@xemahq/xema 0.52.0 → 0.54.0

package/edition/resolve-distribution.mjs

@@ -74,6 +74,7 @@ import {
   sealEditionAuthorizationBase,
   writeAuthorizationLock,
 } from './authorization-base.mjs';
+import { RefusalError, captureRefusal, isRefusal, throwCollectedRefusals } from './collected-refusals.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
@@ -95,16 +96,8 @@ import {
   validateImmutableDistributionLock,
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
-import { BundleSignerPolicyAbsentError, GitSourcedHostModuleBundleError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
-import {
-  assertInstalledOperationCeilingAdmitted,
-  assertOperationGrantsAdmitted,
-  assertExactAudiencesAdmitted,
-  assertOrganizationSweepsAdmitted,
-  assertEventSubscriptionsAdmitted,
-  assertOrgContextRelaysAdmitted,
-  assertStoreWorkloadCeilingAdmitted,
-} from './operation-grant-admission.mjs';
+import { BundleSignerPolicyAbsentError, BundleSignerRefusedError, GitSourcedHostModuleBundleError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
+import { admitDistributionLock } from './operation-grant-admission.mjs';
 import { PUBLISHED_PIN_SOURCE, pinnedSource } from './pin-source.mjs';
 import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
 import { closureBiomeFacts } from './positive-closure.mjs';
@@ -151,7 +144,7 @@ export function lockedServiceProcessFacts(entry) {
   const facts = entry.serviceProcessFacts ?? {};
   const named = Object.keys(facts).sort();
   if (serializeJson(named) !== serializeJson([...services].sort())) {
-    throw new Error(
+    throw new RefusalError(
       `biome "${entry.id}" carries process facts for [${named.join(', ')}] but ships ` +
         `services [${services.join(', ')}] — every shipped service has exactly one ` +
         'row; regenerate the biome index.',
@@ -181,14 +174,14 @@ function versionSatisfies(actual, range) {
   };
   const a = parse(actual);
   if (!a) {
-    throw new Error(`cannot parse actual version "${actual}"`);
+    throw new RefusalError(`cannot parse actual version "${actual}"`);
   }
   const trimmed = range.trim();
   const op = trimmed[0] === '^' || trimmed[0] === '~' ? trimmed[0] : '=';
   const bare = op === '=' ? trimmed : trimmed.slice(1);
   const r = parse(bare);
   if (!r) {
-    throw new Error(
+    throw new RefusalError(
       `cannot parse version range "${range}" — only exact / ^ / ~ forms are supported by this bounded checker`,
     );
   }
@@ -222,7 +215,7 @@ function versionSatisfies(actual, range) {
 const REFUSED_EXTENDS_FIELD = 'extends';
 
 /** An edition definition that breaks the edition model (a refused field); a caller tells it from an I/O or schema error by class. */
-export class EditionModelError extends Error {
+export class EditionModelError extends RefusalError {
   constructor(message) {
     super(message);
     this.name = 'EditionModelError';
@@ -240,7 +233,7 @@ const REFUSED_PLATFORM_SERVICES_FIELD = 'platformServices';
  * A selection or declared dependency the index does not hold. Against a
  * catalogue it is the catalogue's ceiling: the caller names the catalogue.
  */
-export class UnknownSelectionError extends Error {
+export class UnknownSelectionError extends RefusalError {
   constructor(message) {
     super(message);
     this.name = 'UnknownSelectionError';
@@ -254,7 +247,7 @@ export class UnknownSelectionError extends Error {
 export function loadEditionManifest(parseDistribution, id) {
   const path = join(editionsRoot(), id, 'xema-distribution.json');
   if (!existsSync(path)) {
-    throw new Error(`distribution "${id}" not found: ${path} does not exist`);
+    throw new RefusalError(`distribution "${id}" not found: ${path} does not exist`);
   }
   return parseEditionManifest(parseDistribution, id, readStrictJsonFile(path), path);
 }
@@ -271,7 +264,7 @@ export function parseEditionManifest(parseDistribution, id, raw, source) {
     );
   }
   if (raw !== null && typeof raw === 'object' && Object.hasOwn(raw, REFUSED_PLATFORM_SERVICES_FIELD)) {
-    throw new Error(
+    throw new RefusalError(
       `edition "${id}": "${REFUSED_PLATFORM_SERVICES_FIELD}" is not part of the edition definition; ` +
         'the platform substrate is drawn from platform-service-index.json by installation class ' +
         "(core class, the classes the edition's include names, and services a shipped biome's API requires)",
@@ -280,7 +273,7 @@ export function parseEditionManifest(parseDistribution, id, raw, source) {
   // `sourcePins` reaches the kernel unchanged: its Distribution schema validates it.
   const manifest = parseDistribution(raw);
   if (manifest.id !== id) {
-    throw new Error(`distribution at ${source} declares id "${manifest.id}", but it was addressed as "${id}"`);
+    throw new RefusalError(`distribution at ${source} declares id "${manifest.id}", but it was addressed as "${id}"`);
   }
   return manifest;
 }
@@ -355,7 +348,7 @@ function webBiomeProducerRepo() {
   const hosts = workspaceSection('runtimeImageSources', 'knowing which repository produces web biomes')
     .supplementalSources.filter((source) => source.kind === RuntimeSubjectKind.Host);
   if (hosts.length !== 1) {
-    throw new Error(
+    throw new RefusalError(
       `edition-workspace.json runtimeImageSources must declare exactly one "${RuntimeSubjectKind.Host}" source ` +
         `(the image web biomes are bundled into); it declares ${hosts.length}`,
     );
@@ -449,7 +442,7 @@ export function isUniversal(entry) {
  */
 export function assertIndexDeclaresInstallationClasses(id, index) {
   if (!index.some((entry) => entry.installationClass !== undefined)) {
-    throw new Error(
+    throw new RefusalError(
       `distribution "${id}": NO entry in the biome index carries an installationClass, so ` +
         `the index cannot say which components are universal (installationClass core) ` +
         `and every edition would resolve without its floor. The tier is never read in its ` +
@@ -460,14 +453,14 @@ export function assertIndexDeclaresInstallationClasses(id, index) {
   const universal = universalInstallationClass();
   for (const entry of [...index].sort(compareIndexEntries)) {
     if (entry.tier === 'kernel' && entry.installationClass !== universal) {
-      throw new Error(
+      throw new RefusalError(
         `distribution "${id}": kernel-tier biome "${entry.id}" (${entry.repo}) declares ` +
           `installationClass ${entry.installationClass === undefined ? '(none)' : `"${entry.installationClass}"`}; ` +
           `every kernel-tier biome must declare "${universal}" — fix the manifest and regenerate the index.`,
       );
     }
     if (entry.installationClass === universal && entry.audience === 'operator') {
-      throw new Error(
+      throw new RefusalError(
         `distribution "${id}": operator biome "${entry.id}" (${entry.repo}) declares installationClass ` +
           `"${universal}" — an operator biome ships only where an edition names it, so it cannot be universal.`,
       );
@@ -581,7 +574,7 @@ export function mergeExternalSourceEntries(
   // customer's private biome shipping inside `oss`.
   const unstamped = externalEntries.filter((entry) => entry.source === undefined);
   if (unstamped.length > 0) {
-    throw new Error(
+    throw new RefusalError(
       `refusing to merge ${unstamped.length} UNSTAMPED external entr(ies) ` +
         `(${unstamped.map((entry) => entry.id).join(', ')}) into the biome index: an entry ` +
         'with no source stamp is platform-default and admissible to every edition.',
@@ -635,7 +628,7 @@ function isThirdPartyOciSourceEntry(entry, sourceRecords) {
 function requireSourceRecord(entry, sourceRecords) {
   const record = sourceRecords.get(entry.source);
   if (record === undefined) {
-    throw new Error(
+    throw new RefusalError(
       `biome "${entry.id}" is stamped with source "${entry.source}", but no pinned source ` +
         'record was produced for that name. A stamped entry with no record cannot be traced ' +
         'to a revision, and emitting it unstamped would make it read as first-party.',
@@ -677,7 +670,7 @@ function applySelectors(index, include, declaredSourceNames = new Set(), webProd
     }
     if (existing.form === form) {
       if (existing.policy !== policy) {
-        throw new Error(
+        throw new RefusalError(
           `conflicting installPolicy for biome "${entryId}": two ${form}-form selectors ` +
             `stamp "${existing.policy}" and "${policy}" — resolve the manifest ambiguity`,
         );
@@ -718,7 +711,7 @@ function applySelectors(index, include, declaredSourceNames = new Set(), webProd
           entrySourceAdmissible(e, declaredSourceNames),
       );
       if (matches.length === 0) {
-        throw new Error(
+        throw new RefusalError(
           `include { installationClass: "${sel.installationClass}" } matches no biome in ` +
             `the index. An edition that asks for a class nothing declares is asking for ` +
             `something that cannot be built; name the biomes explicitly or drop the selector.`,
@@ -743,7 +736,7 @@ function applySelectors(index, include, declaredSourceNames = new Set(), webProd
       );
       if (inadmissible.length > 0 && inadmissible.length === idMatches.length) {
         const names = [...new Set(inadmissible.map((e) => e.source))].sort();
-        throw new Error(
+        throw new RefusalError(
           `include { biome: "${sel.biome}" } names a biome drawn from source(s) ` +
             `${names.map((name) => `"${name}"`).join(', ')}, which this edition does not ` +
             `declare in sources[]. A biome is reachable only from a source its own ` +
@@ -757,7 +750,7 @@ function applySelectors(index, include, declaredSourceNames = new Set(), webProd
       // naming an operator biome is how you force it in, while naming a web
       // biome with no producer asks for something no build can make.
       if (idMatches.every((e) => !isDeliverable(e, webProducerRepos))) {
-        throw new Error(
+        throw new RefusalError(
           `include { biome: "${sel.biome}" } names a target:web biome authored in ` +
             `"${idMatches[0].repo}". Only web biomes under ` +
             `"${(webProducerRepos ?? [webBiomeProducerRepo()]).join(', ')}" are bundled into the host image, so nothing ` +
@@ -772,20 +765,20 @@ function applySelectors(index, include, declaredSourceNames = new Set(), webProd
             try {
               return versionSatisfies(e.version, sel.version);
             } catch (err) {
-              throw new Error(
+              throw new RefusalError(
                 `version check for biome "${sel.biome}" failed: ${err.message}`,
               );
             }
           })
         : idMatches;
       if (sel.version && matches.length === 0) {
-        throw new Error(
+        throw new RefusalError(
           `include { biome: "${sel.biome}", version: "${sel.version}" } matched ids but no index version satisfied the range ` +
             `(available: ${idMatches.map((m) => m.version).join(', ')})`,
         );
       }
     } else {
-      throw new Error(`unrecognized selector shape: ${JSON.stringify(sel)}`);
+      throw new RefusalError(`unrecognized selector shape: ${JSON.stringify(sel)}`);
     }
     for (const e of matches) {
       const key = entryKey(e);
@@ -877,7 +870,7 @@ function selectByPositiveClosure({
           : { kind };
       if ('platformService' in root) {
         if (!platformSourcesByName.has(root.platformService)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": ${cls} root names platform service ` +
               `"${root.platformService}", which platform-service-index.json does not describe`,
           );
@@ -957,7 +950,7 @@ function selectByPositiveClosure({
     });
   } catch (error) {
     if (error instanceof BiomeClosureError) {
-      throw new Error(`distribution "${id}": ${error.message}`, {
+      throw new RefusalError(`distribution "${id}": ${error.message}`, {
         cause: error,
       });
     }
@@ -985,7 +978,7 @@ function selectByPositiveClosure({
   for (const entry of [...selected.values()].sort(compareIndexEntries)) {
     for (const required of entry.requires ?? []) {
       if (!shippedIds.has(required)) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${entry.id}" declares that it requires biome ` +
             `"${required}", which positive closure did not include — its dependency ` +
             'contract carries no required edge to it. Either the contract is missing ' +
@@ -999,7 +992,7 @@ function selectByPositiveClosure({
           ? shippedPlatformServices.has(edge.requiredService)
           : shippedIds.has(edge.owner.biomeId);
       if (!satisfied) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${entry.id}" API "${edge.consumerService}" declares ` +
             `that it requires service "${edge.requiredService}" (owned by ` +
             `${edge.owner.kind === 'platform' ? 'platform service' : `biome "${edge.owner.biomeId}"`}), ` +
@@ -1050,7 +1043,7 @@ export function serviceResourceBinder(distributionId, selectedEntries, schemas)
   for (const entry of selectedEntries) {
     for (const provision of entry.providesResources ?? []) {
       if (!(Array.isArray(entry.services) && entry.services.includes(provision.service))) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${distributionId}": biome "${entry.id}" declares that ` +
             `"${provision.service}" provides ${provision.kind}, but it does not ` +
             `ship that service`,
@@ -1070,7 +1063,7 @@ export function serviceResourceBinder(distributionId, selectedEntries, schemas)
         `${requirement.kind} "${requirement.logicalName}" (${requirement.scope}-scoped, ` +
         `${requirement.inclusion})`;
       if (providers.length > 1) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${distributionId}": ${subject}, and ${providers.length} ` +
             `shipped services provide that kind: ` +
             `${providers.map((p) => `${p.biomeId}/${p.serviceName}`).join(', ')}. ` +
@@ -1080,7 +1073,7 @@ export function serviceResourceBinder(distributionId, selectedEntries, schemas)
       }
       if (providers.length === 0) {
         if (requirement.inclusion === 'required') {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${distributionId}": ${subject}, and no shipped service ` +
               `provides ${requirement.kind}. Select the biome that provides it, ` +
               `or exclude the consumer.`,
@@ -1096,6 +1089,7 @@ export function serviceResourceBinder(distributionId, selectedEntries, schemas)
         logicalName: requirement.logicalName,
         scope: requirement.scope,
         inclusion: requirement.inclusion,
+        ...(requirement.sharing === undefined ? {} : { sharing: requirement.sharing }),
         provider: providers[0],
       });
     }
@@ -1132,7 +1126,7 @@ export function nexusBinder(distributionId, selectedEntries, schemas) {
   for (const entry of selectedEntries) {
     for (const provision of entry.nexusProvides ?? []) {
       if (!(Array.isArray(entry.services) && entry.services.includes(provision.component))) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${distributionId}": biome "${entry.id}" declares that ` +
             `component "${provision.component}" provides nexus service ` +
             `${provision.service}@${provision.version}, but it does not ship that ` +
@@ -1149,7 +1143,7 @@ export function nexusBinder(distributionId, selectedEntries, schemas) {
     })),
   );
   if (!result.ok) {
-    throw new Error(
+    throw new RefusalError(
       `distribution "${distributionId}": ${result.refusals.length} Nexus ` +
         `requirement(s) cannot be bound:\n` +
         result.refusals
@@ -1160,7 +1154,7 @@ export function nexusBinder(distributionId, selectedEntries, schemas) {
   return result.bindings;
 }
 
-export function resolveDistributionFromInputs(
+export function resolveUnadmittedDistributionFromInputs(
   id,
   index,
   schemas,
@@ -1214,7 +1208,7 @@ export function resolveDistributionFromInputs(
   }
   for (const [biomeId, entries] of entriesById) {
     if (entries.length > 1) {
-      throw new Error(
+      throw new RefusalError(
         `distribution "${id}": biome id "${biomeId}" resolves to multiple compound identities: ` +
           entries
             .map((entry) => `${entry.target}@${entry.repo}/${entry.path}`)
@@ -1227,7 +1221,7 @@ export function resolveDistributionFromInputs(
   const platformSourcesByName = new Map();
   for (const source of platformServiceIndex.services) {
     if (platformSourcesByName.has(source.name)) {
-      throw new Error(
+      throw new RefusalError(
         `distribution "${id}": platform service "${source.name}" has ambiguous source identities in platform-service-index.json`,
       );
     }
@@ -1298,7 +1292,7 @@ export function resolveDistributionFromInputs(
       const isBiome = entriesById.has(excludedId);
       const platformService = platformServices.get(excludedId);
       if (isBiome && platformService) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}" excludes "${excludedId}", which is BOTH a biome id and a ` +
             `platform service name — the shared exclude namespace cannot choose safely`,
         );
@@ -1307,7 +1301,7 @@ export function resolveDistributionFromInputs(
         // Mirrors the universal-biome rule below: a core-class service is in
         // every installation, so it can never be opted out of.
         if (isUniversal(platformService)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}" tries to exclude universal (installationClass core) platform ` +
               `service "${excludedId}" — a universal service is in every edition and cannot be excluded`,
           );
@@ -1316,7 +1310,7 @@ export function resolveDistributionFromInputs(
         continue;
       }
       if (!isBiome) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}" excludes unknown biome or platform service "${excludedId}"`,
         );
       }
@@ -1368,7 +1362,7 @@ export function resolveDistributionFromInputs(
     // (3) Apply exclude — but a universal biome cannot be excluded.
     for (const ex of excludedBiomes) {
       if (universalEntries.some((e) => e.id === ex)) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}" tries to exclude universal (installationClass core) biome "${ex}" — ` +
             `a universal biome is in every edition and cannot be excluded`,
         );
@@ -1405,7 +1399,7 @@ export function resolveDistributionFromInputs(
     const requireBiomeOwner = (consumer, edge) => {
       const owner = edge.owner;
       if (owner.target !== 'server') {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${consumer.id}" API "${edge.consumerService}" requires service ` +
             `"${edge.requiredService}" from cross-target ${owner.target} biome "${owner.biomeId}"`,
         );
@@ -1421,7 +1415,7 @@ export function resolveDistributionFromInputs(
           candidate.services.includes(edge.requiredService),
       );
       if (matches.length !== 1) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${consumer.id}" API "${edge.consumerService}" requires service ` +
             `"${edge.requiredService}", but its exact biome owner ${owner.biomeId} ` +
             `(${owner.target}@${owner.repo}/${owner.path}, ${owner.version}, ${owner.sourceManifestHash}) ` +
@@ -1443,7 +1437,7 @@ export function resolveDistributionFromInputs(
     const requirePlatformOwner = (consumer, edge) => {
       const source = edge.owner.source;
       if (source.name !== edge.requiredService) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${consumer.id}" API "${edge.consumerService}" service edge ` +
             `"${edge.requiredService}" carries mismatched platform owner "${source.name}"`,
         );
@@ -1456,7 +1450,7 @@ export function resolveDistributionFromInputs(
         );
       }
       if (serializeJson(canonical) !== serializeJson(source)) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${consumer.id}" API "${edge.consumerService}" requires platform service ` +
             `"${edge.requiredService}", but its exact committed source identity is absent or mismatched`,
         );
@@ -1475,7 +1469,7 @@ export function resolveDistributionFromInputs(
       }
       const declared = shippedPlatformServices.get(edge.requiredService);
       if (!declared) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${consumer.id}" API "${edge.consumerService}" requires platform service ` +
             `"${edge.requiredService}", but the distribution explicitly excludes it`,
         );
@@ -1529,7 +1523,7 @@ export function resolveDistributionFromInputs(
       pullWebBiomesOf(entry);
       for (const req of [...entry.requires].sort()) {
         if (excludedBiomes.has(req)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" (${entry.repo}) requires "${req}", ` +
               `but the distribution explicitly excludes it`,
           );
@@ -1548,7 +1542,7 @@ export function resolveDistributionFromInputs(
         if (
           dependencies.some((dependency) => dependency.audience === 'operator')
         ) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" (${entry.repo}) requires operator biome "${req}", ` +
               `which must be selected explicitly by id`,
           );
@@ -1568,7 +1562,7 @@ export function resolveDistributionFromInputs(
         );
         if (foreignDeps.length > 0 && foreignDeps.length === dependencies.length) {
           const names = [...new Set(foreignDeps.map((d) => d.source))].sort();
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" (${entry.repo}) requires "${req}", ` +
               `which is drawn from source(s) ${names.map((name) => `"${name}"`).join(', ')} ` +
               `that this edition does not declare in sources[]. Refusing rather than ` +
@@ -1592,14 +1586,14 @@ export function resolveDistributionFromInputs(
       if (entry.dependencyContract !== undefined) {
         for (const target of schemas.contractRequiredServiceTargets(entry.dependencyContract)) {
           if (excludedPlatformServices.has(target)) {
-            throw new Error(
+            throw new RefusalError(
               `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
                 `"${target}", but the distribution explicitly excludes it`,
             );
           }
           for (const owner of serverOwnersOfService.get(target) ?? []) {
             if (excludedBiomes.has(owner.id)) {
-              throw new Error(
+              throw new RefusalError(
                 `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
                   `"${target}" owned by explicitly excluded biome "${owner.id}"`,
               );
@@ -1609,7 +1603,7 @@ export function resolveDistributionFromInputs(
       }
       for (const edge of entry.serviceDependencies ?? []) {
         if (!entry.services.includes(edge.consumerService)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" service dependency names unknown consumer API ` +
               `"${edge.consumerService}"`,
           );
@@ -1620,7 +1614,7 @@ export function resolveDistributionFromInputs(
         }
         const dependency = requireBiomeOwner(entry, edge);
         if (excludedBiomes.has(dependency.id)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" API "${edge.consumerService}" requires service ` +
               `"${edge.requiredService}" owned by explicitly excluded biome "${dependency.id}"`,
           );
@@ -1629,7 +1623,7 @@ export function resolveDistributionFromInputs(
           dependency.audience === 'operator' &&
           !includedIds.has(dependency.id)
         ) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" API "${edge.consumerService}" requires service ` +
               `"${edge.requiredService}" owned by operator biome "${dependency.id}", which must be selected explicitly`,
           );
@@ -1659,7 +1653,7 @@ export function resolveDistributionFromInputs(
         });
         if (provider.id === entry.id) {continue;}
         if (excludedBiomes.has(provider.id)) {
-          throw new Error(
+          throw new RefusalError(
             `distribution "${id}": biome "${entry.id}" service "${requirement.consumerService}" requires ` +
               `${requirement.kind} "${requirement.logicalName}" provided by explicitly excluded biome "${provider.id}"`,
           );
@@ -1720,7 +1714,7 @@ export function resolveDistributionFromInputs(
       }
     }
     const refuseWidening = (consumer, via, pulledClass) => {
-      throw new Error(
+      throw new RefusalError(
         `distribution "${id}": biome "${consumer.id}" ${via}, which declares ` +
           `installationClass "${pulledClass}" — "${consumer.id}" is in this edition only ` +
           `through the class selector(s) [${[...admittedClasses].sort().join(', ')}], and what a ` +
@@ -1763,7 +1757,7 @@ export function resolveDistributionFromInputs(
     const allow = new Set(trustPolicy.allow);
     for (const e of selected.values()) {
       if (!allow.has(e.origin)) {
-        throw new Error(
+        throw new RefusalError(
           `distribution "${id}": biome "${e.id}" (${e.repo}) has origin "${e.origin}", not in trustPolicy.allow [${[...allow].join(', ')}]`,
         );
       }
@@ -1796,6 +1790,7 @@ export function resolveDistributionFromInputs(
 
   // (5c') Bundle signers — every OCI bundle row (a biome's, a host module's) states the signer the data root's
   // trust policy selects for it. See `locked-bundle-signer.mjs`.
+  const bundleSignerRefusals = [];
   const bundleSignerOf = (e, bundleSource, componentKey) => {
     const subject = { biomeId: e.id, ...(componentKey === undefined ? {} : { componentKey }), origin: e.origin, repo: e.repo, bundleSource };
     if (composed?.bundleSigners === undefined) {
@@ -1803,7 +1798,8 @@ export function resolveDistributionFromInputs(
         `${componentKey === undefined ? `biome "${e.id}"` : `host module "${componentKey}" of biome "${e.id}"`} is an OCI bundle, but this resolve was given no bundle signer selection`,
       );
     }
-    return composed.bundleSigners.signerFor(subject);
+    // Every row is selected before any is refused, so one run names them all; the lock is not built from a refused row.
+    return captureRefusal(bundleSignerRefusals, () => composed.bundleSigners.signerFor(subject), isRefusal);
   };
   // A row drawn from a GIT source carries no OCI bundle (biome-level; an OCI host-module bundle is refused below), hence no bundleSigner: it is built
   // from the pinned source, and the manifest's `bundleSource` names a release artifact not built from this commit.
@@ -2310,6 +2306,9 @@ export function resolveDistributionFromInputs(
   // one (the kernel refuses an empty list), carried unchanged.
   if (storeEventCeiling !== undefined) {lock.storeEventCeiling = storeEventCeiling;}
 
+  // (6b) Every bundle signer refusal found while building the rows, together: none, and the lock is whole.
+  throwCollectedRefusals(bundleSignerRefusals, BundleSignerRefusedError);
+
   // (7) Re-derive the ownership index through the KERNEL so the table this
   //     resolver emits is validated by the exact code every consumer will read
   //     it with (`capability-registry-api`, `xema-capability-router`). Catches
@@ -2321,21 +2320,24 @@ export function resolveDistributionFromInputs(
   schemas.resolveFirstPartyCapabilityDomains(lock);
 
   // (8) Validate against the BUILT kernel schema — fail-fast.
-  const parsed = schemas.parseUnsealedDistributionLock(lock);
-  // (9) Admit every declared service-to-service operation requirement; a
-  //     refusal throws, so a lock with one is never returned to be written.
-  //     An optional operation left ungranted is reported, one line each, and
-  //     never fails (the resolve and `edition check` both run through here).
-  assertOperationGrantsAdmitted(schemas, parsed, { report: (line) => console.log(`[operations] ${line}`) });
-  assertOrganizationSweepsAdmitted(schemas, parsed);
-  assertExactAudiencesAdmitted(schemas, parsed);
-  assertOrgContextRelaysAdmitted(schemas, parsed);
-  assertEventSubscriptionsAdmitted(schemas, parsed);
-  assertInstalledOperationCeilingAdmitted(schemas, parsed);
-  assertStoreWorkloadCeilingAdmitted(schemas, parsed);
+  schemas.parseUnsealedDistributionLock(lock);
   return validateImmutableDistributionLock(lock);
 }
 
+/**
+ * Admit every declared service-to-service operation requirement of a composed lock; a refusal throws, so a lock with
+ * one is never returned to be written. An optional operation left ungranted is reported, one line each, and never
+ * fails (the resolve and `edition check` both run through here). Admission only reads the lock.
+ */
+export const admitResolvedLock = (schemas, lock) => admitDistributionLock(schemas, lock, { report: (line) => console.log(`[operations] ${line}`) });
+
+/** The lock composed over the inputs, admitted: what every release caller gets. */
+export function resolveDistributionFromInputs(id, index, schemas, composed, resolvedAt, platformServiceIndex) {
+  const lock = resolveUnadmittedDistributionFromInputs(id, index, schemas, composed, resolvedAt, platformServiceIndex);
+  admitResolvedLock(schemas, lock);
+  return lock;
+}
+
 /**
  * Produce a lock object for a distribution id (used by both the CLI and
  * dist-check). `resolvedAt` is freshly stamped each call; callers that diff
@@ -2359,7 +2361,18 @@ export async function resolveDistribution(id) {
  * `materialize` is the walk's one network seam, injectable for the contract
  * suite exactly as it is on `walkDeclaredSources`.
  */
-export async function resolveDistributionWithIndex(id, { materialize, inputs, readManifest } = {}) {
+export async function resolveDistributionWithIndex(id, options = {}) {
+  const { lock, index, schemas } = await prepareDistributionWithIndex(id, options);
+  admitResolvedLock(schemas, lock);
+  return { lock, index };
+}
+
+/**
+ * `resolveDistributionWithIndex` up to, and not including, admission: the composed lock, its index and the kernel
+ * schemas it was composed with. A develop resolve admits it itself, beside its other checks, so every refusal is
+ * reported in one run; the lock bytes are the ones the admitting variant returns.
+ */
+export async function prepareDistributionWithIndex(id, { materialize, inputs, readManifest } = {}) {
   const schemas = await loadKernelDistributionSchemas();
   // The manifest is composed FIRST, because it is what declares the sources and
   // what refuses a malformed definition before any other work. The walk then
@@ -2403,7 +2416,7 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
     inputs !== undefined && Object.hasOwn(inputs, 'storePublisherTrust')
       ? inputs.storePublisherTrust
       : readStorePublisherTrust();
-  const lock = resolveDistributionFromInputs(
+  const lock = resolveUnadmittedDistributionFromInputs(
     id,
     index,
     schemas,
@@ -2416,7 +2429,7 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
     new Date().toISOString(),
     platformServiceIndex,
   );
-  return { lock, index };
+  return { lock, index, schemas };
 }
 
 /**
@@ -2434,7 +2447,7 @@ export function assertReleaseGitSourcesDeclareNoBundle(lock, index) {
       (bundleSource) => bundleSource?.kind === 'oci',
     );
     if (declared !== undefined) {
-      throw new Error(
+      throw new RefusalError(
         `biome "${biome.id}" is drawn from git source "${biome.source.name}" and declares an OCI bundleSource (${declared.ociRef}); ` +
           'a release does not carry it: declare the biome as an `oci` source with a third-party source pin instead',
       );
@@ -2462,7 +2475,7 @@ export async function writeResolvedDistribution(id, { log = true, materialize, f
   // edition; resolve-chart-set.mjs keeps every copy on the pin thereafter.
   const pinPath = fleetChartSetLockPath();
   if (!existsSync(pinPath)) {
-    throw new Error(`${pinPath} is missing — run resolve-chart-set.mjs; an edition is not resolved without its chart set`);
+    throw new RefusalError(`${pinPath} is missing — run resolve-chart-set.mjs; an edition is not resolved without its chart set`);
   }
   const pinText = readFileSync(pinPath, 'utf8');
   writeEditionChartSet(join(editionsRoot(), id), pinText);
@@ -2513,7 +2526,7 @@ export async function sealAuthorizationBase(id, lock, index, { log = true } = {}
  */
 export async function composeAuthorizationBase(id, lock, index) {
   if (!Array.isArray(index)) {
-    throw new Error(
+    throw new RefusalError(
       `${id}: sealAuthorizationBase needs the index the lock was resolved from ` +
         '(resolveDistributionWithIndex). The committed platform index alone does not hold a source-walked biome.',
     );