.receiver.kind === operation_grant_1.OperationGrantReceiverKind.Biome && !placedBiomes.has(row.receiver.biome)) {
             ctx.addIssue({
                 code: 'custom',
-                path: ['operationGrants', index, 'receiver', 'biome'],
-                message: `"${grant.receiver.biome}" is not a biome of this deployment`,
+                path: ['storeWorkloadCeiling', 'receivers', index, 'receiver', 'biome'],
+                message: `"${row.receiver.biome}" is not a biome of this deployment`,
             });
         }
     });
@@ -165,6 +275,23 @@ exports.ResolvedDeploymentSchema = zod_1.z
             });
         }
     });
+    resolved.orgContextRelays.forEach((row, index) => {
+        const previous = resolved.orgContextRelays[index - 1];
+        if (previous !== undefined && (0, org_context_relay_1.compareOrgContextRelays)(previous, row) >= 0) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['orgContextRelays', index],
+                message: 'orgContextRelays must be unique and sorted by caller biome, caller component',
+            });
+        }
+        if (!placedBiomes.has(row.caller.biome)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['orgContextRelays', index, 'caller', 'biome'],
+                message: `"${row.caller.biome}" is not a biome of this deployment`,
+            });
+        }
+    });
     for (const violation of [
         ...(0, trust_partition_1.gradeTrustRefinement)(resolved.biomes),
         ...(0, trust_partition_1.gradeEnforcementIdentities)(resolved.serviceAccounts.map((account) => ({

package/dist/deployment/lib/resolved-deployment.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-deployment.js","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":";;;AAqXA,kEAIC;AAzXD,6BAAwB;AAExB,2DAA2E;AAC3E,mDAAwD;AACxD,yEAGoC;AACpC,uDAI2B;AAC3B,iDAIwB;AACxB,uDAG2B;AAiEd,QAAA,kCAAkC,GAAG,CAAU,CAAC;AAGhD,QAAA,gBAAgB,GAAG,mBAA4B,CAAC;AAM7D,IAAY,gCAaX;AAbD,WAAY,gCAAgC;IAK1C,qDAAiB,CAAA;IAOjB,uDAAmB,CAAA;AACrB,CAAC,EAbW,gCAAgC,gDAAhC,gCAAgC,QAa3C;AAMY,QAAA,iBAAiB,GAAG,iCAAiC,CAAC;AAGnE,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,yBAAiB,EAAE,+BAA+B,CAAC,CAAC;AAahD,QAAA,uBAAuB,GAAG,IAAI,MAAM,CAC/C,wHAAwH;IACtH,WAAW,mCAAiB,GAAG,CAClC,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,KAAK,CACJ,+BAAuB,EACvB,uFAAuF,CACxF,CAAC;AAEJ,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEjF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,aAAa;IACjB,YAAY,EAAE,gCAAiB;IAC/B,WAAW,EAAE,gCAAiB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IAEpB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAUZ,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACnE,iBAAiB,EAAE,iCAAe;IAClC,cAAc,EAAE,OAAC;SACd,MAAM,EAAE;SACR,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,mCAAiB,GAAG,CAAC,EAAE,8CAA8C,CAAC;IACrG,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,uBAAuB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC;IACzD,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,0CAAkC,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqB,EAAE,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,cAAc;IAChC,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,UAAU,EAAE,iCAAe;QAE3B,gBAAgB,EAAE,iCAAe;QAMjC,uBAAuB,EAAE,iCAAe;QAExC,GAAG,EAAE,2BAAmB;KACzB,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAEtD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,sCAAoB,CAAC;IAE9C,kBAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,uDAA4B,CAAC;IACzD,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;CACvE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC7B,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IACE,KAAK,CAAC,UAAU,CAAC,8CAA+B,CAAC;gBACjD,KAAK,KAAK,GAAG,8CAA+B,GAAG,KAAK,CAAC,EAAE,EAAE,EACzD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,KAAK,6CAA6C,KAAK,CAAC,EAAE,eAAe;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC,CAAC,CAAC;IAGH,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAClF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC;gBACxC,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,wCAAsB,EAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;gBAChC,OAAO,EAAE,wFAAwF;aAClG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACnD,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,qCAAqC;aACrE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,4CAA0B,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;gBACrD,OAAO,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,qCAAqC;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,yDAA8B,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;gBACnC,OAAO,EAAE,uFAAuF;aACjG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACtD,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,qCAAqC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAA,sCAAoB,EAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,GAAG,IAAA,4CAA0B,EAC3B,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,IAAI;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,EACH,QAAQ,CACT;KACF,EAAE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IAGD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO;QAAE,OAAO;IAClF,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC;gBACtC,OAAO,EACL,wEAAwE,KAAK,CAAC,EAAE,UAAU;oBAC1F,IAAI,KAAK,CAAC,WAAW,wBAAwB,KAAK,CAAC,YAAY,GAAG;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,uEAAuE,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE;SAClH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA2BL,SAAgB,2BAA2B,CACzC,QAA4B;IAE5B,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"resolved-deployment.js","sourceRoot":"","sources":["../../../src/deployment/lib/resolved-deployment.ts"],"names":[],"mappings":";;;AA4NA,kDAIC;AAsDD,4DAKC;AAuSD,kEAIC;AAtkBD,6BAAwB;AAExB,2DAA2E;AAC3E,mEAAoE;AACpE,mDAAwD;AACxD,+DAA2E;AAC3E,iFAA4E;AAC5E,yEAIoC;AACpC,yEAGoC;AACpC,2DAAqF;AACrF,uDAK2B;AAC3B,iDAIwB;AACxB,uDAG2B;AA6Fd,QAAA,kCAAkC,GAAG,CAAU,CAAC;AAGhD,QAAA,gBAAgB,GAAG,mBAA4B,CAAC;AAM7D,IAAY,gCAaX;AAbD,WAAY,gCAAgC;IAK1C,qDAAiB,CAAA;IAOjB,uDAAmB,CAAA;AACrB,CAAC,EAbW,gCAAgC,gDAAhC,gCAAgC,QAa3C;AAMY,QAAA,iBAAiB,GAAG,iCAAiC,CAAC;AAGnE,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,yBAAiB,EAAE,+BAA+B,CAAC,CAAC;AAahD,QAAA,uBAAuB,GAAG,IAAI,MAAM,CAC/C,wHAAwH;IACtH,WAAW,mCAAiB,GAAG,CAClC,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,KAAK,CACJ,+BAAuB,EACvB,uFAAuF,CACxF,CAAC;AAEJ,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,EAAE;KACR,KAAK,CAAC,4CAA6B,EAAE,uCAAuC,CAAC,CAAC;AAEjF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,aAAa;IACjB,YAAY,EAAE,gCAAiB;IAC/B,WAAW,EAAE,gCAAiB;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,4BAA4B,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IAEpB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAG1D,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,mBAAmB;IACvB,YAAY,EAAE,mBAAmB;IACjC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,SAAgB,mBAAmB,CAAC,QAAqB;IACvD,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;QACnC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,YAAY,EAAE;QAC3C,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AACpE,CAAC;AAGD,MAAM,yBAAyB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,KAAK,CACJ,gFAAgF,EAChF,iGAAiG,CAClG,CAAC;AASS,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IAEN,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,sBAAsB,EAAE,OAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC;gBAC9B,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,wBAAwB,EAAE,KAAK,CAAC;gBACvC,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAQL,SAAgB,wBAAwB,CACtC,UAAkB,EAClB,OAA0B;IAE1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,cAAc,GAAG,OAAC;KACrB,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAUZ,MAAM,sBAAsB,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACnE,iBAAiB,EAAE,iCAAe;IAClC,cAAc,EAAE,OAAC;SACd,MAAM,EAAE;SACR,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,mCAAiB,GAAG,CAAC,EAAE,8CAA8C,CAAC;IACrG,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,uBAAuB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,OAAO,CAAC;IACzD,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,0CAAkC,CAAC;IAC5D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqB,EAAE,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,cAAc;IAChC,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,UAAU,EAAE,iCAAe;QAE3B,gBAAgB,EAAE,iCAAe;QAMjC,uBAAuB,EAAE,iCAAe;QAExC,GAAG,EAAE,2BAAmB;KACzB,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAEtD,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,sCAAoB,CAAC;IAE9C,2BAA2B,EAAE,OAAC,CAAC,KAAK,CAAC,kDAAgC,CAAC;IAEtE,0BAA0B,EAAE,OAAC,CAAC,KAAK,CAAC,sCAAoB,CAAC;IAEzD,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,uDAA4B,CAAC;IAE9D,kCAAkC,EAAE,OAAC,CAAC,KAAK,CAAC,kEAAuC,CAAC;IAKpF,oBAAoB,EAAE,yDAA0B;IAEhD,iBAAiB,EAAE,wDAAkC;IAErD,kBAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,uDAA4B,CAAC;IAEzD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,yCAAqB,CAAC;IAChD,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAEtE,OAAO,EAAE,6BAAqB,CAAC,QAAQ,EAAE;IAMzC,mBAAmB,EAAE,iDAAyB,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC7B,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IACE,KAAK,CAAC,UAAU,CAAC,8CAA+B,CAAC;gBACjD,KAAK,KAAK,GAAG,8CAA+B,GAAG,KAAK,CAAC,EAAE,EAAE,EACzD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,KAAK,6CAA6C,KAAK,CAAC,EAAE,eAAe;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC,CAAC,CAAC;IAGH,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAClF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC;gBACxC,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAU,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,wCAAsB,EAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;oBACpB,OAAO,EAAE,GAAG,KAAK,yEAAyE;iBAC3F,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;oBACvC,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,qCAAqC;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,4CAA0B,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxG,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;oBACzC,OAAO,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,qCAAqC;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,2BAA2B,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,wCAAsB,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,6BAA6B,EAAE,KAAK,CAAC;gBAC5C,OAAO,EAAE,oGAAoG;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAC/D,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,qCAAqC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,CAAC,yBAAyB,EAAE,oCAAoC,CAAU,EAAE,CAAC;QAC/F,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,uDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;oBACpB,OAAO,EAAE,GAAG,KAAK,8DAA8D;iBAChF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;oBACvC,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,qCAAqC;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,4CAA0B,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;gBACvE,OAAO,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,qCAAqC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,yDAA8B,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;gBACnC,OAAO,EAAE,uFAAuF;aACjG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACtD,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,qCAAqC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAA,2CAAuB,EAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC;gBACjC,OAAO,EAAE,8EAA8E;aACxF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACpD,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,qCAAqC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,IAAA,sCAAoB,EAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,GAAG,IAAA,4CAA0B,EAC3B,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,cAAc,EAAE,OAAO,CAAC,IAAI;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,EACH,QAAQ,CACT;KACF,EAAE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IAGD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO;QAAE,OAAO;IAClF,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC;gBACtC,OAAO,EACL,wEAAwE,KAAK,CAAC,EAAE,UAAU;oBAC1F,IAAI,KAAK,CAAC,WAAW,wBAAwB,KAAK,CAAC,YAAY,GAAG;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,uEAAuE,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE;SAClH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AA2BL,SAAgB,2BAA2B,CACzC,QAA4B;IAE5B,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,CAAC;AAC/E,CAAC"}

package/dist/deployment/lib/store-event-ceiling.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import type { CapabilityDomain } from '../../capability-domain';
+import { type EventTypePattern } from '../../event-subscription';
+import type { InstalledEventSubscriptionCeiling } from './event-subscription-grant';
+import { type StoreWorkloadCeiling } from './store-workload-grant-ceiling';
+export declare const StoreEventCeilingClauseSchema: z.ZodObject<{
+    types: z.ZodArray<z.ZodString>;
+    tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+}, z.core.$strict>;
+export type StoreEventCeilingClause = z.infer<typeof StoreEventCeilingClauseSchema>;
+export declare const StoreEventCeilingDeclarationSchema: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    types: z.ZodArray<z.ZodString>;
+    tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+}, z.core.$strict>>>;
+export type StoreEventCeilingDeclaration = z.infer<typeof StoreEventCeilingDeclarationSchema>;
+export declare const StoreEventCeilingOptionalDeclarationSchema: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    types: z.ZodArray<z.ZodString>;
+    tiers: z.ZodArray<z.ZodEnum<typeof import("../../event-subscription").VisibilityTier>>;
+}, z.core.$strict>>>>;
+export declare function resolveStoreEventCeiling(declaration: StoreEventCeilingDeclaration | undefined): StoreEventCeilingDeclaration;
+export declare enum StoreEventCeilingRefusalCode {
+    UnownedEventDomain = "unowned-event-domain"
+}
+export interface StoreEventCeilingRefusal {
+    readonly code: StoreEventCeilingRefusalCode;
+    readonly biome: string;
+    readonly eventType: EventTypePattern;
+    readonly message: string;
+}
+export interface StoreEventCeilingRowsInput {
+    readonly biome: string;
+    readonly components: readonly string[];
+    readonly ownDomains: readonly CapabilityDomain[];
+    readonly storeWorkloadCeiling: StoreWorkloadCeiling;
+    readonly ownEventTypes: readonly EventTypePattern[];
+    readonly storeEventCeiling: StoreEventCeilingDeclaration;
+}
+export interface StoreEventCeilingRows {
+    readonly ceiling: InstalledEventSubscriptionCeiling[];
+    readonly refusals: readonly StoreEventCeilingRefusal[];
+}
+export declare function storeEventCeilingRows(input: StoreEventCeilingRowsInput): StoreEventCeilingRows;
+//# sourceMappingURL=store-event-ceiling.d.ts.map

package/dist/deployment/lib/store-event-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-event-ceiling.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/store-event-ceiling.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AA2BnG,eAAO,MAAM,6BAA6B;;;kBAA8D,CAAC;AAEzG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AASpF,eAAO,MAAM,kCAAkC;;;oBAoBlC,CAAC;AAEd,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAG9F,eAAO,MAAM,0CAA0C;;;qBAG3C,CAAC;AAGb,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,4BAA4B,GAAG,SAAS,GAAG,4BAA4B,CAE5H;AAKD,oBAAY,4BAA4B;IAEtC,kBAAkB,yBAAyB;CAC5C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAErC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAOvC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAEjD,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAEpD,QAAQ,CAAC,aAAa,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAEpD,QAAQ,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;CAC1D;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACxD;AAWD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,qBAAqB,CAoC9F"}

package/dist/deployment/lib/store-event-ceiling.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreEventCeilingRefusalCode = exports.StoreEventCeilingOptionalDeclarationSchema = exports.StoreEventCeilingDeclarationSchema = exports.StoreEventCeilingClauseSchema = void 0;
+exports.resolveStoreEventCeiling = resolveStoreEventCeiling;
+exports.storeEventCeilingRows = storeEventCeilingRows;
+const zod_1 = require("zod");
+const event_subscription_1 = require("../../event-subscription");
+const code_unit_order_1 = require("./code-unit-order");
+const store_workload_grant_ceiling_1 = require("./store-workload-grant-ceiling");
+exports.StoreEventCeilingClauseSchema = event_subscription_1.DeclaredEventSubscriptionClauseSchema.omit({ scope: true });
+const orgScoped = (clause) => ({
+    types: [...clause.types],
+    tiers: [...clause.tiers],
+    scope: { kind: event_subscription_1.EventSubscriptionScopeKind.Org },
+});
+exports.StoreEventCeilingDeclarationSchema = zod_1.z
+    .array(exports.StoreEventCeilingClauseSchema)
+    .max(event_subscription_1.MAX_EVENT_SUBSCRIPTION_CLAUSES)
+    .superRefine((clauses, ctx) => {
+    clauses.forEach((clause, index) => {
+        const previous = clauses[index - 1];
+        if (previous === undefined)
+            return;
+        const order = (0, code_unit_order_1.compareCodeUnits)((0, event_subscription_1.eventSubscriptionClauseKey)(orgScoped(previous)), (0, event_subscription_1.eventSubscriptionClauseKey)(orgScoped(clause)));
+        if (order >= 0) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [index],
+                message: 'storeEventCeiling clauses must be unique and in canonical order',
+            });
+        }
+    });
+})
+    .readonly();
+exports.StoreEventCeilingOptionalDeclarationSchema = exports.StoreEventCeilingDeclarationSchema.refine((clauses) => clauses.length > 0, 'storeEventCeiling that lists no clause states nothing; omit it').optional();
+function resolveStoreEventCeiling(declaration) {
+    return declaration ?? [];
+}
+const ALL_TIERS = [...event_subscription_1.ALL_VISIBILITY_TIERS].sort(code_unit_order_1.compareCodeUnits);
+var StoreEventCeilingRefusalCode;
+(function (StoreEventCeilingRefusalCode) {
+    StoreEventCeilingRefusalCode["UnownedEventDomain"] = "unowned-event-domain";
+})(StoreEventCeilingRefusalCode || (exports.StoreEventCeilingRefusalCode = StoreEventCeilingRefusalCode = {}));
+function storeEventCeilingRows(input) {
+    const owned = new Set((0, store_workload_grant_ceiling_1.storeBiomeOwnedDomains)(input).domains);
+    const refusals = [];
+    const accepted = [];
+    for (const eventType of new Set(input.ownEventTypes)) {
+        const domain = eventType.split('.')[0] ?? eventType;
+        if (domain !== eventType && owned.has(domain)) {
+            accepted.push(eventType);
+        }
+        else {
+            refusals.push({
+                code: StoreEventCeilingRefusalCode.UnownedEventDomain,
+                biome: input.biome,
+                eventType,
+                message: `Biome "${input.biome}" declares event type "${eventType}", whose domain "${domain}" it does not own, so a store biome cannot subscribe to it as its own.`,
+            });
+        }
+    }
+    refusals.sort((a, b) => (0, code_unit_order_1.compareCodeUnits)(a.eventType, b.eventType));
+    const own = accepted.length === 0
+        ? []
+        : [
+            {
+                types: accepted.sort(code_unit_order_1.compareCodeUnits),
+                tiers: [...ALL_TIERS],
+                scope: { kind: event_subscription_1.EventSubscriptionScopeKind.Org },
+            },
+        ];
+    const clauses = (0, event_subscription_1.canonicalEventSubscriptionClauses)([...input.storeEventCeiling.map(orgScoped), ...own]);
+    const ceiling = clauses.length === 0
+        ? []
+        : [...new Set(input.components)]
+            .sort(code_unit_order_1.compareCodeUnits)
+            .map((component) => ({ caller: { biome: input.biome, component }, clauses }));
+    return { ceiling, refusals };
+}
+//# sourceMappingURL=store-event-ceiling.js.map

package/dist/deployment/lib/store-event-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-event-ceiling.js","sourceRoot":"","sources":["../../../src/deployment/lib/store-event-ceiling.ts"],"names":[],"mappings":";;;AAoFA,4DAEC;AAqDD,sDAoCC;AA/KD,6BAAwB;AAGxB,iEASkC;AAClC,uDAAqD;AAErD,iFAAmG;AA2BtF,QAAA,6BAA6B,GAAG,0DAAqC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAIzG,MAAM,SAAS,GAAG,CAAC,MAA+B,EAAmC,EAAE,CAAC,CAAC;IACvF,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACxB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACxB,KAAK,EAAE,EAAE,IAAI,EAAE,+CAA0B,CAAC,GAAG,EAAE;CAChD,CAAC,CAAC;AAGU,QAAA,kCAAkC,GAAG,OAAC;KAChD,KAAK,CAAC,qCAA6B,CAAC;KACpC,GAAG,CAAC,mDAA8B,CAAC;KACnC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,MAAM,KAAK,GAAG,IAAA,kCAAgB,EAC5B,IAAA,+CAA0B,EAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAC/C,IAAA,+CAA0B,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAC9C,CAAC;QACF,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;KACD,QAAQ,EAAE,CAAC;AAKD,QAAA,0CAA0C,GAAG,0CAAkC,CAAC,MAAM,CACjG,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAC/B,gEAAgE,CACjE,CAAC,QAAQ,EAAE,CAAC;AAGb,SAAgB,wBAAwB,CAAC,WAAqD;IAC5F,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,GAAG,yCAAoB,CAAC,CAAC,IAAI,CAAC,kCAAgB,CAAC,CAAC;AAGnE,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IAEtC,2EAA2C,CAAA;AAC7C,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC;AA6CD,SAAgB,qBAAqB,CAAC,KAAiC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,IAAA,qDAAsB,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B,CAAC,kBAAkB;gBACrD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS;gBACT,OAAO,EAAE,UAAU,KAAK,CAAC,KAAK,0BAA0B,SAAS,oBAAoB,MAAM,wEAAwE;aACpK,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,kCAAgB,EAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,kCAAgB,CAAC;gBACtC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;gBACrB,KAAK,EAAE,EAAE,IAAI,EAAE,+CAA0B,CAAC,GAAG,EAAE;aAChD;SACF,CAAC;IACR,MAAM,OAAO,GAAG,IAAA,sDAAiC,EAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;aAC3B,IAAI,CAAC,kCAAgB,CAAC;aACtB,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}