@xemahq/xema 0.59.0 → 0.60.1

package/edition/oci-image-source-evidence.mjs

@@ -1,364 +0,0 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-
-import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
-import { canonicalJson, sha256Digest } from './image-evidence.mjs';
-import { compareStrings } from './lib.mjs';
-import { OrasRegistry } from './oras.mjs';
-import { BUNDLE_MEDIA_TYPE } from './produce-image-source-evidence.mjs';
-import {
-  EvidenceIntegrityError,
-  PRODUCER_EVIDENCE_INDEX_FILE,
-  PRODUCER_EVIDENCE_INDEX_MEDIA_TYPE,
-  PRODUCER_STATEMENT_MEDIA_TYPE,
-  producerEvidenceLayerFiles,
-  readProducerEvidenceDirectory,
-  readRawStatementAuthorityCommits,
-} from './producer-evidence-bundle.mjs';
-import {
-  loadRegistryCredentialDeclarations,
-  resolveRegistryCredential,
-  splitImageRef,
-} from './registry-credentials.mjs';
-
-export const IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE =
-  'application/vnd.xema.image-source-evidence.v2';
-/** The E4 statement an edition artifact carries as an `oras attach` referrer (the catalogue's signed evidence). */
-export const EDITION_CATALOGUE_EVIDENCE_ARTIFACT_TYPE =
-  'application/vnd.xema.edition-catalogue-evidence.v1';
-export const OCI_IMAGE_MANIFEST_MEDIA_TYPE =
-  'application/vnd.oci.image.manifest.v1+json';
-const OCI_TITLE_ANNOTATION = 'org.opencontainers.image.title';
-const OCI_CREATED_ANNOTATION = 'org.opencontainers.image.created';
-
-/** One registry reader per authority, each with the credential the data root declares for it. */
-export function createRegistryClientResolver({ dataRoot, factory }) {
-  const declarations = loadRegistryCredentialDeclarations(dataRoot);
-  const clients = new Map();
-  return (authority) => {
-    if (clients.has(authority)) {return clients.get(authority);}
-    const client = factory
-      ? factory(authority)
-      : new OrasRegistry({
-          credential: resolveRegistryCredential({ authority, declarations }),
-        });
-    clients.set(authority, client);
-    return client;
-  };
-}
-
-function exactRelativePath(value, label) {
-  if (
-    typeof value !== 'string' ||
-    value.length === 0 ||
-    value.startsWith('/') ||
-    value.split('/').some((part) => !part || part === '.' || part === '..')
-  ) {
-    throw new Error(`${label} is not a contained relative path`);
-  }
-  return value;
-}
-
-function expectedMediaType(path) {
-  if (path === PRODUCER_EVIDENCE_INDEX_FILE) {
-    return PRODUCER_EVIDENCE_INDEX_MEDIA_TYPE;
-  }
-  if (path.startsWith('statements/')) {return PRODUCER_STATEMENT_MEDIA_TYPE;}
-  if (path.startsWith('bundles/')) {return BUNDLE_MEDIA_TYPE;}
-  throw new Error(`OCI evidence layer has unsupported title "${path}"`);
-}
-
-export function validateImageSourceEvidenceManifest({
-  manifest,
-  subjectDigest,
-}) {
-  if (
-    manifest?.schemaVersion !== 2 ||
-    manifest.mediaType !== OCI_IMAGE_MANIFEST_MEDIA_TYPE ||
-    manifest.artifactType !== IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE ||
-    manifest.subject?.digest !== subjectDigest ||
-    !Array.isArray(manifest.layers) ||
-    manifest.layers.length < 3
-  ) {
-    throw new Error(
-      'image-source evidence artifact is not an OCI 1.1 manifest for the exact subject',
-    );
-  }
-  const created = manifest.annotations?.[OCI_CREATED_ANNOTATION];
-  if (typeof created !== 'string' || !Number.isFinite(Date.parse(created))) {
-    throw new Error(`image-source evidence artifact has no valid ${OCI_CREATED_ANNOTATION}`);
-  }
-  const seen = new Set();
-  let indexCount = 0;
-  for (const layer of manifest.layers) {
-    const title = exactRelativePath(
-      layer?.annotations?.[OCI_TITLE_ANNOTATION],
-      'OCI evidence layer title',
-    );
-    if (seen.has(title)) {
-      throw new Error(`OCI evidence manifest duplicates layer title "${title}"`);
-    }
-    seen.add(title);
-    if (
-      !SHA256_DIGEST_PATTERN.test(layer.digest ?? '') ||
-      !Number.isSafeInteger(layer.size) ||
-      layer.size < 0 ||
-      layer.mediaType !== expectedMediaType(title)
-    ) {
-      throw new Error(`OCI evidence layer "${title}" has an invalid descriptor`);
-    }
-    if (title === PRODUCER_EVIDENCE_INDEX_FILE) {indexCount += 1;}
-  }
-  if (indexCount !== 1) {
-    throw new Error('OCI evidence manifest requires exactly one producer evidence index');
-  }
-  return { created, layers: manifest.layers };
-}
-
-export function validateMaterializedImageSourceEvidence({
-  directory,
-  manifest,
-  subjectDigest,
-  schemas,
-}) {
-  const { created, layers } = validateImageSourceEvidenceManifest({
-    manifest,
-    subjectDigest,
-  });
-  const evidence = readProducerEvidenceDirectory({ directory, schemas });
-  const declared = producerEvidenceLayerFiles(evidence.records)
-    .map(({ path, mediaType }) => `${path}\0${mediaType}`)
-    .sort(compareStrings);
-  const materialized = layers
-    .map(
-      (layer) => `${layer.annotations[OCI_TITLE_ANNOTATION]}\0${layer.mediaType}`,
-    )
-    .sort(compareStrings);
-  if (canonicalJson(declared) !== canonicalJson(materialized)) {
-    throw new Error(
-      'OCI evidence layers are not the exact files declared by producer-evidence.json',
-    );
-  }
-  for (const record of evidence.records) {
-    const artifact = record.statement.predicate.artifact;
-    if (
-      artifact.manifestDigest !== subjectDigest ||
-      record.statement.subject[0]?.name !== artifact.imageRepository ||
-      `sha256:${record.statement.subject[0]?.digest?.sha256}` !== subjectDigest
-    ) {
-      throw new Error(`${record.key} statement is not bound to OCI subject ${subjectDigest}`);
-    }
-    if (record.statement.predicate.producerRun.issuedAt !== created) {
-      throw new Error(
-        `${record.key} issuance does not match the OCI artifact creation annotation`,
-      );
-    }
-  }
-  return { ...evidence, created };
-}
-
-function assertExpectedAuthorityCommit(value) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error('the expected kernel contract authority commit is required');
-  }
-}
-
-/** The referrer is not usable evidence under the expected authority: it is skipped for its subject and reported, never thrown past the resolver. */
-export class InvalidEvidenceReferrerError extends Error {
-  constructor({ artifactDigest, reason, sourceCommit = null, cause }) {
-    super(`evidence referrer ${artifactDigest} is invalid: ${reason}`, { cause });
-    this.name = 'InvalidEvidenceReferrerError';
-    this.artifactDigest = artifactDigest;
-    this.reason = reason;
-    this.sourceCommit = sourceCommit;
-  }
-}
-
-/** The artifact states a kernel contract authority other than the one evidence is read under. */
-export class ForeignAuthorityReferrerError extends InvalidEvidenceReferrerError {
-  constructor({ artifactDigest, sourceCommit, expectedAuthorityCommit }) {
-    super({
-      artifactDigest,
-      sourceCommit,
-      reason: `stated under kernel contract authority ${sourceCommit}, not ${expectedAuthorityCommit}`,
-    });
-    this.name = 'ForeignAuthorityReferrerError';
-  }
-}
-
-/** What a skipped referrer is reported as: the one sentence naming it and why it is not evidence. */
-export function describeInvalidReferrer(skipped) {
-  return `referrer ${skipped.artifactDigest}: ${skipped.reason}`;
-}
-
-/** The one stderr line that names a skipped invalid referrer. */
-export function writeInvalidReferrerReport(skipped) {
-  process.stderr.write(
-    `[evidence] skipped ${skipped.imageRepository}@${skipped.subjectDigest} ${describeInvalidReferrer(skipped)}\n`,
-  );
-}
-
-/**
- * Fetch, content-address validate and decode one OCI evidence artifact.
- * `getBlob` verifies every digest again, independently of the manifest.
- * An artifact that is not valid evidence under `expectedAuthorityCommit`
- * (a manifest that is not the exact subject's, RAW statements stating another authority commit, a
- * failed strict parse, a statement whose contract authority is not exactly
- * `expectedContractAuthority`, which is required) is refused with `InvalidEvidenceReferrerError`; a
- * registry that cannot answer, or bytes that do not match their digests
- * (`EvidenceIntegrityError`, a tampering signal), still throw.
- */
-export async function readImageSourceEvidenceArtifact({
-  client,
-  repository,
-  subjectDigest,
-  artifactDigest,
-  schemas,
-  expectedAuthorityCommit,
-  expectedContractAuthority,
-}) {
-  assertExpectedAuthorityCommit(expectedAuthorityCommit);
-  if (!expectedContractAuthority) {
-    throw new Error('the expected kernel contract authority is required');
-  }
-  const fetched = await client.getManifestByDigest(repository, artifactDigest);
-  const invalid = (error) =>
-    new InvalidEvidenceReferrerError({
-      artifactDigest,
-      reason: error instanceof Error ? error.message : String(error),
-      cause: error,
-    });
-  let validated;
-  try {
-    validated = validateImageSourceEvidenceManifest({
-      manifest: fetched.document,
-      subjectDigest,
-    });
-  } catch (error) {
-    throw invalid(error);
-  }
-  const { created, layers } = validated;
-  const directory = mkdtempSync(join(tmpdir(), 'xema-oci-evidence-'));
-  try {
-    for (const layer of layers) {
-      const title = layer.annotations[OCI_TITLE_ANNOTATION];
-      const bytes = await client.getBlob(repository, layer.digest);
-      if (bytes.length !== layer.size || sha256Digest(bytes) !== layer.digest) {
-        throw new EvidenceIntegrityError(
-          `OCI evidence layer "${title}" does not match its descriptor`,
-        );
-      }
-      const path = join(directory, title);
-      mkdirSync(dirname(path), { recursive: true });
-      writeFileSync(path, bytes, { flag: 'wx', mode: 0o600 });
-    }
-    try {
-      for (const sourceCommit of readRawStatementAuthorityCommits({ directory })) {
-        if (sourceCommit !== expectedAuthorityCommit) {
-          throw new ForeignAuthorityReferrerError({
-            artifactDigest,
-            sourceCommit,
-            expectedAuthorityCommit,
-          });
-        }
-      }
-      const evidence = validateMaterializedImageSourceEvidence({
-        directory,
-        manifest: fetched.document,
-        subjectDigest,
-        schemas,
-      });
-      // The wire schema checks the shape of an authority's sourcePaths only
-      // (contracts 0.110.3), so a statement naming the expected commit with
-      // another path set or digest parses: it is not evidence under the pin.
-      for (const record of evidence.records) {
-        if (canonicalJson(record.statement.predicate.contractAuthority) !== canonicalJson(expectedContractAuthority)) {
-          throw new Error(`${record.key} statement's kernel contract authority is not exactly the expected one at ${expectedAuthorityCommit}`);
-        }
-      }
-      return { ...evidence, artifactDigest, created };
-    } catch (error) {
-      if (error instanceof InvalidEvidenceReferrerError || error instanceof EvidenceIntegrityError) {
-        throw error;
-      }
-      throw invalid(error);
-    }
-  } finally {
-    rmSync(directory, { recursive: true, force: true });
-  }
-}
-
-/**
- * Resolve the newest valid evidence referrer deterministically. Every
- * referrer of the subject is evaluated; one that is not valid evidence under
- * `expectedContractAuthority` (foreign authority, bad statement, bad layers)
- * is reported to `onInvalidReferrer` and skipped. It is never a fallback: an
- * invalid referrer is not read as evidence, however old or new. Returns null
- * when no referrer is valid; the handler has then named each invalid one.
- */
-export async function resolveImageSourceEvidenceReferrer({
-  client,
-  imageRepository,
-  subjectDigest,
-  schemas,
-  expectedContractAuthority,
-  onInvalidReferrer,
-}) {
-  const expectedAuthorityCommit = expectedContractAuthority?.sourceCommit;
-  assertExpectedAuthorityCommit(expectedAuthorityCommit);
-  if (typeof onInvalidReferrer !== 'function') {
-    throw new Error('an invalid-referrer report handler is required');
-  }
-  const { authority, repository } = splitImageRef(imageRepository);
-  if (client.authority !== authority) {
-    throw new Error(
-      `registry client for ${client.authority} cannot read ${imageRepository}`,
-    );
-  }
-  const descriptors = await client.listReferrers(
-    repository,
-    subjectDigest,
-    IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE,
-  );
-  const matching = descriptors.filter(
-    (descriptor) =>
-      descriptor?.artifactType === IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE,
-  );
-  if (matching.length === 0) {return null;}
-  const candidates = [];
-  for (const descriptor of matching) {
-    if (!SHA256_DIGEST_PATTERN.test(descriptor.digest ?? '')) {
-      throw new Error('registry returned a non-canonical evidence referrer digest');
-    }
-    try {
-      candidates.push(
-        await readImageSourceEvidenceArtifact({
-          client,
-          repository,
-          subjectDigest,
-          artifactDigest: descriptor.digest,
-          schemas,
-          expectedAuthorityCommit,
-          expectedContractAuthority,
-        }),
-      );
-    } catch (error) {
-      if (!(error instanceof InvalidEvidenceReferrerError)) {throw error;}
-      onInvalidReferrer({
-        imageRepository,
-        subjectDigest,
-        artifactDigest: error.artifactDigest,
-        reason: error.reason,
-        sourceCommit: error.sourceCommit,
-        expectedAuthorityCommit,
-      });
-    }
-  }
-  if (candidates.length === 0) {return null;}
-  candidates.sort((left, right) => {
-    const byCreated = compareStrings(right.created, left.created);
-    return byCreated || compareStrings(left.artifactDigest, right.artifactDigest);
-  });
-  return candidates[0];
-}

package/edition/operation-grant-admission.mjs

@@ -1,285 +0,0 @@
-/**
- * Admission of service-to-service operation grants at the lock.
- *
- * A manifest declares intent (`requiresOperations`, carried in the lock as
- * `operationRequirements`); the kernel's `admitOperationGrants` admits or
- * refuses every requirement, and a refusal is never a warning. The resolve
- * and the seal both call {@link assertOperationGrantsAdmitted}, so a lock with
- * a refused requirement is neither written nor sealed. The installed-operation
- * ceiling (`requestsInstalledOperations`, carried as `installedOperationRequests`)
- * and the edition's store-workload ceiling are admitted the same way.
- */
-
-import { RefusalError, collectRefusals, isRefusal, joinRefusalMessages } from './collected-refusals.mjs';
-
-/** Thrown when one or more declared operation requirements are not admitted. */
-export class OperationGrantAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, operation: string, message: string}>} refusals
-   * @param {ReadonlyArray<{caller: object, operation: string, reason: string}>} [ungrantedOptional] what the kernel left ungranted beside the refusals
-   */
-  constructor(distributionId, refusals, ungrantedOptional = []) {
-    super(
-      `distribution "${distributionId}" declares operation requirements that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'OperationGrantAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-    this.ungrantedOptional = ungrantedOptional;
-  }
-}
-
-/**
- * One informational line per optional operation the kernel left ungranted
- * (`ungrantedOptional`): the edition is valid, the caller runs without it.
- */
-export function ungrantedOptionalOperationLines(distributionId, ungrantedOptional) {
-  return ungrantedOptional.map(
-    ({ caller, operation, reason }) =>
-      `distribution "${distributionId}": optional operation ${operation} of ${caller.biome}/${caller.component} is not granted (${reason})`,
-  );
-}
-
-/**
- * Admit every operation requirement of `lock` through the kernel, or throw
- * {@link OperationGrantAdmissionError} listing every refusal. Returns the
- * admitted grants. `report`, when given, receives each line of
- * {@link ungrantedOptionalOperationLines}; an ungranted optional operation never fails.
- */
-export function assertOperationGrantsAdmitted(schemas, lock, { report } = {}) {
-  const { grants, refusals, ungrantedOptional, platformServiceRefusals } = schemas.admitOperationGrants(lock);
-  // A platform service's refused requirement fails exactly like a biome component's, through the same error.
-  const allRefusals = [...refusals, ...platformServiceRefusals];
-  if (allRefusals.length > 0) {
-    throw new OperationGrantAdmissionError(lock.distributionId, allRefusals, ungrantedOptional);
-  }
-  if (report !== undefined) {
-    for (const line of ungrantedOptionalOperationLines(lock.distributionId, ungrantedOptional)) {report(line);}
-  }
-  return grants;
-}
-
-/** Thrown when one or more declared organization sweeps are not admitted. */
-export class OrganizationSweepAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, biome: string, component: string, sweep: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares organization sweeps that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'OrganizationSweepAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit every organization sweep requirement of `lock` through the kernel
- * (`admitOrganizationSweeps`), or throw {@link OrganizationSweepAdmissionError}
- * listing every refusal. Returns the admitted rows. The resolve and the seal
- * call it beside {@link assertOperationGrantsAdmitted}.
- */
-export function assertOrganizationSweepsAdmitted(schemas, lock) {
-  const { grants, refusals } = schemas.admitOrganizationSweeps(lock);
-  if (refusals.length > 0) {
-    throw new OrganizationSweepAdmissionError(lock.distributionId, refusals);
-  }
-  return grants;
-}
-
-/** Thrown when one or more declared exact audiences are not admitted. */
-export class ExactAudienceAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares audience requirements that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'ExactAudienceAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit every exact-audience requirement of `lock` through the kernel
- * (`admitExactAudiences`), or throw {@link ExactAudienceAdmissionError} listing
- * every refusal. Returns the admitted grants. The resolve and the seal call it
- * beside {@link assertOperationGrantsAdmitted}.
- */
-export function assertExactAudiencesAdmitted(schemas, lock) {
-  const { grants, refusals } = schemas.admitExactAudiences(lock);
-  if (refusals.length > 0) {
-    throw new ExactAudienceAdmissionError(lock.distributionId, refusals);
-  }
-  return grants;
-}
-
-/** Thrown when one or more requested installed operations are not admitted into the ceiling. */
-export class InstalledOperationCeilingAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, biome: string, component: string, operation: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares installed operation requests that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'InstalledOperationCeilingAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit every installed-operation request of `lock` through the kernel
- * (`admitInstalledOperationCeiling`), or throw
- * {@link InstalledOperationCeilingAdmissionError} listing every refusal.
- * Returns the admitted ceiling rows.
- */
-export function assertInstalledOperationCeilingAdmitted(schemas, lock) {
-  const { ceilings, refusals } = schemas.admitInstalledOperationCeiling(lock);
-  if (refusals.length > 0) {
-    throw new InstalledOperationCeilingAdmissionError(lock.distributionId, refusals);
-  }
-  return ceilings;
-}
-
-/** Thrown when one or more domains of the edition's store-workload ceiling are not admitted. */
-export class StoreWorkloadCeilingAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, domain: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares a store-workload ceiling that is not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'StoreWorkloadCeilingAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit the store-workload ceiling of `lock` through the kernel
- * (`admitStoreWorkloadCeiling`), or throw
- * {@link StoreWorkloadCeilingAdmissionError} listing every refusal. Returns the
- * resolved ceiling.
- */
-export function assertStoreWorkloadCeilingAdmitted(schemas, lock) {
-  const { ceiling, refusals } = schemas.admitStoreWorkloadCeiling(lock);
-  if (refusals.length > 0) {
-    throw new StoreWorkloadCeilingAdmissionError(lock.distributionId, refusals);
-  }
-  return ceiling;
-}
-
-/** Thrown when one or more declared organization-context relays are not admitted. */
-export class OrgContextRelayAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, biome: string, component: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares organization-context relays that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'OrgContextRelayAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit every `orgContextRelayers` entry of `lock` through the kernel
- * (`admitOrgContextRelays`), or throw {@link OrgContextRelayAdmissionError}
- * listing every refusal. Returns the admitted relay rows.
- */
-export function assertOrgContextRelaysAdmitted(schemas, lock) {
-  const { relays, refusals } = schemas.admitOrgContextRelays(lock);
-  if (refusals.length > 0) {
-    throw new OrgContextRelayAdmissionError(lock.distributionId, refusals);
-  }
-  return relays;
-}
-
-/** Thrown when one or more declared event subscription clauses are not admitted. */
-export class EventSubscriptionAdmissionError extends RefusalError {
-  /**
-   * @param {string} distributionId
-   * @param {ReadonlyArray<{code: string, biome: string, component: string, message: string}>} refusals
-   */
-  constructor(distributionId, refusals) {
-    super(
-      `distribution "${distributionId}" declares event subscriptions that are not admitted:\n` +
-        refusals.map((refusal) => `[${refusal.code}] ${refusal.message}`).join('\n'),
-    );
-    this.name = 'EventSubscriptionAdmissionError';
-    this.distributionId = distributionId;
-    this.refusals = refusals;
-  }
-}
-
-/**
- * Admit every `eventSubscriptionRequirements` clause of `lock` through the
- * kernel (`admitEventSubscriptions`), or throw
- * {@link EventSubscriptionAdmissionError} listing every refusal. Returns the
- * admission: the first-party grants and the installed ceilings.
- */
-export function assertEventSubscriptionsAdmitted(schemas, lock) {
-  const admission = schemas.admitEventSubscriptions(lock);
-  if (admission.refusals.length > 0) {
-    throw new EventSubscriptionAdmissionError(lock.distributionId, admission.refusals);
-  }
-  return admission;
-}
-
-/** Thrown when several admission categories refuse the same lock; `.errors` holds each category's own error. */
-export class LockAdmissionRefusedError extends RefusalError {
-  /** @param {readonly Error[]} errors */
-  constructor(errors) {
-    super(`the distribution lock is refused by ${errors.length} admission checks:\n\n${joinRefusalMessages(errors)}`);
-    this.name = 'LockAdmissionRefusedError';
-    this.errors = errors;
-  }
-}
-
-/**
- * Run every admission a lock must pass, in the order the resolve has always run them, and refuse with all of them: one
- * refusal is rethrown unchanged, several are one {@link LockAdmissionRefusedError}. `report` receives the optional
- * operations left ungranted. Nothing here changes `lock`.
- */
-export function admitDistributionLock(schemas, lock, { report } = {}) {
-  // The two ceilings read the lock's own fields, not the outcome of the grants, so they are checked beside them.
-  const admissions = [
-    () => assertOperationGrantsAdmitted(schemas, lock, { report }),
-    () => assertOrganizationSweepsAdmitted(schemas, lock),
-    () => assertExactAudiencesAdmitted(schemas, lock),
-    () => assertOrgContextRelaysAdmitted(schemas, lock),
-    () => assertEventSubscriptionsAdmitted(schemas, lock),
-    () => assertInstalledOperationCeilingAdmitted(schemas, lock),
-    () => assertStoreWorkloadCeilingAdmitted(schemas, lock),
-  ];
-  collectRefusals(admissions, (admit) => admit(), isRefusal, LockAdmissionRefusedError);
-}
-
-/**
- * The {@link ungrantedOptionalOperationLines} a refused admission carries: the refusal of the operation grants itself, or the
- * one among several that is. Empty when the grants were not what refused.
- */
-export function ungrantedOptionalLinesOfRefusal(error) {
-  const grantRefusal = [error, ...(error.errors ?? [])].find((candidate) => candidate instanceof OperationGrantAdmissionError);
-  return grantRefusal === undefined ? [] : ungrantedOptionalOperationLines(grantRefusal.distributionId, grantRefusal.ungrantedOptional);
-}