npm - @xemahq/xema - Versions diffs - 0.48.0 → 0.49.0 - Mend

@xemahq/xema 0.48.0 → 0.49.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (98) hide show

package/dist/assets/appliance-base/distribution.lock.json +3936 -1515
package/dist/assets/appliance-base/images.lock.json +878 -1161
package/dist/assets/appliance-lean/distribution.lock.json +3663 -916
package/dist/assets/appliance-lean/images.lock.json +825 -924
package/dist/assets/boot-graph.json +398 -93
package/dist/assets/distribution-assets.manifest.json +10 -10
package/dist/commands/edition.d.ts.map +1 -1
package/dist/commands/edition.js +5 -3
package/dist/commands/edition.js.map +1 -1
package/dist/dev/env-defaults.d.ts.map +1 -1
package/dist/dev/env-defaults.js +0 -1
package/dist/dev/env-defaults.js.map +1 -1
package/dist/edition/verify-image-evidence.bundle.mjs +4386 -2503
package/dist/edition/verify-image-evidence.bundle.provenance.json +590 -488
package/dist/runtime/auth/cli-application.d.ts +18 -0
package/dist/runtime/auth/cli-application.d.ts.map +1 -0
package/dist/runtime/auth/cli-application.js +39 -0
package/dist/runtime/auth/cli-application.js.map +1 -0
package/dist/runtime/edition/verb-map.d.ts +3 -1
package/dist/runtime/edition/verb-map.d.ts.map +1 -1
package/dist/runtime/edition/verb-map.js +5 -1
package/dist/runtime/edition/verb-map.js.map +1 -1
package/dist/runtime/env-seeder.d.ts.map +1 -1
package/dist/runtime/env-seeder.js +21 -0
package/dist/runtime/env-seeder.js.map +1 -1
package/dist/runtime/launch.d.ts.map +1 -1
package/dist/runtime/launch.js +0 -18
package/dist/runtime/launch.js.map +1 -1
package/edition/README.md +20 -3
package/edition/biome-content.mjs +5 -2
package/edition/build-runtime-image-source-index.mjs +79 -5
package/edition/canonical-evidence-json.mjs +82 -0
package/edition/catalogue-evidence.mjs +8 -5
package/edition/customer-edition-verbs.mjs +9 -3
package/edition/develop-coverage-run.mjs +2 -1
package/edition/develop-coverage.mjs +12 -1
package/edition/develop-edition-resolve.mjs +3 -2
package/edition/develop-edition.mjs +15 -3
package/edition/develop-record-verify.mjs +216 -0
package/edition/develop-select-records.mjs +24 -225
package/edition/develop-verify-image-record.mjs +90 -0
package/edition/dist-check.mjs +22 -2
package/edition/distribution-evidence-set.mjs +30 -2
package/edition/edition-artifact.mjs +110 -22
package/edition/edition-ceiling.mjs +180 -0
package/edition/edition-config.mjs +91 -0
package/edition/edition-constants.mjs +21 -3
package/edition/edition-contract-parse.mjs +88 -3
package/edition/edition-contract.json +47 -4
package/edition/edition-image-seal.mjs +9 -2
package/edition/edition-kind.mjs +10 -0
package/edition/edition-protocol.mjs +7 -1
package/edition/edition-publisher.mjs +21 -0
package/edition/edition-seal.mjs +257 -0
package/edition/evidence-grammars.mjs +2 -0
package/edition/evidence-trust-pin.mjs +66 -10
package/edition/evidence-trust-policy.mjs +39 -29
package/edition/external-source-walk.mjs +16 -3
package/edition/fleet-coordinate-finality.mjs +18 -5
package/edition/fulcio-certificate-extensions.mjs +231 -0
package/edition/image-evidence.mjs +34 -79
package/edition/locked-bundle-signer.mjs +224 -0
package/edition/oci-evidence-verbs.mjs +7 -1
package/edition/pinned-cosign.mjs +70 -0
package/edition/plan-image-evidence-refresh.mjs +3 -1
package/edition/producer-evidence-bundle.mjs +3 -1
package/edition/producer-evidence-index-file.mjs +4 -0
package/edition/release-edition-artifact.mjs +3 -3
package/edition/repin-evidence-trust.mjs +6 -1
package/edition/resolve-distribution.mjs +47 -6
package/edition/resolve-edition.mjs +1 -1
package/edition/resolve-images.mjs +53 -7
package/edition/seal-image-digests.mjs +19 -8
package/edition/sealed-distribution-lock.mjs +2 -2
package/edition/third-party-admission.mjs +91 -0
package/edition/third-party-bundle-registry.mjs +147 -0
package/edition/third-party-certificate-extensions.mjs +21 -0
package/edition/third-party-image-pins.mjs +41 -0
package/edition/third-party-pins-trusted.mjs +24 -0
package/edition/third-party-producer-evidence.mjs +76 -0
package/edition/third-party-source-check.mjs +28 -0
package/edition/third-party-source-context.mjs +41 -0
package/edition/third-party-source-evidence.mjs +255 -0
package/edition/third-party-source-flags.mjs +134 -0
package/edition/third-party-source-pins.mjs +259 -0
package/edition/third-party-source-uniqueness.mjs +54 -0
package/edition/third-party-source-walk.mjs +115 -0
package/edition/third-party-source-writer.mjs +229 -0
package/edition/third-party-subjects.mjs +127 -0
package/edition/trust-policy-image-ownership.mjs +85 -0
package/edition/verify-catalogue-evidence.mjs +2 -0
package/edition/verify-image-evidence.mjs +2 -0
package/edition/verify-image-platforms.mjs +33 -9
package/package.json +5 -5
package/dist/runtime/auth/client-bootstrap.d.ts +0 -11
package/dist/runtime/auth/client-bootstrap.d.ts.map +0 -1
package/dist/runtime/auth/client-bootstrap.js +0 -60
package/dist/runtime/auth/client-bootstrap.js.map +0 -1

package/dist/assets/boot-graph.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "$comment": "GENERATED by tooling/codegen/generate-boot-graph.mjs. Node tiers come from each biome manifest's xema.scope; hard startup edges come from xema-biome.json xema.components[].protocol.requiresServices (the v5 component contract — the v4 ships.apis[] spelling is retired). A component with scheduler \"runtime\" is an image payload another service launches, not a standing workload, and is not a node. Non-biome services come from the platformServices[] of every resolved distribution lock. Edit the sources, never this file; regenerate with `pnpm gen:boot-graph`, which writes tooling/boundaries/boot-graph.json and repos-infra/xema-deploy/generated/boot-graph.json — the third copy, repos/xema-cli/apps/xema-cli/assets/boot-graph.json, is refreshed by that CLI package’s own sync script and asserted by --check.",
+  "$comment": "GENERATED by tooling/codegen/generate-boot-graph.mjs. Node tiers come from each biome manifest's xema.scope; hard startup edges come from xema-biome.json xema.components[].protocol.requiresServices (the v5 component contract — the v4 ships.apis[] spelling is retired). A component with scheduler \"runtime\" is an image payload another service launches, not a standing workload, and is not a node. Per-node optionalPeers are request-time peers (protocol.optionalServices, plus the capability registry for every biome-owned service): they carry no boot ordering and are never merged into startupRequires. Non-biome services come from xema-distributions platform-service-index.json, cross-checked against the platformServices[] of every resolved distribution lock. Edit the sources, never this file; regenerate with `pnpm gen:boot-graph`, which writes tooling/boundaries/boot-graph.json and repos-infra/xema-deploy/generated/boot-graph.json — the third copy, repos/xema-cli/apps/xema-cli/assets/boot-graph.json, is refreshed by that CLI package’s own sync script and asserted by --check.",
   "tiers": {
     "base": 2,
     "edge": 4,
@@ -13,14 +13,20 @@
     "event-hub-api",
     "identity-api",
     "kernel-state",
-    "llm-gateway-api",
-    "secrets-api"
+    "llm-gateway-api"
   ],
   "services": {
     "activity-feed-api": {
       "tier": "base",
       "startupRequires": [
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "redis-pool-api"
       ]
     },
     "agent-session-api": {
@@ -30,27 +36,71 @@
         "biome-host-api",
         "capability-registry-api",
         "decision-api",
+        "event-hub-api",
         "identity-api",
         "object-registry-api",
+        "org-database-pool-api",
         "public-gateway-api",
         "resource-governance-api",
         "workload-runtime-api",
         "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "container-registry-api",
+        "credential-broker-api",
+        "llm-registry-api",
+        "mcp-gateway-api",
+        "project-registry-api",
+        "skill-registry-api",
+        "web-access-api",
+        "workspace-orchestrator-api",
+        "workspace-storage-pool-api",
+        "xema-store-api"
       ]
     },
+    "agent-session-worker": {
+      "tier": "base",
+      "startupRequires": [
+        "authorization-api",
+        "biome-host-api",
+        "capability-registry-api",
+        "decision-api",
+        "identity-api",
+        "object-registry-api",
+        "org-database-pool-api",
+        "public-gateway-api",
+        "resource-governance-api",
+        "workload-runtime-api",
+        "xema-capability-router"
+      ],
+      "optionalPeers": []
+    },
     "app-forge-api": {
       "tier": "platform",
       "startupRequires": [
+        "agent-session-api",
         "app-platform-api",
+        "authorization-api",
         "identity-api",
         "org-database-pool-api",
         "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "app-function-broker",
+        "capability-registry-api",
+        "xema-store-api"
       ]
     },
     "app-function-broker": {
       "tier": "platform",
       "startupRequires": [
-        "identity-api"
+        "identity-api",
+        "workload-runtime-api"
+      ],
+      "optionalPeers": [
+        "app-forge-api",
+        "capability-registry-api"
       ]
     },
     "app-platform-api": {
@@ -59,46 +109,82 @@
         "authorization-api",
         "biome-host-api",
         "identity-api",
-        "object-registry-api"
+        "object-registry-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "resource-governance-api",
+        "workload-runtime-api"
       ]
     },
     "artifact-store-api": {
       "tier": "base",
       "startupRequires": [
         "biome-host-api",
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "audit-log-api": {
       "tier": "system",
       "startupRequires": [
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "authorization-api": {
       "tier": "system",
-      "startupRequires": [
-        "identity-api"
-      ]
-    },
-    "backlog-api": {
-      "tier": "base",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "decision-api",
+        "llm-registry-api",
+        "resource-governance-api",
+        "space-registry-api"
       ]
     },
     "biome-fetcher-api": {
       "tier": "base",
       "startupRequires": [
         "identity-api"
+      ],
+      "optionalPeers": [
+        "biome-host-api",
+        "capability-registry-api"
       ]
     },
     "biome-host-api": {
       "tier": "system",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "authorization-api",
+        "biome-fetcher-api",
+        "capability-registry-api",
+        "decision-api",
+        "llm-registry-api",
+        "org-database-pool-api",
+        "workload-runtime-api",
+        "workspace-orchestrator-api",
+        "xema-capability-router"
       ]
     },
     "canopy-api": {
@@ -106,19 +192,39 @@
       "startupRequires": [
         "capability-registry-api",
         "identity-api",
+        "org-database-pool-api",
         "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "llm-registry-api"
       ]
     },
     "capability-registry-api": {
       "tier": "system",
       "startupRequires": [
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "audit-log-api",
+        "authorization-api",
+        "space-registry-api"
       ]
     },
     "channel-gateway-api": {
       "tier": "base",
       "startupRequires": [
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "connector-gateway-api",
+        "credential-broker-api"
       ]
     },
     "connector-gateway-api": {
@@ -126,15 +232,42 @@
       "startupRequires": [
         "authorization-api",
         "capability-registry-api",
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "credential-broker-api",
+        "search-api",
+        "workload-runtime-api"
+      ]
+    },
+    "connector-sync-api": {
+      "tier": "platform",
+      "startupRequires": [
+        "authorization-api",
         "decision-api",
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api",
+        "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "llm-registry-api"
       ]
     },
     "container-registry-api": {
       "tier": "base",
       "startupRequires": [
+        "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "workload-runtime-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "control-plane-api": {
@@ -143,30 +276,55 @@
         "authorization-api",
         "biome-host-api",
         "capability-registry-api",
+        "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "space-registry-api"
+      ],
+      "optionalPeers": [
+        "app-platform-api",
+        "capability-registry-api",
+        "deliverable-specs-api",
+        "llm-registry-api",
+        "project-registry-api",
+        "skill-registry-api"
       ]
     },
     "credential-broker-api": {
       "tier": "base",
       "startupRequires": [
+        "event-hub-api",
         "identity-api",
-        "secrets-api"
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "decision-api": {
       "tier": "system",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "authorization-api",
+        "capability-registry-api"
       ]
     },
     "deliverable-specs-api": {
       "tier": "base",
       "startupRequires": [
         "biome-host-api",
+        "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "resource-governance-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "skill-registry-api"
       ]
     },
     "design-system-builder-api": {
@@ -177,31 +335,49 @@
         "event-hub-api",
         "identity-api",
         "knowledge-base-api",
+        "org-database-pool-api",
         "workflow-engine-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "template-registry-api"
       ]
     },
     "distribution-api": {
       "tier": "base",
       "startupRequires": [
         "identity-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "docs-api": {
       "tier": "platform",
-      "startupRequires": []
+      "startupRequires": [],
+      "optionalPeers": []
     },
     "document-render-api": {
       "tier": "base",
       "startupRequires": [
         "capability-registry-api",
         "identity-api",
+        "org-database-pool-api",
         "template-registry-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "knowledge-base-api"
       ]
     },
     "fleet-control-api": {
       "tier": "base",
       "startupRequires": [
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "knowledge-base-api": {
@@ -209,55 +385,63 @@
       "startupRequires": [
         "authorization-api",
         "capability-registry-api",
+        "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "public-gateway-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "connector-gateway-api",
+        "llm-registry-api"
       ]
     },
     "license-api": {
       "tier": "base",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "fleet-control-api"
       ]
     },
     "llm-registry-api": {
       "tier": "base",
       "startupRequires": [
+        "authorization-api",
         "biome-host-api",
+        "event-hub-api",
         "identity-api",
         "llm-gateway-api",
+        "org-database-pool-api",
         "resource-governance-api",
         "xema-capability-router"
-      ]
-    },
-    "mailops-api": {
-      "tier": "platform",
-      "startupRequires": [
-        "artifact-store-api",
+      ],
+      "optionalPeers": [
+        "agent-session-api",
         "authorization-api",
+        "billing-api",
         "capability-registry-api",
-        "connector-gateway-api",
         "credential-broker-api",
-        "event-hub-api",
-        "identity-api",
-        "workflow-engine-api",
-        "xema-capability-router"
-      ]
-    },
-    "managed-llm-economy-api": {
-      "tier": "platform",
-      "startupRequires": [
-        "event-hub-api",
-        "identity-api",
-        "llm-gateway-api",
-        "llm-registry-api"
+        "deliverable-specs-api",
+        "skill-registry-api"
       ]
     },
     "mcp-gateway-api": {
       "tier": "base",
       "startupRequires": [
         "biome-host-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "credential-broker-api",
+        "redis-pool-api"
       ]
     },
     "memory-api": {
@@ -267,62 +451,102 @@
         "event-hub-api",
         "identity-api",
         "llm-registry-api",
+        "org-database-pool-api",
         "project-registry-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "object-registry-api": {
       "tier": "system",
       "startupRequires": [
+        "event-hub-api",
         "identity-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "memory-api",
+        "xema-store-api"
       ]
     },
     "opencode-image-prepuller": {
       "tier": "platform",
-      "startupRequires": []
+      "startupRequires": [],
+      "optionalPeers": []
     },
     "org-database-pool-api": {
       "tier": "system",
       "startupRequires": [
+        "event-hub-api",
         "identity-api"
+      ],
+      "optionalPeers": [
+        "audit-log-api",
+        "capability-registry-api",
+        "resource-governance-api"
+      ]
+    },
+    "org-database-pool-worker": {
+      "tier": "system",
+      "startupRequires": [
+        "identity-api"
+      ],
+      "optionalPeers": [
+        "biome-host-api",
+        "resource-governance-api"
       ]
     },
     "project-registry-api": {
       "tier": "base",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "artifact-store-api",
+        "authorization-api",
+        "capability-registry-api",
+        "connector-gateway-api",
+        "knowledge-base-api",
+        "workflow-engine-api"
       ]
     },
     "public-gateway-api": {
       "tier": "system",
       "startupRequires": [
+        "event-hub-api",
         "identity-api"
+      ],
+      "optionalPeers": [
+        "biome-host-api",
+        "capability-registry-api"
       ]
     },
     "redis-pool-api": {
       "tier": "system",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "resource-governance-api": {
       "tier": "system",
       "startupRequires": [
-        "identity-api"
-      ]
-    },
-    "scm-connector-api": {
-      "tier": "platform",
-      "startupRequires": [
-        "capability-registry-api",
-        "connector-gateway-api",
+        "authorization-api",
+        "decision-api",
         "event-hub-api",
         "identity-api",
-        "llm-registry-api",
-        "project-registry-api",
-        "space-registry-api",
-        "workflow-engine-api"
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "billing-api",
+        "capability-registry-api"
       ]
     },
     "search-api": {
@@ -333,29 +557,52 @@
         "identity-api",
         "llm-gateway-api",
         "llm-registry-api",
+        "org-database-pool-api",
         "project-registry-api",
         "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "skill-registry-api": {
       "tier": "base",
       "startupRequires": [
         "biome-host-api",
-        "identity-api"
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "capability-registry-api",
+        "llm-registry-api"
       ]
     },
     "space-registry-api": {
       "tier": "system",
       "startupRequires": [
+        "authorization-api",
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "decision-api"
       ]
     },
     "template-registry-api": {
       "tier": "system",
       "startupRequires": [
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "authorization-api",
+        "capability-registry-api",
+        "resource-governance-api"
       ]
     },
     "user-hub-api": {
@@ -363,119 +610,177 @@
       "startupRequires": [
         "capability-registry-api",
         "event-hub-api",
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "activity-feed-api",
+        "authorization-api",
+        "capability-registry-api",
+        "decision-api",
+        "project-registry-api",
+        "workflow-engine-api"
       ]
     },
     "web-access-api": {
       "tier": "base",
       "startupRequires": [
         "identity-api"
-      ]
-    },
-    "webapp-studio-api": {
-      "tier": "platform",
-      "startupRequires": [
-        "agent-session-api",
-        "connector-gateway-api",
-        "event-hub-api",
-        "identity-api",
-        "org-database-pool-api",
-        "project-registry-api",
-        "xema-store-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
     "workflow-engine-api": {
       "tier": "base",
       "startupRequires": [
+        "authorization-api",
         "biome-host-api",
         "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "resource-governance-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "deliverable-specs-api",
+        "llm-registry-api",
+        "project-registry-api"
       ]
     },
     "workflow-runtime-worker": {
       "tier": "base",
       "startupRequires": [
+        "authorization-api",
         "event-hub-api",
         "identity-api"
-      ]
+      ],
+      "optionalPeers": []
     },
     "workload-runtime-api": {
       "tier": "system",
-      "startupRequires": [
-        "identity-api"
-      ]
-    },
-    "workspace-git-api": {
-      "tier": "platform",
       "startupRequires": [
         "event-hub-api",
         "identity-api",
-        "workspace-orchestrator-api"
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "public-gateway-api"
       ]
     },
     "workspace-materialization-api": {
       "tier": "base",
       "startupRequires": [
         "identity-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api",
+        "knowledge-base-api"
       ]
     },
     "workspace-orchestrator-api": {
       "tier": "base",
       "startupRequires": [
+        "authorization-api",
         "biome-host-api",
+        "event-hub-api",
         "identity-api",
         "llm-gateway-api",
+        "org-database-pool-api",
         "resource-governance-api",
         "workload-runtime-api",
         "workspace-storage-pool-api",
         "xema-capability-router"
+      ],
+      "optionalPeers": [
+        "agent-session-api",
+        "artifact-store-api",
+        "capability-registry-api",
+        "connector-gateway-api",
+        "container-registry-api",
+        "deliverable-specs-api",
+        "knowledge-base-api",
+        "llm-registry-api",
+        "mcp-gateway-api",
+        "project-registry-api",
+        "skill-registry-api",
+        "space-registry-api",
+        "workflow-engine-api",
+        "workspace-materialization-api"
       ]
     },
     "workspace-storage-pool-api": {
       "tier": "system",
       "startupRequires": [
-        "identity-api"
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "capability-registry-api"
       ]
     },
-    "xema-biome-runner": {
-      "tier": "base",
-      "startupRequires": []
-    },
     "xema-capability-router": {
       "tier": "system",
       "startupRequires": [
-        "identity-api"
+        "authorization-api",
+        "event-hub-api",
+        "identity-api",
+        "org-database-pool-api"
+      ],
+      "optionalPeers": [
+        "audit-log-api",
+        "capability-registry-api",
+        "credential-broker-api",
+        "workload-runtime-api"
       ]
     },
     "xema-host-web": {
       "tier": "edge",
-      "startupRequires": []
+      "startupRequires": [],
+      "optionalPeers": []
     },
     "xema-kernel-server": {
       "tier": "kernel",
-      "startupRequires": []
+      "startupRequires": [],
+      "optionalPeers": []
     },
     "xema-platform-worker": {
       "tier": "system",
       "startupRequires": [
         "identity-api"
-      ]
+      ],
+      "optionalPeers": []
     },
     "xema-shell-api": {
       "tier": "platform",
       "startupRequires": [
+        "event-hub-api",
         "identity-api"
+      ],
+      "optionalPeers": [
+        "authorization-api",
+        "capability-registry-api",
+        "object-registry-api",
+        "org-database-pool-api",
+        "xema-capability-router"
       ]
     },
     "xema-store-api": {
       "tier": "base",
       "startupRequires": [
+        "audit-log-api",
         "authorization-api",
         "decision-api",
         "event-hub-api",
         "identity-api",
+        "org-database-pool-api",
         "resource-governance-api"
+      ],
+      "optionalPeers": [
+        "billing-api",
+        "biome-fetcher-api",
+        "capability-registry-api"
       ]
     }
   }