@xemahq/xema 0.25.1 → 0.27.0

package/dist/runtime/sources/manifest-walk.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.walkBiomeManifests = walkBiomeManifests;
+exports.localSourceManifestHash = localSourceManifestHash;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const biome_1 = require("@xemahq/contracts/biome");
+const distribution_1 = require("@xemahq/contracts/distribution");
 const SKIP_DIRS = new Set([
     'node_modules',
     '.git',
@@ -48,6 +50,11 @@ function visit(dir, root, out) {
         visit((0, node_path_1.join)(dir, entry.name), root, out);
     }
 }
+function localSourceManifestHash(raw) {
+    return (0, distribution_1.parseBiomeSourceManifestHash)((0, node_crypto_1.createHash)('sha256')
+        .update(`${JSON.stringify(raw, null, 2)}\n`)
+        .digest('hex'));
+}
 function projectManifest(manifestPath, root) {
     const biomeAbsDir = manifestPath.slice(0, -(biome_1.BIOME_MANIFEST_FILENAME.length + 1));
     let manifest;
@@ -55,9 +62,7 @@ function projectManifest(manifestPath, root) {
     try {
         const raw = JSON.parse((0, node_fs_1.readFileSync)(manifestPath, 'utf8'));
         manifest = (0, biome_1.parseBiomeManifest)(raw);
-        sourceManifestHash = (0, node_crypto_1.createHash)('sha256')
-            .update(`${JSON.stringify(raw, null, 2)}\n`)
-            .digest('hex');
+        sourceManifestHash = localSourceManifestHash(raw);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);

package/dist/runtime/sources/manifest-walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-walk.js","sourceRoot":"","sources":["../../../src/runtime/sources/manifest-walk.ts"],"names":[],"mappings":";;AAyGA,gDASC;AAlHD,6CAAyC;AACzC,qCAA6E;AAC7E,yCAA2C;AAE3C,mDAQiC;AA2BjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAqDH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,GAAsB;IAC9D,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,+BAAuB,CAAC,CAAC;IACxD,IAAI,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,IAAY;IACzD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,+BAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAuB,CAAC;IAC5B,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,QAAQ,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAC;QAOnC,kBAAkB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACtC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;aAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAS3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAM3E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU;SACxB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,0BAAkB,CAAC,OAAO,CAAC;SACpE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,MAAM,iBAAiB,GAAG,UAAU;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,0BAAkB,CAAC,MAAM,CAAC;SACnE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAEzE,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;KACT,CAAC;AACJ,CAAC;AAUD,SAAS,gBAAgB,CACvB,QAAgB,EAChB,SAAyB,EACzB,UAAqC;IAErC,MAAM,IAAI,GACR,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,IAAI;QACzD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW;QAChC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAA,gBAAI,EAAC,QAAQ,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAOD,SAAS,mBAAmB,CAC1B,SAAyB,EACzB,UAAqC;IAErC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,IAAI,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,cAAc,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,cAAc,EAAE,CAAC;QAGjG,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,CAAC,GAAG,wBAAwB,QAAQ,CAAC,SAAS,mCAAmC,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"manifest-walk.js","sourceRoot":"","sources":["../../../src/runtime/sources/manifest-walk.ts"],"names":[],"mappings":";;AA6GA,gDASC;AA8BD,0DAMC;AA1JD,6CAAyC;AACzC,qCAA6E;AAC7E,yCAA2C;AAE3C,mDAQiC;AACjC,iEAGwC;AA2BxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAqDH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,GAAsB;IAC9D,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,+BAAuB,CAAC,CAAC;IACxD,IAAI,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAUD,SAAgB,uBAAuB,CAAC,GAAY;IAClD,OAAO,IAAA,2CAA4B,EACjC,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACjB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,IAAY;IACzD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,+BAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAuB,CAAC;IAC5B,IAAI,kBAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,QAAQ,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAC;QAOnC,kBAAkB,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAS3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAM3E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU;SACxB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,0BAAkB,CAAC,OAAO,CAAC;SACpE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,MAAM,iBAAiB,GAAG,UAAU;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,0BAAkB,CAAC,MAAM,CAAC;SACnE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAEzE,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;KACT,CAAC;AACJ,CAAC;AAUD,SAAS,gBAAgB,CACvB,QAAgB,EAChB,SAAyB,EACzB,UAAqC;IAErC,MAAM,IAAI,GACR,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,IAAI;QACzD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW;QAChC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAA,gBAAI,EAAC,QAAQ,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAOD,SAAS,mBAAmB,CAC1B,SAAyB,EACzB,UAAqC;IAErC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,IAAI,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,cAAc,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,kCAA0B,CAAC,cAAc,EAAE,CAAC;QAGjG,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,CAAC,GAAG,wBAAwB,QAAQ,CAAC,SAAS,mCAAmC,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC/B,CAAC"}

package/dist/runtime/sources/schema.d.ts

@@ -39,6 +39,7 @@ export declare const GitSourceSchema: z.ZodObject<{
     url: z.ZodString;
     ref: z.ZodOptional<z.ZodString>;
     authTokenEnv: z.ZodOptional<z.ZodString>;
+    authUsername: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
 }, z.core.$strict>;
 export type GitSource = z.infer<typeof GitSourceSchema>;
@@ -67,6 +68,7 @@ export declare const SourceSpecSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     url: z.ZodString;
     ref: z.ZodOptional<z.ZodString>;
     authTokenEnv: z.ZodOptional<z.ZodString>;
+    authUsername: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
 }, z.core.$strict>], "kind">;
 export type SourceSpec = z.infer<typeof SourceSpecSchema>;
@@ -95,6 +97,7 @@ export declare const SourcesConfigSchema: z.ZodDefault<z.ZodArray<z.ZodDiscrimin
     url: z.ZodString;
     ref: z.ZodOptional<z.ZodString>;
     authTokenEnv: z.ZodOptional<z.ZodString>;
+    authUsername: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
 }, z.core.$strict>], "kind">>>;
 export type SourcesConfig = z.infer<typeof SourcesConfigSchema>;

package/dist/runtime/sources/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,oBAAY,UAAU;IAEpB,SAAS,cAAc;IAEvB,YAAY,iBAAiB;IAE7B,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,GAAG,QAAQ;CACZ;AA8BD,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,wBAAwB;;;;;kBAO1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E,eAAO,MAAM,eAAe;;;;;;kBAWjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,eAAe;;;;;kBAYjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQxD,eAAO,MAAM,eAAe;;;;;;kBAQjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;4BAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAQ1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,oBAAY,UAAU;IAEpB,SAAS,cAAc;IAEvB,YAAY,iBAAiB;IAE7B,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,GAAG,QAAQ;CACZ;AA8BD,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,wBAAwB;;;;;kBAO1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E,eAAO,MAAM,eAAe;;;;;;kBAWjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,eAAe;;;;;kBAYjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQxD,eAAO,MAAM,eAAe;;;;;;;kBAcxB,CAAC;AACL,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAQ1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/runtime/sources/schema.js

@@ -76,8 +76,13 @@ exports.GitSourceSchema = zod_1.z
     url: CredentialFreeGitUrlSchema,
     ref: zod_1.z.string().min(1).optional(),
     authTokenEnv: zod_1.z.string().min(1).optional(),
+    authUsername: zod_1.z.string().regex(/^[^\s:]+$/, 'authUsername must be non-empty without whitespace or ":"').optional(),
 })
-    .strict();
+    .strict()
+    .refine((source) => (source.authTokenEnv === undefined) === (source.authUsername === undefined), {
+    message: 'a git source declares authTokenEnv and authUsername together, or neither',
+    path: ['authUsername'],
+});
 exports.SourceSpecSchema = zod_1.z.discriminatedUnion('kind', [
     exports.WorkspaceSourceSchema,
     exports.DistributionSourceSchema,

package/dist/runtime/sources/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBxB,IAAY,UAWX;AAXD,WAAY,UAAU;IAEpB,qCAAuB,CAAA;IAEvB,2CAA6B,CAAA;IAE7B,yBAAW,CAAA;IAEX,yBAAW,CAAA;IAEX,yBAAW,CAAA;AACb,CAAC,EAXW,UAAU,0BAAV,UAAU,QAWrB;AAGD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;CAC1E,CAAC;AAEF,MAAM,2BAA2B,GAAG,OAAC;KAClC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,uBAAuB,CAAC;KAC5B,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC;KAChD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAOQ,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,WAAW,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC7D,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,8BAA8B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC;IACJ,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,gCAAwB;IACxB,uBAAe;IACf,uBAAe;IACf,uBAAe;CAChB,CAAC,CAAC;AASU,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAGzE,SAAS,yBAAyB,CAAC,KAAa,EAAE,GAAoB;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wFAAwF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,GAAoB;IAEpB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBxB,IAAY,UAWX;AAXD,WAAY,UAAU;IAEpB,qCAAuB,CAAA;IAEvB,2CAA6B,CAAA;IAE7B,yBAAW,CAAA;IAEX,yBAAW,CAAA;IAEX,yBAAW,CAAA;AACb,CAAC,EAXW,UAAU,0BAAV,UAAU,QAWrB;AAGD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;CAC1E,CAAC;AAEF,MAAM,2BAA2B,GAAG,OAAC;KAClC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,uBAAuB,CAAC;KAC5B,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC;KAChD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAOQ,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,WAAW,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC7D,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,8BAA8B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC;IACJ,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE1C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,0DAA0D,CAAC,CAAC,QAAQ,EAAE;CACnH,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE;IAC/F,OAAO,EAAE,0EAA0E;IACnF,IAAI,EAAE,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAGQ,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,gCAAwB;IACxB,uBAAe;IACf,uBAAe;IACf,uBAAe;CAChB,CAAC,CAAC;AASU,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAGzE,SAAS,yBAAyB,CAAC,KAAa,EAAE,GAAoB;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wFAAwF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,GAAoB;IAEpB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/runtime/supervisor.d.ts

@@ -1,4 +1,5 @@
 import type { XemaConfig, Substrate } from './config/schema';
+import type { LocalCustodyBinding } from './custody/local-custody';
 import type { InfraPlan } from './infra/infra-plan';
 import type { RosterEntry } from './roster';
 import type { RunningService, ServiceRunner } from './runner/service-runner';
@@ -14,6 +15,7 @@ export interface SupervisorOptions {
     readonly substrate: Substrate;
     readonly ports: ReadonlyMap<string, number>;
     readonly distributionLockPath: string;
+    readonly distributionLockSha256: string;
     readonly installationId: string;
     readonly planHash: string;
     readonly executionId: string;
@@ -22,6 +24,7 @@ export interface SupervisorOptions {
     readonly graceMs?: number;
     readonly secrets?: ResolvedSecrets;
     readonly managedCredentials?: LocalInfrastructureCredentials;
+    readonly custody?: LocalCustodyBinding;
     readonly onEvent?: (event: LifecycleEvent) => void;
 }
 export interface LifecycleEvent {

package/dist/runtime/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/runtime/supervisor.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAUpC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EACT,YAAY,GACZ,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,eAAe,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAMD,qBAAa,UAAU;IAOT,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,wBAAwB,CAAS;gBAEZ,IAAI,EAAE,iBAAiB;IAmB9C,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;YAuHzB,WAAW;IAwCnB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC/B,OAAO,CAAC,iBAAiB;YAgBX,oBAAoB;IAUlC,OAAO,CAAC,uBAAuB;IAQ/B,IAAI,OAAO,IAAI,SAAS,cAAc,EAAE,CAEvC;IAED,OAAO,CAAC,IAAI;CAGb;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAU5C"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/runtime/supervisor.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAUpC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EACT,YAAY,GACZ,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,eAAe,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAMD,qBAAa,UAAU;IAOT,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,wBAAwB,CAAS;gBAEZ,IAAI,EAAE,iBAAiB;IAqB9C,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;YAuHzB,WAAW;IAwCnB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC/B,OAAO,CAAC,iBAAiB;YAgBX,oBAAoB;IAUlC,OAAO,CAAC,uBAAuB;IAQ/B,IAAI,OAAO,IAAI,SAAS,cAAc,EAAE,CAEvC;IAED,OAAO,CAAC,IAAI;CAGb;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAU5C"}

package/dist/runtime/supervisor.js

@@ -23,12 +23,14 @@ class Supervisor {
             roster: opts.roster,
             substrate: opts.substrate,
             distributionLockPath: opts.distributionLockPath,
+            distributionLockSha256: opts.distributionLockSha256,
             ports: opts.ports,
             installationId: opts.installationId,
             ...(opts.secrets !== undefined ? { secrets: opts.secrets } : {}),
             ...(opts.managedCredentials !== undefined
                 ? { managedCredentials: opts.managedCredentials }
                 : {}),
+            ...(opts.custody !== undefined ? { custody: opts.custody } : {}),
             ...(opts.containerPort !== undefined
                 ? { containerPort: opts.containerPort }
                 : {}),

package/dist/runtime/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/runtime/supervisor.ts"],"names":[],"mappings":";;;AA2VA,wDAaC;AAxWD,6CAAuC;AACvC,iDAMwB;AACxB,wDAA4D;AAmE5D,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,MAAa,UAAU;IAOQ;IANZ,OAAO,GAAqB,EAAE,CAAC;IAC/B,OAAO,GAAqB,EAAE,CAAC;IAC/B,MAAM,CAAC;IAChB,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,wBAAwB,GAAG,KAAK,CAAC;IAEzC,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,MAAM,GAAG,IAAA,oBAAO,EAAC;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,kBAAkB,GACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAC5C,CACF,CAAC;YAGF,MAAM,yBAAyB,GAAY,EAAE,CAAC;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACrD,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,eAAe;4BACrB,OAAO,EAAE,MAAM,CAAC,IAAI;4BACpB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;yBACzB,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,yBAAyB,CAAC,IAAI,CAC5B,IAAI,KAAK,CACP,4CAA4C,MAAM,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACpH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU;oBAC7B,MAAM,CAAC,IAAI,KAAK,cAAc,EAC9B,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5B,OAAO;oBACL,IAAI,KAAK,CACP,qBAAqB,MAAM,CAAC,IAAI,qBAAqB,MAAM,EAAE,CAC9D;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU;oBAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,oCAAoB,CAAC,EAChD,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;gBACrC,OAAO;oBACL,IAAI,KAAK,CACP,WAAW,MAAM,CAAC,IAAI,6DAA6D,EACnF,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CACzB;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG;gBACpB,GAAG,iBAAiB;gBACpB,GAAG,yBAAyB;gBAC5B,GAAG,eAAe;aACnB,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,cAAc,GAClB,yBAAyB,CAAC,MAAM,KAAK,CAAC;oBACpC,CAAC,CAAC,mCAAmC;oBACrC,CAAC,CAAC,6CAA6C,CAAC;gBACpD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,MAAM,IAAI,cAAc,CACtB,CAAC,GAAG,aAAa,EAAE,YAAY,CAAC,EAChC,GAAG,cAAc,0BAA0B,CAC5C,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU,EAC7B,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM,CAAC,IAAI;oBACpB,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACP,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,kBAA0B;QAE1B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5B,KAAK;YACL,GAAG;YACH,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,IAAI;YACJ,kBAAkB;YAClB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC;YACJ,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;gBAChC,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,IAAA,sDAAuC,EACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAC3C,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/C,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,QAAQ,CAAC,GAAG,CACV,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrB,IAAI,KAAK,CACP,iBAAiB,OAAO,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACJ,EACD,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,QAAQ;iBACnE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;iBACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAA,qCAAsB,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAQO,iBAAiB,CAAC,IAAY,EAAE,MAAc;QACpD,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAA,qCAAsB,EAAC;YACrB,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAC/C,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;YACtC,IAAA,wCAAyB,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,uBAAuB,CAC7B,SAAqB;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAEO,IAAI,CAAC,KAAqB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF;AA1QD,gCA0QC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,QAAmC,EACnC,OAAe;IAEf,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/runtime/supervisor.ts"],"names":[],"mappings":";;;AAiWA,wDAaC;AA9WD,6CAAuC;AACvC,iDAMwB;AACxB,wDAA4D;AAuE5D,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,MAAa,UAAU;IAOQ;IANZ,OAAO,GAAqB,EAAE,CAAC;IAC/B,OAAO,GAAqB,EAAE,CAAC;IAC/B,MAAM,CAAC;IAChB,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,wBAAwB,GAAG,KAAK,CAAC;IAEzC,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,MAAM,GAAG,IAAA,oBAAO,EAAC;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,kBAAkB,GACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAC5C,CACF,CAAC;YAGF,MAAM,yBAAyB,GAAY,EAAE,CAAC;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACrD,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,eAAe;4BACrB,OAAO,EAAE,MAAM,CAAC,IAAI;4BACpB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;yBACzB,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,yBAAyB,CAAC,IAAI,CAC5B,IAAI,KAAK,CACP,4CAA4C,MAAM,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACpH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU;oBAC7B,MAAM,CAAC,IAAI,KAAK,cAAc,EAC9B,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5B,OAAO;oBACL,IAAI,KAAK,CACP,qBAAqB,MAAM,CAAC,IAAI,qBAAqB,MAAM,EAAE,CAC9D;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU;oBAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,oCAAoB,CAAC,EAChD,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;gBACrC,OAAO;oBACL,IAAI,KAAK,CACP,WAAW,MAAM,CAAC,IAAI,6DAA6D,EACnF,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CACzB;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,GAAG;gBACpB,GAAG,iBAAiB;gBACpB,GAAG,yBAAyB;gBAC5B,GAAG,eAAe;aACnB,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,cAAc,GAClB,yBAAyB,CAAC,MAAM,KAAK,CAAC;oBACpC,CAAC,CAAC,mCAAmC;oBACrC,CAAC,CAAC,6CAA6C,CAAC;gBACpD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,MAAM,IAAI,cAAc,CACtB,CAAC,GAAG,aAAa,EAAE,YAAY,CAAC,EAChC,GAAG,cAAc,0BAA0B,CAC5C,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IACE,MAAM,KAAK,SAAS;oBACpB,MAAM,EAAE,MAAM,KAAK,UAAU,EAC7B,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,YAAY,KAAK;oBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;oBACvB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM,CAAC,IAAI;oBACpB,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;YACP,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,kBAA0B;QAE1B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC5B,KAAK;YACL,GAAG;YACH,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,IAAI;YACJ,kBAAkB;YAClB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC;YACJ,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;gBAChC,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,IAAA,sDAAuC,EACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAC3C,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/C,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,QAAQ,CAAC,GAAG,CACV,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CACrB,IAAI,KAAK,CACP,iBAAiB,OAAO,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACJ,EACD,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,QAAQ;iBACnE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;iBACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAA,qCAAsB,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAQO,iBAAiB,CAAC,IAAY,EAAE,MAAc;QACpD,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAA,qCAAsB,EAAC;YACrB,IAAI;YACJ,GAAG;YACH,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAC/C,MAAM,GAAG,GAAG,IAAA,6BAAc,EAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE;YACtC,IAAA,wCAAyB,EAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,uBAAuB,CAC7B,SAAqB;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAEO,IAAI,CAAC,KAAqB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF;AA5QD,gCA4QC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,QAAmC,EACnC,OAAe;IAEf,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/edition/README.md

@@ -0,0 +1,315 @@
+# edition library
+
+Resolves, checks, seals and develop-snapshots an edition: a named, positive set
+of biomes and platform services, from its definition (`<id>/xema-distribution.json`)
+to its locks (`distribution`, `authorization`, `images`, `chart-set`). Plain ESM
+`.mjs`, run with `node`; tests run with `node --test`.
+
+The library derives nothing from where it sits. Every directory is stated by the
+caller, once, and a root that was not stated throws, naming its flag. There are
+no defaults.
+
+## Roots
+
+| Flag | Meaning |
+| --- | --- |
+| `--data-root` | catalogue indices (`biome-index.json`, `platform-service-index.json`, `runtime-image-source-index.json`), `chart-set.lock.json`, and `edition-workspace.json` |
+| `--editions-root` | the `<edition-id>/` definitions and locks |
+| `--sources-root` | source checkouts at `repos/<r>` and `submodules/<r>` |
+| `--kernel` | the BUILT `kernel-contracts` package directory |
+| `--deploy-root` | the `xema-deploy` checkout |
+| `--cache-dir` | a writable directory for fetched artifacts |
+| `--source-hash` | the BUILT `@xemahq/distribution-source-hash` package directory (`packages/sdks/distribution-source-hash` of `xema-runtime-core`, after its build). Required by the entries that resolve, build, index or seal; the evidence verifier never reads it. The CLI ships without the package (a devDependency for its tests only). On first load its algorithm ids are held identical to the kernel's `ImageSourceHashAlgorithm`. |
+
+## Entry scripts
+
+Each takes the roots below plus its own arguments (`--check`, an edition id, ...).
+
+| Script | Roots |
+| --- | --- |
+| `resolve-distribution.mjs` | data, editions, sources, kernel, source-hash |
+| `resolve-images.mjs` | data, editions, sources, kernel, cache, source-hash |
+| `resolve-chart-set.mjs` | data, editions, deploy, kernel |
+| `edition-biome-manifests.mjs` | data, editions, sources, source-hash, kernel |
+| `seal-image-digests.mjs` | data, editions, kernel, source-hash |
+| `verify-image-platforms.mjs` | data, editions, kernel |
+| `dist-check.mjs` | data, editions, sources, kernel, deploy, cache, source-hash |
+| `develop-edition.mjs` | data, editions, sources, kernel, deploy, cache, source-hash |
+| `release-edition-artifact.mjs` (`xema edition artifact`) | data, editions, kernel |
+| `build-biome-index.mjs`, `build-platform-service-index.mjs`, `build-runtime-image-source-index.mjs` | data, sources, kernel, source-hash |
+| `checkout-indexed-source-repositories.mjs` | data, sources |
+| `why.mjs` | editions, kernel |
+| `repin-evidence-trust.mjs` | data, kernel |
+| `verify-image-evidence.mjs` (run as the BUILT bundle, `xema edition verify-evidence`) | data, editions, kernel |
+
+## `<data-root>/edition-workspace.json`
+
+The deployment's coordinates, so the library names no organisation or registry.
+Read strictly: every key is required, an unknown key or a duplicate key is refused.
+
+```json
+{
+  "schemaVersion": 1,
+  "imageRegistry": "registry.example.com/acme",
+  "chartRegistry": "oci://registry.example.com/acme/charts",
+  "chartPublishers": [{ "index": "<chart-set-index-name>", "repo": "<owner>/<repo>" }],
+  "sourceRepositoryUrlPrefix": "https://git.example.com/acme/",
+  "sourceAuthUsername": "x-access-token",
+  "evidenceTrustPolicy": { "required": true, "policy": "image-evidence-trust-policy.json", "pin": "image-evidence-trust-policy.pin.json" }
+}
+```
+
+- `imageRegistry`: `<host>/<namespace>`, where first-party images are addressed (`<imageRegistry>/<subject-id>`).
+- `chartRegistry`: `oci://<host>/<path>`, where chart-set indexes and charts are published.
+- `chartPublishers`: the chart-set indexes the pin covers; `repo` is recorded in `chart-set.lock.json`.
+- `sourceRepositoryUrlPrefix`: `https://<host>/<organisation>/`, the prefix every first-party `repositoryUrl` must equal (with `<repo>.git`).
+- `sourceAuthUsername`: the non-empty git username first-party source tokens authenticate as (GitHub: `x-access-token`; other forges differ). Required, no default.
+- `evidenceTrustPolicy` (mandatory): `{required: boolean}`, or `{required, policy, pin}` with `policy` and `pin` two data-root-relative POSIX paths (no `..`, regular no-follow files). `required` has no default. `required: true` with no policy is refused by `xema edition check` (`EvidenceTrustRequiredError`); `required: false` with no policy passes and prints NOT ARMED; a declared policy is enforced whether or not it is required. See below.
+
+## Operating notes
+
+- **Release order (edition protocol coupling).** The CLI is coupled to the kernel's edition protocol, not to the whole kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, version}`, the kernel contract authority digest over every kernel source file the protocol's entry subpaths load at runtime, derived from the import graph; `edition-contract.schema.json` states that identity, the entry subpaths and the source paths). `edition-protocol.mjs` declares the versions this CLI supports, each pinned to one digest and vendored under `vendored/`; the library loads no kernel subpath outside the vendored entry subpaths (`edition-protocol.test.mjs`). Every loader that executes the `--kernel`, `xema edition check` first, and the evidence verifier compare only that identity, and refuse an unsupported one naming the versions this CLI supports and the version the kernel declares. The digest is a CONSERVATIVE, deterministic stand-in for protocol semantics. Any change to accepted or refused edition semantics MUST change it; a behaviour-preserving refactor MAY change it too, and the cost is a repin, which is accepted. Semantic equivalence isn't computable, so it is never detected. A kernel change outside the protocol's source files needs no CLI release. An edition protocol change does: the CLI release that supports it goes FIRST; only then does the data root repin its kernel authority to a kernel that speaks it.
+- **`xema edition resolve <id> --trusted-write-v3`** writes the lock set, and the flag is the operator's explicit acknowledgement that the images lock is rewritten unsealed (`xema edition seal` writes the digests afterwards). **`xema edition resolve <id> --check`** writes nothing committed (it resolves into a scratch copy) and compares like with like: the resolve timestamp is ignored and the committed images lock is read without its sealed `imageDigest`s, so a sealed lock is not drift.
+- **Git credentials.** `git-source-auth.mjs` is the one place a token becomes git authentication (Basic `<username>:<token>`, `GIT_CONFIG_*`, never argv; the username is a required declared argument with no default: `sourceAuthUsername` for first-party sources, and for a customer git source its own `authUsername`, which the kernel's `GitBiomeSourceSchema` requires whenever `authTokenEnv` is set and refuses without it). The header is scoped to the origin of the URL it is for: `sourceRepositoryUrlPrefix` for first-party sources, a customer source's own `url`. A token that cannot be applied (an `authTokenEnv` that is unset, or a URL that is not https with a host) is refused; there is no ambient-credential fallback. The CLI's runtime has its own TypeScript implementation (`src/runtime/sources/kinds/git.ts`) of the same shape, because this library is plain ESM that cannot import compiled TypeScript.
+- **Edition artifacts (one layout for develop and release).** An edition is an OCI artifact at `<registry>/xema-edition-<id>`, addressed by DIGEST, with artifactType `application/vnd.xema.edition.v1+json` and titled layers (`org.opencontainers.image.title` = file name): `xema-edition.json` (the descriptor) plus `distribution.lock.json`, `images.lock.json`, `authorization.lock.json` and the chart-set lock. `--registry` is the caller's namespace only (`registry.example.com/acme`); the CLI appends `xema-edition-<id>` itself and refuses a registry whose last segment already starts with `xema-edition-` or is the retired develop-only segment. Tags are for humans only: develop `<snapshot hash>`, release `<coordinate>`. The CLI writes the files to a scratch directory and prints the target; the workflow does `oras push` and `cosign sign` on the digest. Develop: `xema edition develop resolve <id> --pins <file> --out <dir> --registry <ns> --engine-image <repo>@sha256:<digest> [--local]`. Release: `xema edition artifact <id> --channel release --registry <ns> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir> [--local]`, written from the committed locks and refused when the images lock is not sealed.
+- **The descriptor** (`xema.edition/v1`, strict parse, no other key): `{schema, distributionId, locks[], provenance: {channel: "develop" | "release", pins, workflow: {repository, runId}}, evidenceTrustPolicy: "armed" | "not-armed", engine: {image: "<repository>@sha256:<64 hex>"}}`. `engine.image` is required, digest form only, filled from `--engine-image` (the producer workflow resolves the engine tag with oras; the CLI never resolves tags). `evidenceTrustPolicy` records `armed` when the data root declares a policy and it is armed, `not-armed` otherwise. A release edition's `provenance.pins` is empty (its sources are recorded in its locks). Admission rests on the cosign signature of the manifest digest: readers never branch on `provenance.channel`, and no tool refuses an edition for a channel label, schema name or file name.
+- **Contract.** `edition-contract.json` (`xema.edition-contract/v1`) holds the artifactType, the repository prefix, the descriptor file and schema, the lock list and the develop image namespace segment; it ships in the package and xema-deploy vendors it byte for byte.
+- **Chart set.** ONE `chart-set.lock.json` (rostered, `schemaVersion: 3`: `publishers[]` with each chart's version and registry manifest digest) serves both channels. A develop edition pins the charts xema-deploy publishes as OCI for the frozen deploy SHA, at version `0.0.0-dev.<first 12 hex of the SHA>` (also the OCI tag). Each producer validates the chart coordinates of its own channel: a release chart set accepts only `-h<16 hex>` versions, a develop one only `-dev.<12 hex>`; a develop chart-set lock copied into a release is refused by `assertReleaseContent`, and `0.0.0-dev.*` index tags are never release candidates; the resolver reads each chart's manifest digest from the chart registry, exactly as a release does, and the lock lists only the publisher whose repository is the deploy pin role's. The CLI computes no chart content digest.
+- **Release lock set.** `assertReleaseEditionTree` checks that the companion chart-set lock is PRESENT beside the distribution and authorization locks. It does not bind the set by a digest, and is not described as hash-bound.
+
+## Evidence trust
+
+The descriptor's `evidenceTrustPolicy` has exactly two states, and sealing fails closed (also documented in `edition-contract.json` under `evidenceTrust`, which xema-deploy vendors):
+
+- `armed`: the data root declares a policy, the policy hashes to its data-root pin, this CLI's verifier is the pinned one, and the policy is ARMED on the channel of the edition.
+- `not-armed`: for a release edition, exactly `required: false` and no policy armed on the release channel; for a develop edition, a policy that is not armed on the develop channel, whatever `required` says.
+
+Arming is judged for ONE channel, the channel of the edition being checked, sealed or written: a channel is ARMED when the policy authorizes a signer for each of the three predicates on that channel and pins the cosign and the git binary. The signers of the other channel count for nothing, so a policy with release signers only is ARMED for a release edition. The develop channel admits not-armed: a develop edition is written when its channel has no signer, and prints one line on stderr (`develop channel: trust policy not armed, evidence is not signature-verified`). A verification of signed develop evidence is satisfied by develop signers only.
+
+`required: true` while the policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there) REFUSES `xema edition check`, sealing a release edition and writing a release artifact, with `EvidenceTrustRequiredError`, code `EVIDENCE_TRUST_REQUIRED_UNARMED`; `not-armed` is never recorded for a release edition of a `required: true` data root. A data root with `required: true` and no declared policy, and a channel that is PARTIALLY ARMED, are refused on either channel. Both `artifact` and `develop resolve` (and `develop check-existing`) hold the policy to its pin and the verifier to the pinned one before recording a state: a policy edited after pinning or a drifted verifier is refused.
+
+`xema edition check` runs one evidence-trust gate. With `required: true` and no policy it refuses (`EvidenceTrustRequiredError`). With `required: false` and no policy it prints
+`image-evidence trust policy: NOT ARMED` and passes, but refuses a data root that holds an
+undeclared policy (a top-level `*.json` the kernel parses as an offline trust policy, or a
+`trust/` directory). With one declared it parses the policy with the kernel schema, checks the
+Sigstore trusted root the policy itself names (`trustedRootPath`, resolved against the data root,
+and `trustedRootDigest`), checks the pin file, and classifies the authority configuration of each channel: no
+signer on the channel is UNARMED (on the release channel it passes only when `required: false`, and delivery stays
+fail-closed; on the develop channel it passes with the not-armed line), mixed is PARTIAL (refused on either channel, with
+what is unmet), complete is ARMED.
+
+The pin file (strict JSON, exact keys) is reviewed data:
+
+```json
+{ "schemaVersion": 2,
+  "policyDigest": "sha256:<canonical-json digest of the parsed policy>",
+  "verifier": { "bundleDigest": "sha256:<bytes>", "provenanceDigest": "sha256:<bytes>" },
+  "kernelContractAuthority": { "sourceCommit": "<40 hex>", "digest": "sha256:<canonical-json digest of the whole authority>" },
+  "trustedOrasBinaryDigests": ["sha256:<bytes of an oras binary>"] }
+```
+
+`xema edition repin-evidence-trust [--trusted-oras-digest sha256:<64 hex>]…` writes it from the
+declared policy, THIS CLI's built verifier and the kernel contract authority the data root's
+`runtime-image-source-index.json` states. A drifted policy or a verifier that is not the pinned
+one is refused by the check, and a missing built bundle is refused, never skipped.
+
+- **Kernel contract authority.** Evidence is held to the authority the PIN records. The index
+  states it; an index that states another authority is refused
+  (`KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE`), and a data root that declares no evidence trust
+  has no authority to hold evidence to (`KERNEL_CONTRACT_AUTHORITY_UNPINNED`): no evidence verb
+  runs there. The verifier checks the same pin before it reads a statement.
+- **oras is a trusted executable.** On a data root that declares evidence trust, the `oras`
+  binary (`XEMA_ORAS_BIN`, else the first on `PATH`, symbolic links resolved) must hash to one of
+  `trustedOrasBinaryDigests`; a private copy of exactly those bytes is what runs, re-checked on
+  every use. Without the flag a re-pin keeps the reviewed list; a first pin requires it. A data
+  root that declares no evidence trust has no pin: there oras is held to its version only, and
+  the run says so. oras always runs under a scrubbed environment (`HOME` an empty temporary
+  directory, `PATH=/usr/bin:/bin`, `LANG`, `LC_ALL`, `TZ`).
+- **Known limits of the registry reader.** (1) A registry whose Bearer token realm is on another
+  host than the registry itself is refused with the coded error
+  `REGISTRY_TOKEN_REALM_CROSS_HOST` (`RegistryTokenRealmError`), so the pull credential is never
+  sent to a third host. Customer registries that delegate tokens to a separate auth host (for
+  example Docker Hub, or a Harbor or GitLab registry with an external token service) cannot be
+  read; there is no setting that allows it. (2) Because the environment is scrubbed, a proxy or
+  a private CA stated only in environment variables (`HTTPS_PROXY`, `SSL_CERT_FILE`) does not
+  reach oras.
+- **Registry status.** A registry status (404, 401, 403, …) is read only from oras's own error
+  line; any other failure of the run is undecided and is thrown, never read as "absent".
+
+### Why the verifier can be trusted (the binding)
+
+The code under review must be the code that runs. The verifier is ONE file, the bundle
+`dist/edition/verify-image-evidence.bundle.mjs`, built at CLI build time (`scripts/build-evidence-verifier.mjs`,
+exact-pinned esbuild) from the CLI's own sources and its locked `@xemahq/contracts` and `zod`.
+It ships in the npm tarball, which is immutable and integrity-addressed, so anyone can recompute
+its digest from `@xemahq/xema@<version>`; `...bundle.provenance.json` lists every bundled input as
+`{package, version, path in that package, sha256}` and is deterministic (building twice gives
+identical bytes). The reviewed data root PINS the bundle's and the provenance's digests, so
+changing the verifier needs a reviewed data-root commit. At run (`xema edition verify-evidence`,
+which launches the built bundle with a reduced environment) the bundle refuses unless:
+
+1. its own file (realpath of `argv[1]`) and its provenance hash to the data-root pin;
+2. its install path and every ancestor are not group/world writable nor foreign-owned;
+3. the environment carries no `NODE_OPTIONS`, `NODE_PATH`, `DYLD_*`, `LD_*`, `GIT_*`;
+4. the `--kernel` it is given (the built kernel `xema edition check` proves against the authority
+   in `runtime-image-source-index.json`) declares exactly the edition protocol compiled into the
+   bundle, and this CLI supports that protocol (`edition-protocol.mjs`); nothing else about the
+   kernel is compared;
+5. the data root and the editions root are clean git checkouts at an exact HEAD, every file read
+   from them bound to its HEAD blob, graded with a digest-pinned git binary (the completeness
+   signature is bound to the editions checkout's HEAD).
+
+Not here, vendor-side: `require-verified-image-evidence.mjs`, `deliver-images.mjs`,
+`delta-build-plan.mjs`, the evidence producers, and `edition-pin.mjs` (publish plane).
+
+### Product-data sections
+
+The library owns the protocol (the edition schema, the resolution algorithm, the closed
+`installationClass` vocabulary, lock and seal rules, the digest format, the trust-policy
+schema) and never product data. Every product fact below is the data root's, in the same
+file, strictly parsed (unknown, missing or mistyped keys are refused, naming the section).
+A section may be absent where a data root legitimately has none; the operation that needs
+it refuses by name when it runs, and never skips.
+
+| Section | Holds | Needed by |
+| --- | --- | --- |
+| `firstPartySources` | `{ "<repos/\|submodules/ handle>": "<declared source id>" }` | naming a composed-process subject after its source |
+| `platformServiceSources` | per platform service: `name`, `tier`, `installationClass?`, `repo`, `manifestPath`, `manifestName`, `imageKey`, `runtimeBinding` (`null` or `{subjectKind, subjectId}`) | the platform service index (derived from these rows; no edition is read), image subjects, the runtime image source index |
+| `connectorSources` | `repository`, `bindings[{id, path}]`, `nonProductionIds`, `buildInput{consumerRepo, consumerService, destinationRoot}` | biome discovery and the connector cross-repo inputs; absent means no connector repository |
+| `runtimeImageSources` | `supplementalSources` (the host image, standing services, runtime components), `crossRepoBuildInputs`, `buildStepContextDirectories`; the `host`-kind source's repo is the one repo web biomes are delivered from | the runtime image source index, web-biome deliverability |
+| `pinRoles` | the snapshot pin key of the `data`, `kernel` and `deploy` roles | develop snapshots |
+| `confinedBiomes` | `[{biomeId, holds, consequence, admittedEditions}]` | the confinement check; absent means nothing is confined |
+
+`schemaVersion` stays 1: the sections are additive, and a file written for this library is
+refused by a library that predates them (unknown key), never mis-read.
+
+The `develop` freeze flags name roles, not repositories: `--data-sha`, `--kernel-sha`,
+`--deploy-sha` (they were `--distributions-sha`, `--kernel-contracts-sha`,
+`--xema-deploy-sha`; no aliases).
+
+## Evidence verbs (consumed by vendor-ops)
+
+The edition library builds, validates and verifies evidence statements. It NEVER signs: it holds no key, requests no OIDC token, and its cosign runner refuses every subcommand except `verify-blob-attestation`. A caller (vendor-ops) runs `cosign attest-blob`, `oras`, `git` and writes its own step outputs; it reads the JSON these verbs print and never parses a lock, a statement or a policy itself.
+
+Common to all verbs: root flags `--data-root`, `--editions-root`, `--sources-root`, `--kernel` (each verb names the ones it needs); JSON results go to stdout, diagnostics to stderr; exit 0 on success, 1 on any refusal (plus 2 for `plan-refresh` when a refresh is due). The kernel contract authority every statement binds is the one the data root's evidence-trust pin records (see Evidence trust); the trust policy is the one `edition-workspace.json` declares, held to its pin.
+
+| Verb | Arguments | Result |
+|---|---|---|
+| `xema edition chart-set resolve [--check]` | roots `--data-root --editions-root --deploy-root --kernel` | what `node resolve-chart-set.mjs` did: pins `chart-set.lock.json` and every edition's copy to the charts the registry serves; `--check` writes nothing and fails when the pin is stale |
+| `xema edition chart-set source-commit` | roots `--data-root --kernel`, env the registry credential variables the data root declares | read-only: for each publisher of the committed `chart-set.lock.json` it fetches the index chart at the LOCKED version and prints `{"schema":"xema.edition-chart-set-source/v1","publishers":[{"index","repo","version","sourceCommit"}]}` (the `xema.dev/chart-set-source-sha` annotation). It prints nothing and exits non-zero when the annotation is absent or not 40 lowercase hex, or when the index's roster differs from the charts the lock records for that publisher |
+| `xema edition biome-manifests <id> --json` | `--data-root --editions-root --sources-root --source-hash --kernel` | `{"schema":"xema.edition-biome-manifests/v1","distributionId","biomes":[{"id","repo","sourceCommit","manifest"}]}` sorted by id: each biome's `xema-biome.json` read at the commit its lock pins; an absent lock or an unreadable manifest is refused with nothing on stdout |
+| `xema edition list` | `--editions-root` | `{"schemaVersion":1,"editions":["<id>",…]}`; an empty root is refused |
+| `xema edition locks <id>` | `--data-root --editions-root --kernel` | `{"schemaVersion":1,"distributionId","contractAuthority","distributionLock","imageLock","repositoryPins":[…]}`, validated as the verifier validates them |
+| `xema edition evidence assemble-input` | `--output <file> --image-repository --manifest-digest --subject-kind --subject-id --source-repo --source-path --source-commit --provenance <file> [--source-manifest-hash] [--source-tree-hash] [--ttl-seconds]`, roots `--data-root --sources-root --kernel`, env `GITHUB_*` workflow context and the registry credential variables the data root declares | writes the producer-input JSON (mode 0600, never overwrites); reads the registry with the pinned oras |
+| `xema edition evidence check-committed` | `--input <file> --repository-root <dir> [--github-output <file>] [--now <epoch-ms>]`, roots `--data-root --kernel` | prints `REUSE`/`PRODUCE <directory>: <reason>`; with `--github-output` appends `reusable`, `evidence-directory`, `reason` |
+| `xema edition evidence plan-refresh` | `--distribution <id>… [--horizon-seconds] [--now] [--github-output <file>] [--kernel-checkout exact\|preview]`, roots `--data-root --editions-root --kernel` | prints the plan; exit 2 when a refresh is due; `--github-output` appends `refresh-due`, `due-subjects`, `total-subjects`, `due-repositories`; producer evidence is read only from the OCI referrers of each locked image. `--kernel-checkout exact` (default) loads the kernel from a clean checkout at the pinned authority commit; `preview` uses the kernel built at `--kernel`, held to no commit: it prints `LOCAL PREVIEW` and refuses `--github-output` |
+| `xema edition evidence statement producer stage` | `--input <file> --staging <abs dir> --github-repository --github-ref --github-sha --github-workflow-ref`, roots `--data-root --kernel` | creates the staging directory with `statements/<stem>.json`; prints the signing plan |
+| `xema edition evidence statement producer accept` | the `stage` flags plus `--output <abs dir> --cosign <abs path>` | verifies each bundle, builds the output from the statements the input derives and the canonical verified bundles ONLY (the staging must hold exactly what `stage` recorded), writes `producer-evidence.json`, and removes the staging whether it succeeds or refuses; the cosign version is the trust policy's `cosignVersion`; prints `{"schemaVersion":1,"kind":"producer","outputDirectory","producerEvidence":[…]}` |
+| `xema edition evidence statement completeness stage` | `--distribution --staging <abs dir> --release-sequence --release-source-commit --run-id --run-attempt --issued-at --expires-at --signer-repository --signer-ref --signer-workflow-path --github-repository --github-ref --github-sha --github-workflow-ref `, roots `--data-root --editions-root --kernel` | stages the edition's producer evidence under `producers/` and `completeness/statement.json`; prints the signing plan |
+| `xema edition evidence assemble-set` | the completeness `stage` flags plus `--evidence-root <abs dir> --cosign <abs path>` | re-resolves the producer evidence (it must equal the staged copy), verifies the signed completeness bundle, writes `evidence-set.json`, builds the evidence root from the derived files ONLY (the staging must hold exactly what `stage` recorded) and removes the staging whether it succeeds or refuses; prints `{"schemaVersion":1,"kind":"evidence-set","distributionId","evidenceRoot","evidenceSetPath","producerBundles","completenessStatementDigest"}` |
+| `xema edition evidence statement entitlement stage` | `--distribution --evidence-root <dir> --staging <abs dir> --customer --mode [--target-registry] --idempotency-key --run-id --run-attempt --issued-at --expires-at --signer-repository --signer-ref --signer-workflow-path --github-repository --github-ref --github-sha --github-workflow-ref`, roots `--data-root --kernel` | writes `entitlement/statement.json`; prints the signing plan |
+| `xema edition evidence statement entitlement accept` | the `stage` flags plus `--output <abs dir> --cosign <abs path>` | verifies the bundle, writes `entitlement.json`, builds the output from the derived files ONLY (the staging must hold exactly what `stage` recorded) and removes the staging whether it succeeds or refuses; prints `{"schemaVersion":1,"kind":"entitlement",…,"evidence":{…}}` |
+| `xema edition evidence oci attach-plan` | `--evidence-directory <abs dir> [--input <file>]`, roots `--data-root --kernel` | validates a produced evidence directory (with `--input`, against the statements that input builds) and prints `{"schemaVersion":1,"kind":"oci-attach-plan","evidenceDirectory","imageRepository","subjectDigest","subject","artifactType","distributionSpec","annotations":{…},"files":[{"path","mediaType"}]}`: the operands of `oras attach`, run from the evidence directory |
+| `xema edition evidence oci validate` | `--evidence-directory <abs dir> --manifest <file> --subject-digest <digest> [--input <file> --cosign <abs path> [--now <epoch-ms>]]`, roots `--data-root --kernel` | holds a pulled artifact (`oras pull`) to its manifest (`oras manifest fetch`); prints `{"schemaVersion":1,"kind":"oci-evidence","subjectDigest","created","subjects":[…],"matchesInput","remainingSeconds","reusable"}`. The last three are `null` without `--input`; with it every bundle is verified against the input's signer and a bundle that does not verify is a refusal |
+| `xema edition evidence oci backfill-plan` | `--distribution <id>… --producer-repository-root <abs dir>…`, roots `--data-root --editions-root --kernel`, env the registry credential variables the data root declares | prints `{"schemaVersion":1,"kind":"oci-backfill-plan","items":[{"status":"missing-git\|present\|missing","subjectKind","subjectId","imageRepository","subjectDigest","artifactDigest","attach"?}]}`; a `missing` item carries its attach plan; exit 2 unless every item is `present` |
+| `xema edition index runtime-image-source --repin-contract-authority` | roots `--data-root --sources-root --kernel --source-hash` | replaces ONLY `contractAuthority` of the committed `runtime-image-source-index.json` with the authority trusted from the `--kernel` checkout (clean, at the expected origin, else refused) and validates and rewrites it; every repository pin and subject is identical before and after. It writes the move on stdout and the owed follow-ups on stderr: `xema edition repin-evidence-trust`, re-resolving every edition (each `images.lock.json` carries the authority), and that signed producer statements made under the old authority no longer verify |
+| `xema edition source-closure` | `--repo <repo> --path <dir> --commit <40 hex>`, roots `--sources-root --source-hash --kernel` (the hash implementation is held to the kernel) | `{"schemaVersion":1,"repo","directory","commit","treeAlgorithm","treeHash","buildable","lockfileBlobId","closure":[{"directory","treeHash"}]}`: the facts a content coordinate is framed from |
+| `xema edition verify-evidence <id>` | see Evidence trust; `--descriptor <absolute path of the edition descriptor being verified>` (required: its `distributionId` must be the requested id and its `provenance.channel` is the channel whose signers may vouch for the evidence; it is held outside the graded checkouts like `--state`); plus `[--json]` (stdout is then exactly one `{"schema":"xema.edition-evidence-verification/v1","distributionId","channel","releaseSequence","statements":[{"predicateType","subject","statementDigest"}]}` document, where `statementDigest` is the digest of the verified statement, not of the image; the human text goes to stderr, and a failed verification prints no JSON); verifying a delivery entitlement is not available in this version | the in-repository gate and the release-checkout grading are this verifier; there is no second one. Its result is its exit status, the advanced replay state and, with `--json`, the verification document on stdout: it writes no "already verified" file and has no file-output flag. Verifying a delivery entitlement is not available in this version |
+
+The signing plan (stdout of every `stage`):
+
+```json
+{"schemaVersion":1,"kind":"producer|completeness|entitlement","root":"<staging dir>","predicateType":"<uri>",
+ "signer":{"certificateIdentity":"…","oidcIssuer":"…","githubWorkflow":{"repository":"…","ref":"…","path":"…"}},
+ "certificateWorkflowSha":"<40 hex>","statements":[{"statementPath":"<relative>","bundlePath":"<relative>"}]}
+```
+
+For each entry the caller runs `cosign attest-blob --yes --statement <root>/<statementPath> --bundle <root>/<bundlePath> --new-bundle-format <root>/<statementPath>` and then the matching `accept` (or `assemble-set`) with the SAME flags it staged with. `accept` re-derives every statement from those flags and refuses staged bytes that differ, so nothing but what the library built can be accepted; it rewrites the bundle as canonical JSON, requires its payload to be exactly the statement bytes, and runs `cosign verify-blob-attestation` against the plan's signer at `certificateWorkflowSha`. The staging directory must not exist before `stage`; the output is built in a private sibling `<output>.accepting-<pid>` on the output's filesystem and renamed into place. `accept` removes the staging whether it succeeds or refuses (a refusal of its arguments before the first read leaves it), so a signed-but-unaccepted bundle is never left behind; stage and sign again after a refusal.
+
+## Tests
+
+`node --test "edition/*.test.mjs" "edition/*-contract-tests.mjs"` (`pnpm run test:edition`).
+Tests build throwaway roots with `test-fixtures/workspace.mjs`. The kernel is the
+CLI's own installed `@xemahq/contracts`; nothing is supplied from outside and no test
+skips. The two sealing cases run the real openfga/cli v0.8.1 and FAIL, naming
+`XEMA_FGA_CLI`, when it is unset (CI installs it by checksum). `no-vendor-literals.test.mjs` fails on any organisation or
+registry literal in a shipped file.
+
+## Customer editions
+
+A customer edition is resolved against a CATALOGUE: `catalogue.json`, a titled layer of an offering's edition artifact
+(`xema.edition-catalogue/v1`: `offeringId`, `channel` (provenance only), `biomes`, `platformServices`, `images`,
+`chartSet`, `contractAuthority`, `ceiling`). The catalogue is the ceiling: it supplies availability, pins, digests and
+the chart-set, and never adds a component. The resolved set is the customer's `{biome}` selections, every
+`installationClass: core` entry and the transitive declared dependencies.
+
+    xema edition resolve --definition <file> --catalogue oci://<registry>/<repo>@sha256:<digest> --channel release \
+      --data-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir> --source-hash <dir> --out <dir> \
+      --source-image <source>=<registry>/<prefix> [--catalogue-username <u> --catalogue-token-env <VAR>]
+
+`--out` is the customer's editions root (`<out>/<id>/` receives the four locks). `--data-root` holds the customer's
+`edition-workspace.json`. The definition allows `{biome}` selectors (the same per-biome options a vendor offering's selector takes in the kernel
+schema, `installPolicy` and `mandatory`, and nothing else), `sources[]` (no registry), `trustCeiling` and
+`imageRegistryMirror`; `extends`, `exclude`, tier/origin/class selectors, `platformServices`, `visibility` and a source
+registry are refused.
+
+Ownership rules of the definition (the kernel's `parseCustomerEditionDefinition` and `customerTrustCeilingIssues`; `customer-definition.mjs` only calls them):
+`sources[].ref` is required and names a branch or a tag; a commit id (any full 40- or 64-hex git object id) is refused,
+because the seal records the resolved commit in the lock (the develop `--pins` file still supplies commits). `trustCeiling`
+is required when the definition declares `sources[]` and refused when it does not. It must assign every customer-source
+biome (a biome drawn from the definition's own `sources[]`) exactly once: a missing biome, a biome assigned twice and an
+extra biome that is not customer-sourced are refused.
+
+The vendor's trust domain is closed to a customer edition, by three refusals the CLI makes:
+- a `trustCeiling` assignment whose domain is the kernel's first-party domain is refused when the definition is parsed, naming the biomes and the domain;
+- a biome drawn from a declared `sources[]` entry (of any edition) whose manifest declares an origin other than third-party (`xema.trustTier`) is refused, naming the source and the biome;
+- the catalogue's `ceiling` bounds the resolve. Its `trustPolicy` (origin allow list), when stated, is the one the resolve applies to every biome of the lock.
+  Its `trustCeiling`, when stated, is written onto the vendor's rows of the customer lock, and for a customer-source biome it admits one domain: the domain the catalogue
+  assigns that biome when it names it, otherwise any domain the catalogue assigns to nothing. A definition that names another domain is refused, naming the biome and both domains.
+  A `null` member of `ceiling` bounds nothing.
+
+Handoff to the customer's registry: `oras cp` the catalogue artifact and the vendor images by digest, switch
+`EDITION_CATALOGUE_REF`, and declare `imageRegistryMirror: {complete: true, map: [{source, target}]}`. Prefixes match whole
+path segments; the digest never changes and no signature is re-verified at the mirrored ref (the customer's seal is the
+trust anchor and deploy is digest-anchored).
+
+The chart-set is copied whole from the catalogue: it states which deploy charts are available, not which components are
+selected, so it adds no component. `trustCeiling` has the kernel shape `{assignments: [{domain, biomes}]}`.
+
+### Locks, sealing and the catalogue's tree ids
+
+`resolve` writes the UNSEALED lock (`unsealedSchema`); `seal` attaches each biome's `biomeContentHash` and stamps
+`schemaVersion` 5, the only grammar. The hash is recomputed by `seal` AND by the verify step from the biome's
+`sourceManifestHash`, its git tree id at the pinned commit and the sorted image subject digests, through the kernel's
+`computeBiomeContentHash`; a mismatch (a tampered hash, 64 arbitrary hex digits, a changed manifest, tree id or image
+digest) is refused, naming the biome. `resolve --check` compares the unsealed projection byte for byte.
+
+A customer holds no checkout of the vendor's sources. `catalogue.json` therefore carries `sourceTreeIds` (each vendor
+biome's tree id at its pinned commit, written from the real tree by `edition catalogue` / `edition artifact`), and the
+customer's seal takes that tree id as an INPUT ON THE CATALOGUE'S AUTHORITY: it is not source verification, and the
+refusal text says so. A vendor biome absent from the catalogue is refused, not skipped.
+
+    xema edition seal <id> --catalogue oci://<registry>/<repo>@sha256:<digest> [--catalogue-username <u> --catalogue-token-env <VAR>] \
+      --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir> --source-hash <dir>
+
+Mirror runbook (`imageRegistryMirror`): 1. `oras cp` the catalogue artifact and every vendor image BY DIGEST into the
+customer's registry. 2. Point the definition at the mirrored catalogue digest. 3. Declare
+`imageRegistryMirror: {complete: true, map: [{source, target}]}` (whole path segments; `complete: true` refuses a vendor row no
+entry covers). 4. Resolve and seal: digests are unchanged, so the seal's hashes are unchanged; no signature is
+re-verified at the mirrored ref.
+
+### Develop customer edition
+
+    xema edition develop resolve --definition <file> --catalogue oci://<registry>/<repo>@sha256:<digest> \
+      --pins <file> --out <dir> --registry <namespace> --engine-image <repository>@sha256:<digest> \
+      --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir> --source-hash <dir> \
+      [--source-image <source>=<registry>/<prefix>]... [--catalogue-username <u> --catalogue-token-env <VAR>] [--local]
+
+The id is the definition's (no positional id). `--pins` holds exactly one `sources/<name>` commit per source the
+definition declares (the customer's own repositories; the vendor's pins are the catalogue's). The digest of the catalogue
+artifact is frozen into the descriptor's `provenance.pins` as `catalogue: "sha256:<64 hex>"` (typed per key: every other
+pin is a 40-hex commit), so the snapshot-hash tag covers it. The artifact is the one edition layout (`xema.edition/v1`,
+the descriptor plus the four locks) at `<namespace>/xema-edition-<id>`. Vendor image rows arrive sealed from the
+catalogue; only the customer's own rows are sealed against the develop image repositories. A customer artifact is not an
+offering and carries no `catalogue.json`. `edition-contract.json` lists `catalogue.json` under `offeringLayers` (a layer
+of an offering artifact, not a lock) and the `catalogue` pin under `provenancePins`.