@xemahq/xema 0.59.1 → 0.60.1

package/edition/lib.mjs

@@ -1,3303 +0,0 @@
-// Shared helpers for the Xema distribution packaging tooling.
-//
-// These are pure Node ESM utilities (mjs tooling — Date.now()/clocks are fine
-// here, unlike kernel contracts). They centralize the few things the three
-// distribution scripts share: locating the repo root, resolving the BUILT
-// kernel contract schemas, the closed BiomeTier order, and the on-disk biome
-// walk. Keeping them here avoids duplicating the manifest-reading + tier-order
-// logic across build/resolve/check. Trusted index generation reads immutable
-// Git objects rather than mutable working-tree files.
-
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { createRequire } from 'node:module';
-import { isIP } from 'node:net';
-
-import { parse as parseYaml } from 'yaml';
-
-import { ADAPTER_HOST_BIOME_ID, readHostPackageVersions } from './adapter-host-versions.mjs';
-import { readBiomeAuthorizationModuleAt } from './authorization-base.mjs';
-import {
-  isAuthoritativeProductionBiomeSource,
-} from './connector-source-authority.mjs';
-import {
-  compareDispatchedEdges,
-  dispatchedEdgeIdentity,
-  isSupplementalEdge,
-  projectDispatchedTarget,
-} from './dispatched-runtime-components.mjs';
-import { assertKernelEditionProtocol } from './edition-protocol.mjs';
-import {
-  kernelDistPath,
-  kernelPackageDir,
-  kernelRepoDir,
-  sourcePath,
-  storeSourceRepositoriesPath,
-} from './edition-workspace.mjs';
-import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
-import { readGitJsonAtCommit } from './git-json.mjs';
-import { imageSubjectIdentity } from './image-subject-identity.mjs';
-import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
-import {
-  PRINCIPAL_PRIVILEGE_FIELDS,
-  assertPrivilegesHavePrincipals,
-  componentAudienceRequirements,
-  componentInstalledOperationRequests,
-  componentEventSubscriptionRequirements,
-  componentRelaysOrgContext,
-  componentOperationRequirements,
-  componentOptionalOperationRequirements,
-  componentOwnedAudienceNamespaces,
-  componentOrganizationSweepRequirements,
-} from './operation-requirements.mjs';
-import {
-  createSourceAuthority,
-  DistributionSourceMode,
-  PUBLISHED_SOURCE_REF,
-  publishedSourceCommit,
-} from './source-authority.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
-import { compareStrings } from './string-order.mjs';
-
-export {
-  compareStrings,
-  createSourceAuthority,
-  DistributionSourceMode,
-  PUBLISHED_SOURCE_REF,
-  publishedSourceCommit,
-  readGitJsonAtCommit,
-};
-
-
-/**
- * Closed BiomeTier order (low→high), READ FROM THE KERNEL.
- *
- * The VOCABULARY and the ORDER are both `@xemahq/contracts/biome`'s:
- * `BIOME_TIER_ORDER` in `src/biome/lib/biome-tier-rank.ts`, itself derived
- * from `BIOME_TIER_RANK` — a map exhaustively keyed on the `BiomeTier` enum, so
- * a fifth tier is a compile error in the kernel rather than a value that reads
- * back `undefined` here and sorts silently to one end.
- *
- * The package NAME above is `@xemahq/contracts`, not the retired
- * `@xemahq/kernel-contracts`; the repository directory is still
- * `repos/xema-kernel-contracts`, which is why the dist path below keeps it.
- * Re-measured at that repository's `origin/main` (1e2f7d7, 2026-09-15):
- * `packages/kernel/kernel-contracts/package.json` declares `@xemahq/contracts`,
- * `BIOME_TIER_ORDER` is exported from `src/biome/lib/biome-tier-rank.ts`, and
- * `src/biome/index.ts` re-exports it.
- *
- * ── This replaced a literal, and the comment above it was FALSE ──
- *
- * That comment said "the kernel exports no order constant — there is no
- * `BIOME_TIER_ORDER` in `@xemahq/kernel-contracts` (verified 2026-08-31)", and
- * justified the private copy with "so the tooling does not depend on the kernel
- * package being workspace-linked at the repo root (it is not)". Both halves
- * failed, and each failed differently:
- *
- *   • The FIRST half was true when written and is not now. The kernel ships
- *     `BIOME_TIER_RANK`, `BIOME_TIER_ORDER`, `biomeTierRank` and
- *     `biomeTierWithin`, re-exported by the `biome` barrel — and that file's own
- *     header names `['infra', ...BIOME_TIER_ORDER, 'edge']` in
- *     `resolve-distribution.mjs` as the hand-rolled copy it exists to delete.
- *   • The SECOND half was never a reason. It is true that a BARE
- *     `@xemahq/kernel-contracts` specifier does not resolve here — this repo's
- *     `package.json` declares one devDependency and it is `esbuild` — but this
- *     module has never used one. It reaches the kernel by the deterministic dist
- *     PATH below (`loadKernelBiomeContracts`), and `readBiomeManifest`, the very
- *     function that validated a tier against the deleted literal, already called
- *     that loader four lines later for `isBiomeStoreListed`. The kernel was a
- *     hard precondition of this exact code path the whole time.
- *
- * A justification that names a real constraint which does not apply is the
- * worst shape of the three, because the constraint checks out: a reader
- * verifying "the bare specifier does not resolve" confirms the sentence and
- * stops. See `.claude/rules/writing-boundary-checks.md`, "A comment that
- * JUSTIFIES a limitation is the last place anyone re-derives it".
- *
- * ── Why a function and not a const ──
- *
- * `loadKernelBiomeContracts` throws when the kernel dist is unbuilt. Reading it
- * at module scope would make merely IMPORTING this module require a built
- * kernel, for every consumer including those that never rank a tier. Lazy and
- * memoized keeps the precondition where it already was.
- *
- * A remaining duplicate, deliberately not taken here: `PLATFORM_SERVICE_TIER_RANK`
- * (kernel `src/distribution`) is `['infra', ...biome ladder, 'edge']` already
- * derived, which is what `resolve-distribution.mjs` still builds by hand. That
- * subpath is loaded through a DIFFERENT, async loader
- * (`loadKernelDistributionSchemas`) and is a rank MAP rather than an array, so
- * adopting it is its own change with its own call-site shape.
- */
-export function biomeTierOrder() {
-  return loadKernelBiomeContracts().BIOME_TIER_ORDER;
-}
-
-/** Is `tier` a valid BiomeTier? (closed set — callers fail fast on false). */
-export function isBiomeTier(tier) {
-  return biomeTierOrder().includes(tier);
-}
-
-/**
- * Filename of the committed per-biome generated index, beside every
- * `xema-biome.json`. Value-identical to `BIOME_GENERATED_INDEX_FILENAME` in
- * `@xemahq/contracts/biome`; asserted against the BUILT kernel export by
- * `loadKernelBiomeContracts`, so the two cannot drift silently.
- */
-export const BIOME_GENERATED_INDEX_FILENAME = 'xema-biome.index.json';
-
-/**
- * Closed workload set for the v4 `xema.ships.apis[]` manifest shape this
- * tooling reads.
- *
- * NO kernel enum spells it: there is no `BiomeWorkloadKind` and no
- * `biome-workload-kind.ts` anywhere in `@xemahq/contracts` (verified
- * against that repo's `origin/main`, 2026-08-31), so this literal is the only
- * declaration of the set — it mirrors nothing. The v5 successor of the same
- * distinction is `BiomeComponentScheduler` (`platform | runtime`) in
- * `@xemahq/contracts/biome`
- * (`src/biome/lib/biome-component-vocabulary.ts`), whose own docblock names
- * `ships.apis[].workload: "runtime-component"` as the v4 spelling it carries
- * forward. When this tooling moves to `components[]`, map onto that rather
- * than re-deriving the distinction here. An entry of `xema.ships.apis[]` that
- * omits `workload` resolves to `DEFAULT_BIOME_WORKLOAD_KIND`.
- *
- *  - `service`           — a standing cluster workload the deploy plane rosters.
- *  - `runtime-component` — an image built/published/signed/mirrored like any
- *    other but NEVER independently scheduled; another workload owns its
- *    lifecycle. No chart, no release, no roster entry.
- */
-export const BIOME_WORKLOAD_KINDS = new Set(['service', 'runtime-component']);
-
-/** The kind applied when a `ships.apis[]` entry omits `workload`. */
-export const DEFAULT_BIOME_WORKLOAD_KIND = 'service';
-
-/**
- * The `@xemahq/distribution-source-hash` package (CJS dist), a caret (0.x minor-locked)
- * dependency of the CLI, loaded by name on first use.
- *
- * That package is the SINGLE owner of `xema-source-tree-sha256-v2` — the same
- * implementation every producing repository's CI uses to derive the
- * `<contentHash>` release tag. This tooling must never carry a second copy: a
- * divergence would put a lock and its images at coordinates that silently
- * disagree. The evidence verifier never hashes a source tree, so its bundle
- * does not reach this package; only the entries that resolve, build, index or
- * seal load it.
- */
-const requireFromLib = createRequire(import.meta.url);
-
-let loadedSourceHash;
-
-function distributionSourceHash() {
-  if (loadedSourceHash === undefined) {
-    const mod = requireFromLib('@xemahq/distribution-source-hash');
-    assertSourceHashMatchesKernel(mod);
-    loadedSourceHash = mod;
-  }
-  return loadedSourceHash;
-}
-
-/**
- * The one source-TREE hash algorithm identifier this tooling accepts — read
- * from the implementation that actually derives the hash, never a local
- * literal. `loadKernelDistributionSchemas` asserts it is value-identical to the
- * kernel's `ImageSourceHashAlgorithm.MetadataV2`.
- *
- * This hashes ONE directory. It is a COMPONENT of an image coordinate, never an
- * image coordinate on its own.
- */
-function metadataSourceHashAlgorithm(sourceHash) {
-  return requireAlgorithmMember(
-    sourceHash.SourceTreeHashAlgorithm,
-    'SourceTreeHashAlgorithm',
-    'MetadataV2',
-  );
-}
-
-/**
- * Read one member off a built enum, refusing `undefined`.
- *
- * A missing member on a JS enum object is an ordinary property read: it yields
- * `undefined` and nothing complains at the read site. That is not hypothetical
- * here — renaming `ImageInputV1` to `ImageInputV2` in the source-hash package
- * turned every reader of the old name into a silent `undefined`, which reaches
- * a lock's `sourceHashAlgorithm` and a producer statement before anything
- * notices. Failing AT THE READ names the stale artifact instead.
- */
-function requireAlgorithmMember(enumObject, enumName, member) {
-  const value = enumObject?.[member];
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(
-      `@xemahq/distribution-source-hash does not declare ` +
-        `${enumName}.${member}. The installed package is `+
-        `stale or the member was renamed; change the pinned @xemahq/distribution-source-hash version and, if the `+
-        `rename was deliberate, move every reader in the same change.`,
-    );
-  }
-  return value;
-}
-
-/**
- * The one IMAGE-BUILD-INPUT closure algorithm this tooling MINTS, and the only
- * value admissible as an `ImageLock.sourceHashAlgorithm`. A subject's
- * `contentHash` under this algorithm covers the whole declared build-input
- * closure of its image, not just its own subtree.
- *
- * Read from the implementation that derives the hash, never a local literal,
- * so "the algorithm this tooling accepts" and "the algorithm CI can compute"
- * cannot drift apart. That implementation's `ImageBuildInputHashAlgorithm`
- * declares `ImageInputV2` and `ImageInputV3`; this tooling mints only
- * `ImageInputV2`. `@xemahq/contracts` 0.70.0 declares `ImageInputV3` (kernel-
- * contracts 259c8f5e), but every producer's release lane (and the develop lane,
- * contract C1) computes V2 keys, so a V3 lock would name coordinates no producer
- * pushes. V3 adoption is increment 2 and moves the producers and this function
- * together.
- *
- * The kernel's `ImageSourceHashAlgorithm` retains `ImageInputV1` because signed
- * in-toto statements and already-published locks carry that string and are
- * immutable. This function is deliberately not a set: a lock the current
- * producer cannot reproduce is not deliverable, so a v1 lock must be
- * REGENERATED, never silently accepted.
- */
-export function imageInputSourceHashAlgorithm() {
-  return imageInputSourceHashAlgorithmOf(distributionSourceHash());
-}
-
-function imageInputSourceHashAlgorithmOf(sourceHash) {
-  return requireAlgorithmMember(
-    sourceHash.ImageBuildInputHashAlgorithm,
-    'ImageBuildInputHashAlgorithm',
-    'ImageInputV2',
-  );
-}
-
-/**
- * Hold the built source-hash package value-identical to the kernel's wire names.
- * Runs once per loaded package, so no hash is ever derived from a package that
- * names its algorithms differently from the kernel that parses the lock.
- */
-function assertSourceHashMatchesKernel(sourceHash) {
-  const { ImageSourceHashAlgorithm } = requireFromLib(kernelDistributionDist());
-  if (typeof ImageSourceHashAlgorithm !== 'object' || ImageSourceHashAlgorithm === null) {
-    throw new Error(
-      `Built kernel distribution module at ${kernelDistributionDist()} does not export ImageSourceHashAlgorithm — the dist is stale; rebuild kernel-contracts.`,
-    );
-  }
-  // The kernel owns the WIRE name of the source-hash algorithm; the
-  // source-hash package owns its IMPLEMENTATION and declares the identifier
-  // itself so it can ship dependency-free to every producing repo's CI. This
-  // is the one place both built artifacts are in hand, so it is where the two
-  // are held value-identical — a drift here would put a lock's `contentHash`
-  // and the tag CI pushes at coordinates that silently disagree.
-  //
-  // BOTH members are held identical. `MetadataV2` names the component tree
-  // digest; `ImageInputV2` names the full image build-input closure and is what
-  // a lock declares. A drift in either would put a lock's `contentHash` and the
-  // tag CI pushes at coordinates that silently disagree.
-  //
-  // The kernel enum is a SUPERSET: it keeps `ImageInputV1` so an already-signed
-  // statement stays readable, while the source-hash package declares only what
-  // it can still COMPUTE. So the assertion pairs each implemented member with
-  // the kernel member of the same name — it is not a set comparison, and adding
-  // a retired wire name to the kernel must not make this pass vacuously.
-  for (const [implemented, declared, label] of [
-    [
-      metadataSourceHashAlgorithm(sourceHash),
-      ImageSourceHashAlgorithm.MetadataV2,
-      'MetadataV2',
-    ],
-    [
-      imageInputSourceHashAlgorithmOf(sourceHash),
-      ImageSourceHashAlgorithm.ImageInputV2,
-      'ImageInputV2',
-    ],
-  ]) {
-    if (implemented !== declared) {
-      throw new Error(
-        `Source-hash algorithm drift (${label}): @xemahq/distribution-source-hash ` +
-          `implements "${String(implemented)}" but @xemahq/contracts declares ` +
-          `"${String(declared)}". Both must name the same algorithm; rebuild both ` +
-          `packages, and if they genuinely diverged, fix the producer side before ` +
-          `any lock is written.`,
-      );
-    }
-  }
-}
-
-/** Path to the BUILT kernel-contracts BIOME module (CJS dist). */
-const kernelBiomeDist = () => kernelDistPath('biome', 'index.js');
-
-let kernelBiomeContracts;
-
-/**
- * The kernel's biome contracts, loaded SYNCHRONOUSLY (`createRequire`, like the
- * source-hash module above) because the index builder is synchronous.
- *
- * It lives here rather than in each consumer because `isBiomeStoreListed` is a
- * predicate with derived refusals, and a second reading of it is not a style
- * problem — it is a wrong answer. `manifestToIndexEntry` used to resolve
- * `storeListed` as `xema.storeListed ?? true`, which skips BOTH refusals the
- * kernel applies: an `operator`-audience biome and a `kernel`-tier biome are
- * never listed, whatever the flag says. So the index advertised every kernel
- * biome as store-listed while the catalog projector — which calls the kernel
- * function — refused them, and the two disagreed about the same bytes. The
- * kernel's own docstring says it in as many words: resolve via
- * `isBiomeStoreListed`, never read the field raw.
- */
-export function loadKernelBiomeContracts() {
-  assertKernelEditionProtocol(kernelPackageDir());
-  if (kernelBiomeContracts) {return kernelBiomeContracts;}
-  let mod;
-  try {
-    mod = requireFromLib(kernelBiomeDist());
-  } catch (err) {
-    throw new Error(
-      `Cannot load built kernel biome contracts from ${kernelBiomeDist()}. ` +
-        `Build it first: run \`pnpm install --frozen-lockfile && pnpm run build\` ` +
-        `in the kernel checkout (${kernelRepoDir()}). That names no package deliberately — ` +
-        `a remedy naming one goes stale on a rename, silently, because ` +
-        `\`pnpm --filter\` exits 0 when nothing matches. ` +
-        `Underlying error: ${err.message}`,
-    );
-  }
-  if (
-    typeof mod.parseBiomeManifest !== 'function' ||
-    typeof mod.isBiomeStoreListed !== 'function' ||
-    typeof mod.BiomeTrustTier !== 'object' ||
-    typeof mod.BiomeOrigin !== 'object' ||
-    typeof mod.requiredBiomeDependencyIds !== 'function' ||
-    typeof mod.foldInstallationClass !== 'function' ||
-    typeof mod.BiomeComponentInstallationClass !== 'object' ||
-    // The GRAMMAR a service component's `protocol.databaseExtensions` entries
-    // are validated against. Read from the kernel, never restated here.
-    //
-    // A PREDICATE, not a set, and that is the whole point: a PostgreSQL
-    // extension name is an OPEN vocabulary owned by whoever runs the database,
-    // so the kernel declares `^[a-z_][a-z0-9_-]*$` (<=63) and ships
-    // `isPostgresExtensionName` rather than an enum. This guard asked for a
-    // closed `PostgresExtension` object the kernel has never exported, and its
-    // error told the reader to rebuild a dist that was already current --- a
-    // false remedy for a design disagreement. Whether a name may actually be
-    // INSTALLED is a deployment question (`infra.yaml#postgres.allowedExtensions`),
-    // deliberately not a contract one.
-    typeof mod.isPostgresExtensionName !== 'function' ||
-    typeof mod.BiomeBundleGeneratedIndexSchema?.parse !== 'function' ||
-    // The ONE shape a biome's `xema.bundleSource` is validated against before
-    // it is projected — onto a host module, or onto the biome itself. Read
-    // from the kernel so the index can never carry a source the lock schema
-    // (which reuses this exact schema) would then refuse.
-    typeof mod.BiomeBundleSourceSpecSchema?.safeParse !== 'function' ||
-    // A component's process facts (`@xemahq/contracts` >= 0.30.0): the
-    // scaling vocabulary and the intrinsic-facts block, projected into
-    // `serviceProcessFacts` by `componentProcessFacts`.
-    typeof mod.BiomeScalingMode !== 'object' ||
-    typeof mod.BiomeComponentProcessFactsSchema?.safeParse !== 'function' ||
-    // Worker protocol v2 (`@xemahq/contracts` >= 0.52.0): the ONE schema a
-    // worker's `protocol.taskQueues` / `protocol.nexus` are graded against
-    // before `componentNexusDeclarations` projects them into the index.
-    typeof mod.BiomeWorkerProtocolSchema?.safeParse !== 'function' ||
-    // The ONE schema a service's `protocol.workflowClientOf` entries are graded
-    // against (`@xemahq/contracts` >= 0.60.0), before `componentWorkflowClients`
-    // projects them into the index.
-    typeof mod.BiomeWorkflowClientOfSchema?.safeParse !== 'function' ||
-    // Asserted here, not read hopefully: `biomeTierOrder()` above returns this
-    // array straight to `.includes()` / `.indexOf()`, and an absent export
-    // would surface as a TypeError at some sort comparator rather than as the
-    // actionable "rebuild kernel-contracts" below.
-    !Array.isArray(mod.BIOME_TIER_ORDER) ||
-    mod.BIOME_TIER_ORDER.length === 0
-  ) {
-    throw new Error(
-      `Built kernel biome module at ${kernelBiomeDist()} does not export ` +
-        `parseBiomeManifest/isBiomeStoreListed/BiomeTrustTier/BiomeOrigin/` +
-        `requiredBiomeDependencyIds/foldInstallationClass/` +
-        `BiomeComponentInstallationClass/isPostgresExtensionName/` +
-        `BiomeBundleGeneratedIndexSchema/BiomeBundleSourceSpecSchema/BiomeScalingMode/` +
-        `BiomeComponentProcessFactsSchema/BiomeWorkerProtocolSchema/BiomeWorkflowClientOfSchema/BIOME_TIER_ORDER — ` +
-        `the dist is stale (isPostgresExtensionName needs @xemahq/contracts >= 0.12.0, ` +
-        `the process facts >= 0.30.0, worker protocol v2 >= 0.52.0, workflowClientOf >= 0.60.0); rebuild ` +
-        `kernel-contracts at a commit that carries it.`,
-    );
-  }
-  if (mod.BIOME_GENERATED_INDEX_FILENAME !== BIOME_GENERATED_INDEX_FILENAME) {
-    throw new Error(
-      `Kernel BIOME_GENERATED_INDEX_FILENAME is "${String(mod.BIOME_GENERATED_INDEX_FILENAME)}" ` +
-        `but this plane reads "${BIOME_GENERATED_INDEX_FILENAME}" — the literal drifted from the kernel.`,
-    );
-  }
-  kernelBiomeContracts = mod;
-  return kernelBiomeContracts;
-}
-
-/** Path to the BUILT kernel-contracts RESOURCE-REQUIREMENT module (CJS dist). */
-const kernelResourceRequirementDist = () => kernelDistPath('resource-requirement', 'index.js');
-
-let kernelResourceRequirementContracts;
-
-/**
- * The kernel's resource-requirement grammar, loaded SYNCHRONOUSLY like
- * {@link loadKernelBiomeContracts}. A component's `protocol.resources` and
- * `protocol.providesResources` are validated by the kernel's own schemas —
- * never a restated grammar — so the index can never carry a declaration the
- * lock schema would then refuse.
- */
-export function loadKernelResourceRequirementContracts() {
-  assertKernelEditionProtocol(kernelPackageDir());
-  if (kernelResourceRequirementContracts) {
-    return kernelResourceRequirementContracts;
-  }
-  let mod;
-  try {
-    mod = requireFromLib(kernelResourceRequirementDist());
-  } catch (err) {
-    throw new Error(
-      `Cannot load built kernel resource-requirement contracts from ` +
-        `${kernelResourceRequirementDist()}. Build kernel-contracts at a commit ` +
-        `that carries the resource-requirement subpath: run ` +
-        `\`pnpm install --frozen-lockfile && pnpm run build\` in ` +
-        `the kernel checkout (${kernelRepoDir()}). Underlying error: ${err.message}`,
-    );
-  }
-  if (
-    typeof mod.ResourceRequirementsSchema?.safeParse !== 'function' ||
-    typeof mod.ResourceProvisionsSchema?.safeParse !== 'function'
-  ) {
-    throw new Error(
-      `Built kernel resource-requirement module at ${kernelResourceRequirementDist()} ` +
-        `does not export ResourceRequirementsSchema/ResourceProvisionsSchema — ` +
-        `the dist is stale; rebuild kernel-contracts.`,
-    );
-  }
-  kernelResourceRequirementContracts = mod;
-  return kernelResourceRequirementContracts;
-}
-
-/**
- * Validate one component's `protocol.resources` / `protocol.providesResources`
- * with the KERNEL's schemas, naming the manifest and the component on failure.
- * Returns `[]` for an absent field — absent and `[]` make the same claim.
- */
-function parseComponentResourceDeclaration(schemaName, value, where) {
-  if (value === undefined) {return [];}
-  const schema = loadKernelResourceRequirementContracts()[schemaName];
-  const parsed = schema.safeParse(value);
-  if (!parsed.success) {
-    throw new Error(
-      `${where} is not a valid resource declaration: ` +
-        parsed.error.issues
-          .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
-          .join('; '),
-    );
-  }
-  return parsed.data;
-}
-
-/**
- * Project one image component's Nexus declarations (worker protocol v2) into
- * the two index rows the edition resolver binds from. The protocol is graded
- * by the KERNEL's `BiomeWorkerProtocolSchema` first, so every v2 rule (a
- * provided service names one of the worker's own `nexus` queues, nothing is
- * provided and required by one worker, no duplicates) holds before anything
- * is projected. Returns empty arrays for a component that declares no `nexus`
- * — absent and `[]` make the same claim — so a biome that declares none adds
- * no index key and `biome-index.json` stays byte-stable.
- *
- * Only a `worker` may declare one: the v2 shape is the worker protocol's, and
- * a `nexus` block on any other kind is refused rather than dropped, because a
- * dropped requirement reaches no lock and fails nothing.
- */
-/** The protocol kinds a `worker` component may declare (closed). */
-const WorkerProtocolKind = Object.freeze({ Worker: 'worker', None: 'none' });
-
-/**
- * The task queues a protocol `worker/v2` component polls, sorted by name (a bare
- * short name, or `{ name, placement }` when the queue is placed),
- * or null for anything else — a runtime-launched worker (protocol `none`) polls
- * nothing, and a service carries no worker protocol. Validated by the kernel's own worker-protocol
- * schema, naming the manifest. The deploy plane runs exactly these components
- * under a Worker Controller (durable-execution plan W3.4 / U14), so a v2 worker
- * is recognised by what it declares, never by a list of chart names.
- */
-function componentWorkerTaskQueues(component, protocol, where) {
-  if (component.kind !== 'worker') {return null;}
-  // A CLOSED enum: a worker protocol kind this resolver does not know would
-  // otherwise silently contribute no queues, and a missing queue reaches no lock.
-  if (!Object.values(WorkerProtocolKind).includes(protocol.kind)) {
-    throw new Error(
-      `${where} declares worker protocol kind ${JSON.stringify(protocol.kind)}; ` +
-        `expected ${Object.values(WorkerProtocolKind).join(' | ')}`,
-    );
-  }
-  if (protocol.kind === WorkerProtocolKind.None) {return null;}
-  const parsed = loadKernelBiomeContracts().BiomeWorkerProtocolSchema.safeParse(protocol);
-  if (!parsed.success) {
-    throw new Error(
-      `${where} is not a valid worker protocol: ` +
-        parsed.error.issues.map((issue) => `[${issue.path.join('.')}] ${issue.message}`).join('; '),
-    );
-  }
-  // A queue with a `placement` keeps it: the lock carries `{ name, placement }`
-  // for it and the bare short name for every other queue.
-  return parsed.data.taskQueues
-    .map((queue) => lockedTaskQueueRef(queue.name, queue.placement))
-    .sort(compareTaskQueueRefs);
-}
-
-/** The lock's `WorkerTaskQueueRef`: a bare short name, or `{ name, placement }` when the queue is placed. */
-function lockedTaskQueueRef(name, placement) {
-  return placement === undefined ? name : { name, placement };
-}
-
-function taskQueueRefName(ref) {
-  return typeof ref === 'string' ? ref : ref.name;
-}
-
-function compareTaskQueueRefs(a, b) {
-  return compareStrings(taskQueueRefName(a), taskQueueRefName(b));
-}
-
-/**
- * The `{ biome?, component, taskQueue }[]` a service's `protocol.workflowClientOf`
- * declares (`biome` only when the entry names another biome's worker, passed
- * through from the kernel schema's parse), sorted by biome (absent first), then
- * component, then queue name (`taskQueue` is a bare short
- * name, or `{ name, placement }` when the queue is placed), or `null` when it declares none (absent and `[]`
- * make the same claim). Each entry is graded by the kernel's own schema; that
- * the target is a shipped worker/v2 whose queue is polled is the lock's
- * refinement, not restated here.
- */
-function componentWorkflowClients(protocol, where) {
-  if (protocol.workflowClientOf === undefined) {return null;}
-  if (!Array.isArray(protocol.workflowClientOf)) {
-    throw new Error(`${where} protocol.workflowClientOf must be an array`);
-  }
-  if (protocol.workflowClientOf.length === 0) {return null;}
-  const schema = loadKernelBiomeContracts().BiomeWorkflowClientOfSchema;
-  return protocol.workflowClientOf.map((entry, index) => {
-    const parsed = schema.safeParse(entry);
-    if (!parsed.success) {
-      throw new Error(
-        `${where} has an invalid protocol.workflowClientOf[${index}]: ` +
-          parsed.error.issues.map((issue) => `[${issue.path.join('.')}] ${issue.message}`).join('; '),
-      );
-    }
-    return parsed.data;
-  }).sort(
-    (a, b) =>
-      compareStrings(a.biome ?? '', b.biome ?? '') ||
-      compareStrings(a.component, b.component) ||
-      compareTaskQueueRefs(a.taskQueue, b.taskQueue),
-  );
-}
-
-/**
- * `{ imageOf, entry }` for a worker declaring `artifact.kind:
- * shared-oci-image` — the sibling SERVICE whose sealed image it runs (by that
- * service's image name, `protocol.serviceName`) and the module `node` runs in
- * it — or `null` for any other component.
- *
- * The kernel manifest schema already refuses an inconsistent declaration; this
- * projection reads the RAW manifest, so it re-checks exactly the facts it
- * writes rather than trusting them: a lock naming a sibling that is not a
- * platform-scheduled oci-image service would send the deploy plane to a
- * subject that does not exist.
- */
-function sharedImageWorker(component, components, where) {
-  if (component.artifact?.kind !== 'shared-oci-image') {return null;}
-  const siblingKey = component.artifact.component;
-  const sibling = components.find(
-    (candidate) =>
-      candidate !== null && typeof candidate === 'object' && candidate.key === siblingKey,
-  );
-  const imageOf = sibling?.protocol?.serviceName;
-  if (
-    sibling === undefined ||
-    sibling.kind !== 'service' ||
-    sibling.artifact?.kind !== 'oci-image' ||
-    sibling.scheduler !== 'platform' ||
-    typeof imageOf !== 'string' ||
-    imageOf.length === 0
-  ) {
-    throw new Error(
-      `${where} runs the image of component "${String(siblingKey)}", which is not a ` +
-        `platform-scheduled service shipping its own oci-image in this biome`,
-    );
-  }
-  const entry = component.entrypoint?.module;
-  if (component.entrypoint?.kind !== 'node-module' || typeof entry !== 'string' || entry.length === 0) {
-    throw new Error(
-      `${where} declares a shared-oci-image artifact without a node-module entrypoint ` +
-        `naming the module to run`,
-    );
-  }
-  return { imageOf, entry };
-}
-
-function componentNexusDeclarations(component, name, protocol, where) {
-  if (protocol.nexus === undefined) {return { provides: [], requires: [] };}
-  if (component.kind !== 'worker') {
-    throw new Error(
-      `${where} declares protocol.nexus on a "${String(component.kind)}" component — ` +
-        `only a worker (protocol worker/v2) provides or requires a Nexus service`,
-    );
-  }
-  const parsed = loadKernelBiomeContracts().BiomeWorkerProtocolSchema.safeParse(protocol);
-  if (!parsed.success) {
-    throw new Error(
-      `${where} is not a valid worker protocol: ` +
-        parsed.error.issues
-          .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
-          .join('; '),
-    );
-  }
-  const nexus = parsed.data.nexus ?? {};
-  return {
-    // `operations` travels with each row: the kernel's `resolveNexusBindings`
-    // binds a requirement only to a provider declaring EVERY operation it
-    // requires, so the operation names are binding facts, not decoration.
-    // Sorted by code unit, so the index is byte-stable whatever order the
-    // manifest lists them in.
-    provides: (nexus.provides ?? []).map((entry) => ({
-      component: name,
-      service: entry.service,
-      version: entry.version,
-      taskQueue: entry.taskQueue,
-      operations: entry.operations.map((operation) => operation.name).sort(compareStrings),
-    })),
-    requires: (nexus.requires ?? []).map((entry) => ({
-      component: name,
-      service: entry.service,
-      version: entry.version,
-      operations: [...entry.operations].sort(compareStrings),
-      ...(entry.optional === true ? { optional: true } : {}),
-    })),
-  };
-}
-
-const compareNexusRows = (a, b) =>
-  compareStrings(a.service, b.service) ||
-  compareStrings(a.version, b.version) ||
-  compareStrings(a.component, b.component);
-
-const compareResourceRows = (a, b) =>
-  compareStrings(a.consumerService, b.consumerService) ||
-  compareStrings(a.kind, b.kind) ||
-  compareStrings(a.logicalName, b.logicalName);
-
-
-
-const kernelDistributionDist = () => kernelDistPath('distribution', 'index.js');
-
-// The kernel's process-topology module: the ONE trust-domain grammar
-// (`deriveTrustCeiling`) a lock writer projects an edition's `trustCeiling`
-// through. A sibling of the distribution dist, loaded beside it.
-const kernelProcessTopologyDist = () => kernelDistPath('process-topology', 'index.js');
-
-/** A composed-process subject, on a kernel that cannot write image-lock schemaVersion 4. */
-export class ComposedProcessNeedsLockV4Error extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'ComposedProcessNeedsLockV4Error';
-  }
-}
-
-/** The image-lock revision of a kernel that predates `IMAGE_LOCK_WRITE_SCHEMA_VERSION` (edition protocol < v14). */
-const PRE_V14_IMAGE_LOCK_SCHEMA_VERSION = 3;
-
-/**
- * Refuse a composed-process subject when the loaded kernel predates image-lock
- * schemaVersion 4 (it exports no `IMAGE_LOCK_WRITE_SCHEMA_VERSION`): such a
- * kernel has no `members[]`, so it cannot say which services the composed
- * image carries. There is no fallback.
- */
-export function assertKernelSealsComposedMembership(schemas, subjects, label) {
-  if (Number.isInteger(schemas.IMAGE_LOCK_WRITE_SCHEMA_VERSION)) {return;}
-  const composed = (subjects ?? []).find((subject) => subject.kind === 'composed-process');
-  if (composed === undefined) {return;}
-  throw new ComposedProcessNeedsLockV4Error(
-    `${label}: composed-process subject "${composed.id}" — a composed-process subject needs a kernel that ` +
-      'writes image-lock schemaVersion 4 (edition protocol >= v14); the loaded kernel ' +
-      `(${kernelRepoDir()}) exports no IMAGE_LOCK_WRITE_SCHEMA_VERSION`,
-  );
-}
-
-/**
- * The image-lock schemaVersion a writer emits for `subjects`: the loaded
- * kernel's `IMAGE_LOCK_WRITE_SCHEMA_VERSION`. A kernel before edition protocol
- * v14 exports none and writes only schemaVersion 3, which is allowed only when
- * there is NO composed-process subject
- * ({@link ComposedProcessNeedsLockV4Error} otherwise).
- */
-export function imageLockWriteSchemaVersion(schemas, subjects, label = 'images.lock.json') {
-  assertKernelSealsComposedMembership(schemas, subjects, label);
-  const version = schemas.IMAGE_LOCK_WRITE_SCHEMA_VERSION;
-  return Number.isInteger(version) ? version : PRE_V14_IMAGE_LOCK_SCHEMA_VERSION;
-}
-
-/**
- * Dynamically import the BUILT kernel distribution schemas. The kernel package
- * is NOT linked into the repo-root node_modules (it lives in its own sub-
- * workspace), so a bare `@xemahq/contracts/distribution` specifier does
- * not resolve from root tooling. We import the deterministic dist path instead
- * — fail-fast with an actionable message if the dist is not built.
- */
-export async function loadKernelDistributionSchemas() {
-  assertKernelEditionProtocol(kernelPackageDir());
-  let mod;
-  try {
-    mod = await import(`file://${kernelDistributionDist()}`);
-  } catch (err) {
-    throw new Error(
-      `Cannot load built kernel distribution schemas from ${kernelDistributionDist()}. ` +
-        `Build it first: run \`pnpm install --frozen-lockfile && pnpm run build\` ` +
-          `in the kernel checkout (${kernelRepoDir()}) — naming no package, deliberately. ` +
-        `Underlying error: ${err.message}`,
-    );
-  }
-  // The Node-only half of the distribution contracts (`distribution/server`): the lock digest and the
-  // predicate checks that recompute it.
-  let server;
-  try {
-    server = await import(`file://${kernelDistPath('distribution', 'server', 'index.js')}`);
-  } catch (err) {
-    throw new Error(
-      `Cannot load the built kernel distribution/server module from ${kernelDistPath('distribution', 'server', 'index.js')}. ` +
-        `Rebuild the kernel checkout (${kernelRepoDir()}). Underlying error: ${err.message}`,
-    );
-  }
-  const { distributionLockDigest, distributionImagesPredicateLockRefusal, imageDeliveryEntitlementRefusal } = server;
-  const {
-    parseDistribution,
-    parseDistributionLock,
-    parseDistributionLockForReading,
-    parseUnsealedDistributionLock,
-    parseCustomerEditionDefinition,
-    customerTrustCeilingIssues,
-    customerLockCeilingIssues,
-    biomeOriginsOfLock,
-    sealDistributionLock,
-    unsealedProjection,
-    UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
-    DISTRIBUTION_LOCK_SCHEMA_VERSION,
-    computeBiomeContentHash,
-    computeBiomeSourceManifestHash,
-    parseBiomeSourceManifestHash,
-    parseOciDigest,
-    parseGitTreeId,
-    parseImageLock,
-    dedicatedServiceImageSubjects,
-    carryForwardComposedArtifacts,
-    DEFAULT_COMPOSED_IMAGE_CLASS,
-    ComposedImageClassSchema,
-    IMAGE_LOCK_WRITE_SCHEMA_VERSION,
-    ImageLockSchemaVersion,
-    parseImageProducerStatement,
-    parseDistributionImagesStatement,
-    parseImageDeliveryEntitlementStatement,
-    parseEditionCatalogueStatement,
-    editionCatalogueRefusal,
-    parseDistributionImageEvidenceSet,
-    parseDistributionImageReplayState,
-    parseSigstoreOfflineTrustPolicy,
-    SigstoreEvidenceDescriptorSchema,
-    parsePlatformServiceSourceIndex,
-    parseRuntimeImageSourceIndex,
-    producerWorkflowPinRefusal,
-    resolveRuntimeImagePlatforms,
-    BiomeInstallPolicy,
-    BiomeLaunchMode,
-    ImageSourceHashAlgorithm,
-    RuntimeImagePlatformKey,
-    RuntimeImageOwnerKind,
-    RuntimeImageSubjectKind,
-    IMAGE_PRODUCER_PREDICATE_TYPE,
-    DISTRIBUTION_IMAGES_PREDICATE_TYPE,
-    IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE,
-    EDITION_CATALOGUE_PREDICATE_TYPE,
-    EVIDENCE_CHANNELS,
-    EVIDENCE_CHANNEL_REFS,
-    resolveFirstPartyCapabilityDomains,
-    DistributionVisibility,
-    computeKernelContractAuthorityContentDigest,
-    KernelContractContentHashAlgorithm,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR,
-    XEMA_KERNEL_CONTRACT_REPOSITORY_URL,
-    XEMA_KERNEL_CONTRACT_SOURCE_MODE,
-    XEMA_KERNEL_CONTRACT_SOURCE_PATHS,
-    compareLockedServiceResources,
-    resolveNexusBindings,
-    describeNexusBindingRefusal,
-    canonicalNexusFacts,
-    DistributionResolutionMode,
-    resolveBiomeClosure,
-    platformInvariantRoots,
-    BiomeClosureError,
-    ClosureEntityKind,
-    ClosureProvenanceKind,
-    describeProvenance,
-    describeHop,
-    deriveWorkflowSubjects,
-    distributionImagesPredicateChannelRefusal,
-    admitOperationGrants,
-    admitOrganizationSweeps,
-    admitExactAudiences,
-    contractRequiredServiceTargets,
-    admitInstalledOperationCeiling,
-    admitStoreWorkloadCeiling,
-    admitOrgContextRelays,
-    admitEventSubscriptions,
-  } = mod;
-  let topology;
-  try {
-    topology = await import(`file://${kernelProcessTopologyDist()}`);
-  } catch (err) {
-    throw new Error(
-      `Cannot load the built kernel process-topology module from ${kernelProcessTopologyDist()}. ` +
-        `Rebuild the kernel checkout (${kernelRepoDir()}). Underlying error: ${err.message}`,
-    );
-  }
-  const { deriveTrustCeiling, defaultTrustDomain, FIRST_PARTY_TRUST_DOMAIN, ProcessTrustPolicySchema } = topology;
-  const { DistributionTrustPolicySchema, LockedStorePublisherSchema } = mod;
-  if (
-    typeof parseDistribution !== 'function' ||
-    typeof parseDistributionLock !== 'function' ||
-    // The tolerant READER (`@xemahq/contracts` >= 0.27.0). Every PURE read of a
-    // lock in this repository goes through it; only the resolver, which WRITES
-    // the lock, uses the strict `parseDistributionLock`.
-    typeof parseDistributionLockForReading !== 'function' ||
-    // Lock v5 is the only grammar. The resolver writes the UNSEALED document,
-    // the seal mints each biomeContentHash (`computeBiomeContentHash`) and the
-    // kernel's `sealDistributionLock` attaches them; the CLI never assembles v5.
-    DISTRIBUTION_LOCK_SCHEMA_VERSION !== 5 ||
-    typeof parseUnsealedDistributionLock !== 'function' ||
-    typeof sealDistributionLock !== 'function' ||
-    typeof unsealedProjection !== 'function' ||
-    typeof UNSEALED_DISTRIBUTION_LOCK_SCHEMA !== 'string' ||
-    typeof computeBiomeContentHash !== 'function' ||
-    typeof computeBiomeSourceManifestHash !== 'function' ||
-    typeof parseBiomeSourceManifestHash !== 'function' ||
-    typeof parseOciDigest !== 'function' ||
-    typeof parseGitTreeId !== 'function' ||
-    typeof parseImageLock !== 'function' ||
-    typeof dedicatedServiceImageSubjects !== 'function' ||
-    typeof carryForwardComposedArtifacts !== 'function' ||
-    typeof DEFAULT_COMPOSED_IMAGE_CLASS !== 'string' ||
-    typeof ComposedImageClassSchema?.safeParse !== 'function' ||
-    typeof parseImageProducerStatement !== 'function' ||
-    typeof parseDistributionImagesStatement !== 'function' ||
-    typeof parseImageDeliveryEntitlementStatement !== 'function' ||
-    typeof parseDistributionImageEvidenceSet !== 'function' ||
-    typeof parseDistributionImageReplayState !== 'function' ||
-    typeof parseSigstoreOfflineTrustPolicy !== 'function' ||
-    typeof SigstoreEvidenceDescriptorSchema?.parse !== 'function' ||
-    typeof parsePlatformServiceSourceIndex !== 'function' ||
-    typeof parseRuntimeImageSourceIndex !== 'function' ||
-    typeof producerWorkflowPinRefusal !== 'function' ||
-    typeof resolveRuntimeImagePlatforms !== 'function' ||
-    typeof resolveFirstPartyCapabilityDomains !== 'function' ||
-    typeof DistributionVisibility !== 'object' ||
-    typeof BiomeInstallPolicy !== 'object' ||
-    typeof BiomeLaunchMode !== 'object' ||
-    typeof ImageSourceHashAlgorithm !== 'object' ||
-    typeof RuntimeImagePlatformKey !== 'object' ||
-    typeof RuntimeImageOwnerKind !== 'object' ||
-    typeof RuntimeImageSubjectKind !== 'object' ||
-    typeof IMAGE_PRODUCER_PREDICATE_TYPE !== 'string' ||
-    typeof DISTRIBUTION_IMAGES_PREDICATE_TYPE !== 'string' ||
-    typeof IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE !== 'string' ||
-    !Array.isArray(EVIDENCE_CHANNELS) ||
-    typeof EVIDENCE_CHANNEL_REFS !== 'object' ||
-    typeof computeKernelContractAuthorityContentDigest !== 'function' ||
-    typeof KernelContractContentHashAlgorithm !== 'object' ||
-    typeof XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN !== 'string' ||
-    XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION !== 1 ||
-    typeof XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR !== 'string' ||
-    typeof XEMA_KERNEL_CONTRACT_REPOSITORY_URL !== 'string' ||
-    typeof XEMA_KERNEL_CONTRACT_SOURCE_MODE !== 'string' ||
-    !Array.isArray(XEMA_KERNEL_CONTRACT_SOURCE_PATHS) ||
-    !Object.isFrozen(XEMA_KERNEL_CONTRACT_SOURCE_PATHS) ||
-    // The ONE order a lock's `serviceResources` rows are emitted in — the
-    // comparator the kernel lock schema asserts, never a second spelling.
-    typeof compareLockedServiceResources !== 'function' ||
-    // THE Nexus binding rule — service, major version and every required
-    // operation — shared with the runtime resolver (>= 0.53.0).
-    typeof resolveNexusBindings !== 'function' ||
-    typeof describeNexusBindingRefusal !== 'function' ||
-    // The canonical per-biome Nexus facts a lock carries (>= 0.54.0).
-    typeof canonicalNexusFacts !== 'function' ||
-    // Positive closure (`@xemahq/contracts` >= the release that added the
-    // `resolution`/`roots` edition fields): the ONE closure algorithm, shared
-    // with runtime installation, and the vocabulary its provenance is written in.
-    typeof DistributionResolutionMode !== 'object' ||
-    typeof resolveBiomeClosure !== 'function' ||
-    typeof platformInvariantRoots !== 'function' ||
-    typeof BiomeClosureError !== 'function' ||
-    typeof ClosureEntityKind !== 'object' ||
-    typeof ClosureProvenanceKind !== 'object' ||
-    typeof describeProvenance !== 'function' ||
-    typeof describeHop !== 'function' ||
-    // A biome's workflow subjects and its edition trust ceiling, each written
-    // through the kernel's one derivation (`@xemahq/contracts` >= 0.71.0).
-    typeof deriveWorkflowSubjects !== 'function' ||
-    // Predicate v2 checks (`@xemahq/contracts` >= 0.78.0): the channel the verifying policy row states and
-    // the lock digest the predicates bind.
-    typeof distributionImagesPredicateChannelRefusal !== 'function' ||
-    // The ONE admission of service-to-service operation grants; the seal and
-    // the resolve refuse through it (`assertOperationGrantsAdmitted`).
-    typeof admitOperationGrants !== 'function' ||
-    typeof admitOrganizationSweeps !== 'function' ||
-    typeof admitExactAudiences !== 'function' ||
-    typeof contractRequiredServiceTargets !== 'function' ||
-    // The installed-operation ceiling and the edition's store-workload ceiling,
-    // both admitted at the lock (`assertInstalledOperationCeilingAdmitted`,
-    // `assertStoreWorkloadCeilingAdmitted`).
-    typeof admitInstalledOperationCeiling !== 'function' ||
-    typeof admitStoreWorkloadCeiling !== 'function' ||
-    typeof admitOrgContextRelays !== 'function' ||
-    typeof admitEventSubscriptions !== 'function' ||
-    typeof distributionImagesPredicateLockRefusal !== 'function' ||
-    typeof distributionLockDigest !== 'function' ||
-    typeof imageDeliveryEntitlementRefusal !== 'function' ||
-    typeof deriveTrustCeiling !== 'function' ||
-    // The trust-domain vocabulary a customer edition is bounded by: the vendor's
-    // own domain, a biome's default domain, and the two ceiling grammars a
-    // catalogue carries.
-    typeof defaultTrustDomain !== 'function' ||
-    typeof FIRST_PARTY_TRUST_DOMAIN !== 'string' ||
-    typeof ProcessTrustPolicySchema?.safeParse !== 'function' ||
-    typeof DistributionTrustPolicySchema?.safeParse !== 'function' ||
-    // One Store publisher entry of a lock: the grammar a catalogue's `ceiling.storePublisherTrust` is read by.
-    typeof LockedStorePublisherSchema?.array !== 'function'
-  ) {
-    throw new Error(
-      `Built kernel distribution module at ${kernelDistributionDist()} does not export ` +
-        `parseDistribution/parseDistributionLock/parseDistributionLockForReading/DISTRIBUTION_LOCK_SCHEMA_VERSION/parseUnsealedDistributionLock/sealDistributionLock/unsealedProjection/computeBiomeContentHash/computeBiomeSourceManifestHash/parseImageLock/image-evidence parsers/` +
-        `parsePlatformServiceSourceIndex/parseRuntimeImageSourceIndex/` +
-        `resolveRuntimeImagePlatforms/RuntimeImagePlatformKey/` +
-        `kernel contract-authority digest SSOT/compareLockedServiceResources/resolveNexusBindings/describeNexusBindingRefusal/canonicalNexusFacts/` +
-        `positive closure (resolveBiomeClosure/platformInvariantRoots/DistributionResolutionMode/provenance)/` +
-        `deriveWorkflowSubjects/deriveTrustCeiling (>= 0.71.0)/admitOperationGrants/admitOrganizationSweeps/admitExactAudiences/admitInstalledOperationCeiling/admitStoreWorkloadCeiling/admitOrgContextRelays/admitEventSubscriptions/` +
-        `defaultTrustDomain/FIRST_PARTY_TRUST_DOMAIN/ProcessTrustPolicySchema/DistributionTrustPolicySchema/LockedStorePublisherSchema/` +
-        `resolveFirstPartyCapabilityDomains/DistributionVisibility/` +
-        `BiomeInstallPolicy/BiomeLaunchMode/ImageSourceHashAlgorithm/runtime-image enums — ` +
-        `the dist is stale; rebuild kernel-contracts.`,
-    );
-  }
-  // The build-record exports (absent from a kernel before the build-record contract): carried as-is, NOT required
-  // here, so every other verb still loads an older kernel. `select-records` refuses a kernel that lacks them.
-  const { BUILD_RECORD_MEDIA_TYPE, BuildRecordSchema, buildRecordTag, parseBuildRecordTag, compareBuildRecordRuns, parseBuildRecord } = mod;
-  // The image-build-record exports (edition protocol v41): the same, carried as-is; `develop image-record` and `--images-from` refuse an older kernel.
-  const { IMAGE_BUILD_RECORD_SCHEMA_VERSION, ImageBuildRecordSchema, parseImageBuildRecord } = mod;
-  return {
-    BUILD_RECORD_MEDIA_TYPE,
-    BuildRecordSchema,
-    buildRecordTag,
-    parseBuildRecordTag,
-    compareBuildRecordRuns,
-    parseBuildRecord,
-    IMAGE_BUILD_RECORD_SCHEMA_VERSION,
-    ImageBuildRecordSchema,
-    parseImageBuildRecord,
-    parseDistribution,
-    parseDistributionLock,
-    parseDistributionLockForReading,
-    parseUnsealedDistributionLock,
-    parseCustomerEditionDefinition,
-    customerTrustCeilingIssues,
-    customerLockCeilingIssues,
-    biomeOriginsOfLock,
-    sealDistributionLock,
-    unsealedProjection,
-    UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
-    DISTRIBUTION_LOCK_SCHEMA_VERSION,
-    computeBiomeContentHash,
-    computeBiomeSourceManifestHash,
-    parseBiomeSourceManifestHash,
-    parseOciDigest,
-    parseGitTreeId,
-    parseImageLock,
-    dedicatedServiceImageSubjects,
-    carryForwardComposedArtifacts,
-    DEFAULT_COMPOSED_IMAGE_CLASS,
-    ComposedImageClassSchema,
-    IMAGE_LOCK_WRITE_SCHEMA_VERSION,
-    ImageLockSchemaVersion,
-    parseImageProducerStatement,
-    parseDistributionImagesStatement,
-    parseImageDeliveryEntitlementStatement,
-    parseEditionCatalogueStatement,
-    editionCatalogueRefusal,
-    parseDistributionImageEvidenceSet,
-    parseDistributionImageReplayState,
-    parseSigstoreOfflineTrustPolicy,
-    SigstoreEvidenceDescriptorSchema,
-    parsePlatformServiceSourceIndex,
-    parseRuntimeImageSourceIndex,
-    resolveRuntimeImagePlatforms,
-    BiomeInstallPolicy,
-    BiomeLaunchMode,
-    ImageSourceHashAlgorithm,
-    RuntimeImagePlatformKey,
-    RuntimeImageOwnerKind,
-    RuntimeImageSubjectKind,
-    IMAGE_PRODUCER_PREDICATE_TYPE,
-    DISTRIBUTION_IMAGES_PREDICATE_TYPE,
-    IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE,
-    // Optional: a kernel without the E4 predicate is a catalogue consumer that cannot be armed (trust-policy-arming.mjs).
-    EDITION_CATALOGUE_PREDICATE_TYPE,
-    EVIDENCE_CHANNELS,
-    EVIDENCE_CHANNEL_REFS,
-    resolveFirstPartyCapabilityDomains,
-    DistributionVisibility,
-    computeKernelContractAuthorityContentDigest,
-    KernelContractContentHashAlgorithm,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION,
-    XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR,
-    XEMA_KERNEL_CONTRACT_REPOSITORY_URL,
-    XEMA_KERNEL_CONTRACT_SOURCE_MODE,
-    XEMA_KERNEL_CONTRACT_SOURCE_PATHS,
-    compareLockedServiceResources,
-    resolveNexusBindings,
-    describeNexusBindingRefusal,
-    canonicalNexusFacts,
-    DistributionResolutionMode,
-    resolveBiomeClosure,
-    platformInvariantRoots,
-    BiomeClosureError,
-    ClosureEntityKind,
-    ClosureProvenanceKind,
-    describeProvenance,
-    describeHop,
-    deriveWorkflowSubjects,
-    deriveTrustCeiling,
-    defaultTrustDomain,
-    FIRST_PARTY_TRUST_DOMAIN,
-    ProcessTrustPolicySchema,
-    DistributionTrustPolicySchema,
-    LockedStorePublisherSchema,
-    distributionLockDigest,
-    distributionImagesPredicateChannelRefusal,
-    admitOperationGrants,
-    admitOrganizationSweeps,
-    admitExactAudiences,
-    contractRequiredServiceTargets,
-    admitInstalledOperationCeiling,
-    admitStoreWorkloadCeiling,
-    admitOrgContextRelays,
-    admitEventSubscriptions,
-    distributionImagesPredicateLockRefusal,
-    imageDeliveryEntitlementRefusal,
-    producerWorkflowPinRefusal,
-  };
-}
-
-/**
- * The published branch every image/platform source repository is pinned at.
- *
- * Deliberately NOT the local `HEAD`. A pin is a coordinate a CONSUMER has to be
- * able to fetch: pinning a local HEAD records commits that exist only on this
- * machine — an unpushed commit, or a branch someone is mid-way through — and a
- * lock built on one is unresolvable anywhere else. It also made every generator
- * hostage to the aggregator's checkout state, which is never quiescent.
- *
- * Every digest in release mode reads immutable Git objects at this exact
- * commit, so the working tree is not an accidental input. Local development
- * can opt into `workspace` authority explicitly; that mode also produces exact
- * Git objects, but its synthetic commits are local-only and never selected by
- * default.
- */
-// Aligns with the CLI's manifest discovery rules:
-// `fixtures`/`templates` hold test-fixture and scaffold `xema-biome.json` files
-// that are NOT distributable biomes and must never enter the packaging index
-// (e.g. create-biome templates, any package's `test/fixtures/*-biome`).
-const SKIP_DIR_NAMES = new Set([
-  'node_modules',
-  '.git',
-  'dist',
-  'fixtures',
-  'templates',
-]);
-
-/**
- * Whether a discovered manifest path is an OpenAPI/test fixture rather than a
- * real biome. Fixtures live under `scripts/openapi-fixture/` and re-use real
- * biome ids (e.g. `runtime`), which would otherwise collide in the index.
- */
-function isFixtureManifest(repoRelativePath) {
-  return repoRelativePath.split('/').includes('openapi-fixture');
-}
-
-export function distributionBiomeSourceRepositories() {
-  const publishersPath = storeSourceRepositoriesPath();
-  const publishers = readStrictJsonFile(publishersPath);
-  if (publishers.schemaVersion !== 1) {
-    throw new Error(`${publishersPath} must declare schemaVersion 1`);
-  }
-  const unknownKeys = Object.keys(publishers).filter(
-    (key) => key !== 'schemaVersion' && key !== 'publishers',
-  );
-  if (unknownKeys.length > 0) {
-    throw new Error(
-      `${publishersPath}: unknown top-level key ${unknownKeys.map((key) => JSON.stringify(key)).join(', ')}`,
-    );
-  }
-  if (
-    !Array.isArray(publishers.publishers) ||
-    publishers.publishers.length === 0
-  ) {
-    throw new Error(`${publishersPath} declares no Store publishers`);
-  }
-  const repositoryNames = publishers.publishers.flatMap((publisher) => {
-    if (!Array.isArray(publisher.sourceRepositories)) {
-      throw new Error(
-        `${publishersPath} publisher ${String(publisher.anchorKey)} has no sourceRepositories`,
-      );
-    }
-    return publisher.sourceRepositories;
-  });
-  if (new Set(repositoryNames).size !== repositoryNames.length) {
-    throw new Error(
-      `${publishersPath} declares a source repository under more than one publisher`,
-    );
-  }
-  return repositoryNames
-    .map((repo) => ({ repo, directory: sourcePath(repo) }))
-    .sort((a, b) => compareStrings(a.repo, b.repo));
-}
-
-/**
- * Ceiling for one `git ls-tree -r` listing of a whole repository.
- *
- * Node's default is 1 MiB and this call outgrew it in production: `xema-base`
- * measured 1,056,095 bytes across 12,214 paths on 2026-08-20 — 7 KiB past the
- * default — so the biome-index step began failing with a bare
- * `spawnSync git ENOBUFS`, which names neither the repository nor the reason.
- * The listing grows with every file added to any carved repo, so the ceiling
- * has to sit far above today's number rather than just above it.
- *
- * A ceiling is safe to raise here because `execFileSync` THROWS on overflow
- * rather than truncating: exceeding it is a loud failure, never a short read
- * that would silently drop biomes from the index.
- */
-const GIT_LS_TREE_MAX_BUFFER = 256 * 1024 * 1024;
-
-/**
- * Every authoritative biome manifest in one repository AT ONE COMMIT, paired
- * with the `xema-biome.index.json` committed beside it.
- *
- * Extracted so the IMAGE-axis pass and the SOURCE-axis pass read manifests the
- * SAME way. Two copies of this walk would be two places for the skip rules, the
- * authoritative-source filter and the missing-index error to drift apart — and
- * the whole point of the split is that the two axes differ ONLY in which commit
- * they read.
- *
- * The manifest and its generated index are read from the SAME commit, which is
- * load-bearing and predates this split: the index is the authority for which
- * biomes this one requires, so reading them apart would let it describe a
- * different revision of the biome than the one being locked.
- */
-function listBiomeManifestsAt(directory, repo, commit) {
-  const found = [];
-  const rawPaths = execFileSync(
-    'git',
-    ['-C', directory, 'ls-tree', '-r', '-z', '--name-only', commit],
-    { encoding: 'buffer', maxBuffer: GIT_LS_TREE_MAX_BUFFER },
-  );
-  for (const repoPath of decodeNullDelimitedGitRecords(
-    rawPaths,
-    `Git manifest paths in ${repo}@${commit}`,
-  )) {
-    if (
-      !repoPath.endsWith('/xema-biome.json') ||
-      repoPath.split('/').some((segment) => SKIP_DIR_NAMES.has(segment)) ||
-      isFixtureManifest(repoPath)
-    ) {
-      continue;
-    }
-    const manifestDirectory = repoPath.slice(0, -'/xema-biome.json'.length);
-    const rel = `${repo}/${repoPath}`;
-    const raw = readGitJsonAtCommit(directory, repoPath, commit);
-    const path = `${repo}/${manifestDirectory}`;
-    if (
-      !isAuthoritativeProductionBiomeSource({
-        id: raw?.xema?.id,
-        repo,
-        path,
-      })
-    ) {
-      continue;
-    }
-    // The generated index is COMMITTED beside the manifest and is the single
-    // authority for which biomes this one requires. It is read from the SAME
-    // pinned commit as the manifest, so the index cannot describe a different
-    // revision of the biome than the one being locked.
-    const indexRepoPath = `${manifestDirectory}/${BIOME_GENERATED_INDEX_FILENAME}`;
-    let generatedIndex;
-    try {
-      generatedIndex = readGitJsonAtCommit(directory, indexRepoPath, commit);
-    } catch (error) {
-      throw new Error(
-        `${repo}/${indexRepoPath} is missing at ${commit}: ${error.message}. ` +
-          `Every biome carries a committed ${BIOME_GENERATED_INDEX_FILENAME} — it replaced the ` +
-          `manifest field xema.requiresServerBiomes as the authority for required biomes. ` +
-          `Run \`pnpm derive:biome-index:write\` in the aggregator and commit the result.`,
-      );
-    }
-    // The biome's authorization module, read at the SAME pinned commit as the
-    // manifest, so the sealer composes exactly the bytes the bundle signs.
-    const authorizationModule = readBiomeAuthorizationModuleAt(
-      manifestDirectory,
-      (repoRelativePath) => readGitTextAtCommitOrNull(directory, repoRelativePath, commit),
-      rel,
-    );
-    found.push({
-      raw,
-      generatedIndex,
-      rel,
-      repo,
-      path,
-      // The manifest's directory in its repository, and a reader of any file of
-      // that repository at the SAME pinned commit (the host's pnpm-lock.yaml).
-      manifestDirectory,
-      readRepositoryText: (repoRelativePath) => readGitTextAtCommitOrNull(directory, repoRelativePath, commit),
-      ...(authorizationModule === null ? {} : { authorizationModule }),
-    });
-  }
-
-  return found;
-}
-
-/** A file's text at a commit, or `null` when the commit does not carry it. */
-export function readGitTextAtCommitOrNull(repoDir, repoRelativePath, commit) {
-  try {
-    execFileSync('git', ['-C', repoDir, 'cat-file', '-e', `${commit}:${repoRelativePath}`], {
-      stdio: 'ignore',
-    });
-  } catch {
-    return null;
-  }
-  return execFileSync('git', ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`], {
-    encoding: 'utf8',
-    maxBuffer: GIT_LS_TREE_MAX_BUFFER,
-  });
-}
-
-/**
- * Does this biome ship a runtime image subject?
- *
- * THE axis discriminator, declared once. A biome that ships a service or a
- * runtime component earns image evidence, so every fact about it is pinned on
- * the IMAGE axis and verified there (`assembleProducerInput` recomputes its
- * `sourceManifestHash` at the image commit). A biome that ships neither can
- * never earn image evidence, so pinning it on the image axis makes it
- * permanently undeliverable — its content belongs on the SOURCE axis.
- *
- * Takes the `{ services, runtimeComponents }` shape that BOTH an index entry
- * (`manifestToIndexEntry`) and a LOCKED biome carry, so the two consumers that
- * must agree about this cannot drift: a second copy of the predicate is a
- * second answer to the question the whole two-axis split turns on.
- */
-export function biomeShipsRuntimeImage(entry) {
-  return (
-    (entry.services?.length ?? 0) > 0 ||
-    (entry.runtimeComponents?.length ?? 0) > 0
-  );
-}
-
-async function committedBiomeManifests(sourceRepositories, sourceAuthority) {
-
-
-const repositories = sourceRepositories.map((repository) => ({
-    ...repository,
-    commit: sourceAuthority.commitForRepository(repository.repo),
-    // The SOURCE axis, for the second pass below.
-    vendoredCommit: sourceAuthority.vendoredSourceCommitForRepository(repository.repo),
-  }));
-  const manifests = [];
-  for (const { repo, directory, commit } of repositories) {
-    manifests.push(...listBiomeManifestsAt(directory, repo, commit));
-  }
-
-  // ── SECOND PASS: CONTENT-ONLY BIOMES ARE READ ON THE SOURCE AXIS ──
-  //
-  // The pass above reads every manifest at the IMAGE commit, and for a biome
-  // that SHIPS A SERVICE that is exactly right: `resolve-images` pairs this
-  // biome's `sourceManifestHash` with that repository's image commit, and
-  // `assembleProducerInput` verifies the hash by recomputing it AT that commit.
-  // Move those and every image-producing service fails verification.
-  //
-  // A CONTENT-ONLY biome has no image subject, so nothing verifies it — and
-  // that same property is why it was undeliverable: it can never earn image
-  // evidence, so the image-evidence commit could never carry its changes. Its
-  // content belongs on the SOURCE axis, which is the commit whose bytes are
-  // actually vendored into whichever image carries it.
-  //
-  // Measured 2026-09-14: `memory-maintenance` (services: [], runtimeComponents:
-  // []) had migrated `modelClass` -> `modelLane`; the fix sat on cultivars' main
-  // while the image pin was 130 commits behind, and biome-host crashlooped in
-  // production on the retired key for 21 hours.
-  //
-  // Producing-ness is decided by PROJECTING the manifest through
-  // `manifestToIndexEntry` rather than re-deriving it here — one authority for
-  // "does this biome ship an image", not two that can disagree.
-  //
-  // This pass also lets a NEW content-only biome appear with no image build at
-  // all, which is the other half of the same defect.
-  let replaced = 0;
-  let added = 0;
-  for (const { repo, directory, commit, vendoredCommit } of repositories) {
-    if (!vendoredCommit || vendoredCommit === commit) {continue;}
-    for (const candidate of listBiomeManifestsAt(directory, repo, vendoredCommit)) {
-      let entry;
-      try {
-        entry = await manifestToIndexEntry(candidate);
-      } catch {
-        // A manifest that will not project is not this pass's problem to
-        // report: the image-axis pass above raises on it with its own message.
-        continue;
-      }
-      if (biomeShipsRuntimeImage(entry)) {continue;}
-      const at = manifests.findIndex((existing) => existing.rel === candidate.rel);
-      if (at === -1) {
-        manifests.push(candidate);
-        added += 1;
-      } else {
-        manifests[at] = candidate;
-        replaced += 1;
-      }
-    }
-  }
-  // A CORPUS LINE, because this pass is invisible in its output when the two
-  // axes happen to agree — which is the normal case and was the case on the run
-  // that introduced it: zero content-only manifests differed, so a no-op and a
-  // working pass produce byte-identical indexes. Printing what it SELECTED is
-  // the only thing that distinguishes them, and a future regression to
-  // `replaced=0` is then visible rather than silent.
-  console.log(
-    `[dist:index] source axis: ${replaced} content-only biome(s) re-read at the ` +
-      `vendored commit, ${added} added that exist only there ` +
-      `(${repositories.filter((r) => r.vendoredCommit && r.vendoredCommit !== r.commit).length} ` +
-      `repositor(y/ies) where the axes differ).`,
-  );
-  return manifests.sort((a, b) => compareStrings(a.rel, b.rel));
-}
-
-/**
- * Validate a service component's `protocol.databaseExtensions` the way the
- * kernel manifest schema does — an array of names matching the kernel's
- * extension-name GRAMMAR, with no repeats — and return it SORTED and
- * de-duplicated for the index. The predicate is read from the built kernel
- * dist so this plane cannot admit a name the kernel refuses, or refuse one it
- * admits.
- *
- * AN OPEN VOCABULARY, VALIDATED BY GRAMMAR — never a closed set. A PostgreSQL
- * extension name is owned by whoever runs the database, so a closed kernel enum
- * would produce members nothing can satisfy and would have to grow once per
- * customer: the same defect that deleted `DataResidency.Eu`. The kernel says so
- * itself — `PostgresExtensionNameSchema` is `z.string().regex(...)` and its
- * docstring reads "An OPEN vocabulary validated by GRAMMAR".
- *
- * This function previously read `Object.values(PostgresExtension)` and required
- * every entry to be a member. That export has never existed on any kernel
- * branch, so the biome-index build could not run at all while any manifest
- * declared the field, and its error blamed a stale dist. The consequence was
- * silent and total: the field reached ZERO of 62 subjects in the sealed lock.
- *
- * WHAT THIS DOES NOT DECIDE. Grammar admission is not installation permission.
- * Whether a deployment may install a given extension is
- * `infra.yaml#postgres.allowedExtensions`, enforced by the privileged bootstrap
- * — so a cloud tenant cannot install ad-hoc extensions even though the contract
- * can express any name. Contract breadth and runtime authority are separate
- * axes and this plane only carries the first.
- *
- * Throws naming the manifest and the component (`label`), because the index
- * build is where a manifest that would strand a database at boot should fail:
- * the runtime bootstrap only VERIFIES `pg_extension`, so a name nothing can
- * install is a pod that never comes up, discovered at the first deploy.
- */
-export function parseDatabaseExtensions(value, label) {
-  const { isPostgresExtensionName, POSTGRES_EXTENSION_NAME_PATTERN, POSTGRES_EXTENSION_NAME_MAX_LENGTH } =
-    loadKernelBiomeContracts();
-  const grammar =
-    `${String(POSTGRES_EXTENSION_NAME_PATTERN)}, at most ` +
-    `${POSTGRES_EXTENSION_NAME_MAX_LENGTH} characters`;
-  if (!Array.isArray(value)) {
-    throw new Error(
-      `${label} has protocol.databaseExtensions ${JSON.stringify(value)} — ` +
-        `expected an array of PostgreSQL extension names (${grammar})`,
-    );
-  }
-  const seen = new Set();
-  for (const extension of value) {
-    if (typeof extension !== 'string' || !isPostgresExtensionName(extension)) {
-      throw new Error(
-        `${label} has protocol.databaseExtensions entry ` +
-          `${JSON.stringify(extension)} — not a PostgreSQL extension NAME the ` +
-          `kernel grammar admits (${grammar}). The vocabulary is open, so this ` +
-          `is a malformed name rather than an unlisted one; whether this ` +
-          `deployment may install it is infra.yaml#postgres.allowedExtensions`,
-      );
-    }
-    if (seen.has(extension)) {
-      throw new Error(
-        `${label} repeats "${extension}" in protocol.databaseExtensions — ` +
-          `an extension is declared once`,
-      );
-    }
-    seen.add(extension);
-  }
-  return [...seen].sort(compareStrings);
-}
-
-/**
- * Read + minimally validate a raw `xema-biome.json` and project it into one
- * index entry. Fail-fast (throws) on missing id/scope/target or an unknown
- * tier. The full biome-manifest zod schema is NOT applied here — the index only
- * needs the packaging-relevant fields and must tolerate the wide variety of
- * (already-valid) manifests in the tree.
- */
-/**
- * The process facts of ONE platform-scheduled image component, in the exact
- * shape the kernel's `LockedServiceProcessFactsSchema` carries:
- * `{ componentKind, scalingMode, processFacts? }`.
- *
- * The same three inputs the kernel's `deriveProcessMemberFacts` reads off a
- * component (`kind`, `requirements.scaling.mode`, `processFacts`) — the rest
- * of a member's facts (origin, version, build source) already travel in the
- * lock and are joined by the deploy plane. Nothing is defaulted: a missing or
- * unknown scaling class REFUSES, naming the manifest, because a guessed class
- * bounds a process's replicas and the kernel requires the field on every
- * component. `processFacts` is validated by the kernel's own schema so the
- * index can never carry a block the lock schema would then refuse.
- */
-function componentProcessFacts(component, where) {
-  const kernel = loadKernelBiomeContracts();
-  const scalingMode = component.requirements?.scaling?.mode;
-  if (!Object.values(kernel.BiomeScalingMode).includes(scalingMode)) {
-    throw new Error(
-      `${where} declares requirements.scaling.mode "${String(scalingMode)}" — ` +
-        `expected one of ${Object.values(kernel.BiomeScalingMode).join(', ')}. ` +
-        'The scaling class is what bounds a process\'s replicas, so it is read, never defaulted.',
-    );
-  }
-  const facts = { componentKind: component.kind, scalingMode };
-  if (component.processFacts !== undefined) {
-    const parsed = kernel.BiomeComponentProcessFactsSchema.safeParse(
-      component.processFacts,
-    );
-    if (!parsed.success) {
-      throw new Error(
-        `${where} declares an invalid processFacts block: ` +
-          parsed.error.issues
-            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
-            .join('; '),
-      );
-    }
-    facts.processFacts = parsed.data;
-  }
-  return facts;
-}
-
-/**
- * The capabilities a signed biome declares: the sorted unique union of the refs
- * of the `capability` contributions it ships (read from its committed generated
- * index, which lists descriptor files and inline entries alike) and its
- * manifest's `requiresCapabilitiesForService`. Counterpart of biome-host's
- * `signedBiomeFacts` in xema-base, which must produce the same set.
- */
-export function signedBiomeDeclaredCapabilities(indexBiome, xema) {
-  const shipped = indexBiome.contributions
-    .filter((fact) => fact.kind === 'capability')
-    .map((fact) => {
-      if (typeof fact.capabilityRef !== 'string' || fact.capabilityRef.length === 0) {
-        throw new Error(
-          `biome "${indexBiome.biomeId}": capability contribution "${fact.id}" carries no capabilityRef in its generated index`,
-        );
-      }
-      return fact.capabilityRef;
-    });
-  const requiredForService = Array.isArray(xema.requiresCapabilitiesForService) ? xema.requiresCapabilitiesForService : [];
-  return [...new Set([...shipped, ...requiredForService])].sort(compareStrings);
-}
-
-/**
- * The components of a biome manifest that are image workloads: a service or worker with its own `oci-image`, or a
- * worker running its sibling service's image with its own entry module (`shared-oci-image`). Such a worker is a
- * standing workload like any other image component (rostered, with process facts, task queues and peers); it just
- * builds no image of its own, and `workerImages` in {@link manifestToIndexEntry} records whose it runs.
- */
-export function biomeImageComponents(components) {
-  return components.filter(
-    (component) =>
-      component !== null &&
-      typeof component === 'object' &&
-      (component.kind === 'service' || component.kind === 'worker') &&
-      (component.artifact?.kind === 'oci-image' ||
-        (component.kind === 'worker' && component.artifact?.kind === 'shared-oci-image')),
-  );
-}
-
-/**
- * The image name of one image component of biome `id` (manifest `rel`, `target`), claimed in `taken` (the names the
- * manifest's earlier image components claimed). A `service` registers under `protocol.serviceName`; a `worker` never
- * registers with the service registry, so its image name is the component key. Same rule the producing repo's build
- * plane applies: the image name is the SERVICE build arg either way. Refused: no image name, a web biome owning a
- * deployable image, and one image name declared twice.
- */
-export function claimBiomeImageName(component, { rel, id, target, taken }) {
-  const protocol = component.protocol !== null && typeof component.protocol === 'object' ? component.protocol : {};
-  const name = component.kind === 'service' ? protocol.serviceName : component.key;
-  if (typeof name !== 'string' || name.length === 0) {
-    throw new Error(
-      `${rel}: xema.components[] kind "${component.kind}" component ` +
-        `"${String(component.key)}" has no image name — a service declares ` +
-        `protocol.serviceName, a worker a non-empty key`,
-    );
-  }
-  if (target !== 'server') {
-    throw new Error(`${rel}: web biome "${id}" cannot own deployable image "${name}"`);
-  }
-  if (taken.has(name)) {
-    throw new Error(`${rel}: xema.components[] declares image "${name}" more than once`);
-  }
-  taken.add(name);
-  return name;
-}
-
-/** An image component launched per allocation (`scheduler: "runtime"`): a runtime component, never a rostered service. */
-export const isRuntimeImageComponent = (component) => component.scheduler === 'runtime';
-
-export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, path, authorizationModule }) {
-  const xema = raw?.xema;
-  if (!xema || typeof xema !== 'object') {
-    throw new Error(`${rel}: missing top-level "xema" object`);
-  }
-  const id = xema.id;
-  const tier = xema.scope;
-  const target = xema.target;
-  if (typeof id !== 'string' || id.length === 0) {
-    throw new Error(`${rel}: missing or empty xema.id`);
-  }
-  if (typeof tier !== 'string' || tier.length === 0) {
-    throw new Error(`${rel}: missing or empty xema.scope (the biome tier)`);
-  }
-  if (!isBiomeTier(tier)) {
-    throw new Error(
-      `${rel}: xema.scope "${tier}" is not a valid BiomeTier (one of ${biomeTierOrder().join(', ')})`,
-    );
-  }
-  if (typeof target !== 'string' || target.length === 0) {
-    throw new Error(`${rel}: missing or empty xema.target`);
-  }
-
-  const version = raw.version;
-  if (typeof version !== 'string' || version.length === 0) {
-    throw new Error(`${rel}: missing or empty top-level "version"`);
-  }
-
-  const origin = xema.trustTier ?? 'third-party';
-  // `mandatory` is NOT a manifest field — it is a distribution decision applied
-  // at resolve time from the `mandatory` selector flag (kernel-tier is always
-  // mandatory). The index carries only manifest-intrinsic facts.
-  const audience = xema.audience ?? 'org';
-  // Resolved by the KERNEL predicate, never read raw — it applies two derived
-  // refusals (operator audience, kernel tier) that a raw read silently skips.
-  const storeListed = loadKernelBiomeContracts().isBiomeStoreListed(raw);
-
-  // Deployable service names this biome ships (manifest `ships.apis[].name`).
-  // This is the biome→service mapping the deploy-roster generator needs; it is
-  // baked into the index (and forwarded into the lock) because the generator
-  // runs in a standalone checkout WITHOUT the biome sources. Pure skill/agent
-  // biomes and web biomes have no API and resolve to [].
-  const shipsApis = xema.ships?.apis;
-  const legacyApis = Array.isArray(shipsApis) ? shipsApis : [];
-  // component-contract-v5 shape: every image the biome ships is a
-  // `xema.components[]` entry whose `kind` is "service" or "worker" and whose
-  // `artifact.kind` is "oci-image". The remaining kinds (content, web, adapter,
-  // and any host-module service) are loaded INTO another process and ship no
-  // image of their own. This is DUAL SUPPORT for the staged ships.apis →
-  // components migration, not a fallback.
-  //
-  // WHICH PLANE SCHEDULES the image is read from the component's `scheduler`
-  // — the ONE owner of that fact, declared by the biome author. It is not
-  // derivable from anything else here: the four `kind: "worker"` components in
-  // xema-base are byte-identical in `entrypoint`, `protocol`, `executionModes`,
-  // `requirements.scaling`, `requirements.io` and `requirements.state`, yet
-  // three are standing Deployments and one must never be scheduled at all.
-  //
-  // Reading only `kind === "service"` (which this did until the contract regained
-  // the discriminator) silently reclassified five image subjects: it dropped the
-  // three platform-scheduled workers out of the roster entirely, dropped
-  // `opencode-worker` out of the image plane altogether, and PROMOTED
-  // `biome-adapter-host` to a rostered service that would have been given a
-  // Deployment it must never have.
-  const components = Array.isArray(xema.components) ? xema.components : [];
-  const hostModuleComponents = components.filter(
-    (component) =>
-      component !== null &&
-      typeof component === 'object' &&
-      component.artifact?.kind === 'host-module',
-  );
-  const hostModules = hostModuleComponents
-    .map((component) => {
-      if (target !== 'server') {
-        throw new Error(
-          `${rel}: web biome "${id}" cannot ship host module "${String(component.key)}"`,
-        );
-      }
-      if (!xema.bundleSource || typeof xema.bundleSource !== 'object') {
-        throw new Error(
-          `${rel}: host module "${String(component.key)}" requires xema.bundleSource; ` +
-            'a distribution host cannot fetch an executable from catalog prose or a source-tree path',
-        );
-      }
-      if (
-        component.entrypoint?.kind !== 'module-export' ||
-        typeof component.entrypoint.module !== 'string' ||
-        component.entrypoint.module.length === 0 ||
-        typeof component.entrypoint.exportName !== 'string' ||
-        component.entrypoint.exportName.length === 0
-      ) {
-        throw new Error(
-          `${rel}: host module "${String(component.key)}" must declare a non-empty module-export entrypoint`,
-        );
-      }
-      if (
-        typeof component.artifact.path !== 'string' ||
-        component.artifact.path.length === 0 ||
-        typeof component.hostAbi?.name !== 'string' ||
-        component.hostAbi.name.length === 0 ||
-        typeof component.hostAbi?.versionRange !== 'string' ||
-        component.hostAbi.versionRange.length === 0
-      ) {
-        throw new Error(
-          `${rel}: host module "${String(component.key)}" must declare artifact.path and hostAbi`,
-        );
-      }
-      return {
-        componentKey: component.key,
-        artifactPath: component.artifact.path,
-        modulePath: component.entrypoint.module,
-        exportName: component.entrypoint.exportName,
-        hostAbi: {
-          name: component.hostAbi.name,
-          versionRange: component.hostAbi.versionRange,
-        },
-        bundleSource: xema.bundleSource,
-      };
-    })
-    .sort((left, right) => compareStrings(left.componentKey, right.componentKey));
-  // The BIOME-LEVEL bundle source — `xema.bundleSource`, WHERE the runtime
-  // fetches this biome's bundle — for a biome whose bundle nothing above
-  // already names.
-  //
-  // Until this existed the manifest's declaration reached the lock in exactly
-  // one place: `hostModules[].bundleSource`, once per host module, because the
-  // only runtime consumer that fetched a distribution-selected bundle was the
-  // shared adapter host. A biome shipping `components[].kind = service` and no
-  // host module — the `pai-core` / `document-translation` shape in the
-  // customer edition — declared an `oci` source in its
-  // manifest and reached biome-host with NONE, so the required-biome
-  // reconciler reported it UNRESOLVABLE. Nothing at the runtime may guess the
-  // coordinate instead: `xema biome publish` pushes to the manifest's declared
-  // `ociRef` while `bundle-coordinate.mjs` derives `<registry>/<id>:<hash>`,
-  // and a third rule matching one of them today fetches a DIFFERENT signed
-  // bundle by the same publisher the day either moves, and fails nothing.
-  //
-  // STATED ONCE PER BIOME, and that is the byte-stability property: a biome
-  // that ships host modules keeps its source on each host module, unchanged,
-  // and gains NO biome-level key. Measured at `origin/develop`: the seventeen
-  // manifests that declare `xema.bundleSource` are all connector biomes with a
-  // host module, so every committed index entry and all nine committed vendor
-  // locks are byte-identical under this projection. Emitting it for those too
-  // would be the same value stated twice and would re-stamp five vendor locks
-  // to lock schemaVersion 4 — a fleet rollout, not a projection. A reader
-  // that wants one answer for any biome reads the biome-level field first and
-  // falls back to the host-module projection (biome-host's
-  // `resolveLockedBiomeBundleSource`).
-  //
-  // Validated by the KERNEL's own `BiomeBundleSourceSpecSchema` — the one
-  // shape the lock reuses — so a malformed declaration fails HERE, naming the
-  // manifest, rather than at `parseDistributionLock` forty fields in.
-  let bundleSource;
-  if (xema.bundleSource !== undefined && hostModules.length === 0) {
-    const parsed = loadKernelBiomeContracts().BiomeBundleSourceSpecSchema.safeParse(
-      xema.bundleSource,
-    );
-    if (!parsed.success) {
-      throw new Error(
-        `${rel}: xema.bundleSource is not a valid biome bundle source: ` +
-          parsed.error.issues
-            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
-            .join('; '),
-      );
-    }
-    bundleSource = parsed.data;
-  }
-  const imageComponents = biomeImageComponents(components);
-  // A worker is a standing workload that runs an image: its own oci-image or a
-  // sibling service's (shared-oci-image, validated by `sharedImageWorker`).
-  // A worker with neither would be rostered by nothing and ship no image.
-  const imagelessWorkers = components.filter(
-    (component) =>
-      component !== null &&
-      typeof component === 'object' &&
-      component.kind === 'worker' &&
-      !imageComponents.includes(component),
-  );
-  if (imagelessWorkers.length > 0) {
-    throw new Error(
-      `${rel}: worker component(s) ${imagelessWorkers.map((component) => JSON.stringify(component.name ?? component.key ?? '?')).join(', ')} ` +
-        'resolve no worker image: a worker declares artifact.kind "oci-image" or "shared-oci-image"',
-    );
-  }
-  // A privilege (`requiresOperations`, `optionalOperations`, `requestsInstalledOperations`, `requiresOrganizationSweeps`, `requiresAudiences`, `ownsAudienceNamespaces`) is admitted for a lock workload
-  // principal only; on any other component it is refused, never dropped.
-  assertPrivilegesHavePrincipals(components, imageComponents, rel);
-  // A biome must declare its images in EXACTLY ONE shape. Declaring both a
-  // legacy `ships.apis[]` entry and a v5 image component is ambiguous during
-  // the staged migration — fail fast instead of guessing.
-  if (legacyApis.length > 0 && imageComponents.length > 0) {
-    throw new Error(
-      `${rel}: declares deployable images in BOTH xema.ships.apis[] (legacy) and ` +
-        `xema.components[] (component-contract-v5) — a biome must use exactly one shape`,
-    );
-  }
-  const serviceRequirements = [];
-  const services = [];
-  // `service → database key` for the few services whose key is not derivable.
-  const serviceDatabases = {};
-  // `service → PostgreSQL extensions its database must carry`, for the few
-  // services that declare any. Travels beside `serviceDatabases` into the lock,
-  // where the deployment's privileged database bootstrap reads it.
-  const serviceDatabaseExtensions = {};
-  // Images the biome ships that are never scheduled (`workload:
-  // "runtime-component"`). They are built, content-addressed, signed and
-  // mirrored exactly like a service image, but the deploy plane must never
-  // roster a release for them — so they are carried in a SEPARATE array and
-  // contribute NO service-dependency edge and NO service owner.
-  const runtimeComponents = [];
-  // `component key → image name` for every runtime component declared through
-  // `xema.components[]`. A `runtime-image` edge names its target by component
-  // KEY, and the image lock by image NAME, so the edition resolver reads this
-  // to follow another biome's edge to this one. The legacy `ships.apis[]`
-  // shape declares no component key, so no edge can name its components.
-  const runtimeComponentKeys = {};
-  // Infrastructure resources each rostered component NEEDS
-  // (`protocol.resources`) and the resource kinds it PROVIDES
-  // (`protocol.providesResources`). Declared INTENT only: the resolver binds
-  // each requirement to the one provider of its kind in the edition, and the
-  // lock carries that binding as an authorization input the provider enforces.
-  // Validated by the kernel's own schemas, at index build, naming the manifest.
-  const serviceResources = [];
-  const providesResources = [];
-  // `service → what sharing a process needs to know about it`, for EVERY
-  // platform-scheduled image component — see `componentProcessFacts`.
-  const serviceProcessFacts = {};
-  // `component → the service-to-service operations it requires`
-  // (`requiresOperations`), keyed by the SAME name the lock uses. Declared
-  // intent only: the seal admits or refuses each one.
-  const operationRequirements = {};
-  // `component → the operations it uses only when their owner is served`
-  // (`optionalOperations`), keyed like `operationRequirements`. Declared
-  // intent only: the seal grants, leaves ungranted or refuses each one.
-  const optionalOperationRequirements = {};
-  // `component → the operations it asks to exercise for the installing
-  // organization` (`requestsInstalledOperations`), keyed like
-  // `operationRequirements`. Declared intent only: the lock admits the ceiling.
-  const installedOperationRequests = {};
-  // The workload components that declare `relaysOrgContext`, in manifest order
-  // (sorted at the write). Declared intent only: the lock admits it.
-  const orgContextRelayers = [];
-  // `component → the edition input families it declares` (`editionInputs`),
-  // keyed like `operationRequirements`. A service reads them through the lock's
-  // `componentEditionInputs`. Declared intent only: the lock admits them.
-  const componentEditionInputs = {};
-  // `component → the event subscription clauses it declares` (`subscribesEvents`),
-  // keyed like `operationRequirements`. Declared intent only: the lock admits them.
-  const eventSubscriptionRequirements = {};
-  // `component → the organization sweeps it may hold`
-  // (`requiresOrganizationSweeps`), keyed like `operationRequirements`.
-  // Declared intent only: the seal admits or refuses each one.
-  const organizationSweepRequirements = {};
-  // `component → the exact audiences it requires` (`requiresAudiences`), keyed
-  // like `operationRequirements`. Declared intent only: `admitExactAudiences`.
-  const audienceRequirements = {};
-  // The audience namespaces the biome's components own (`ownsAudienceNamespaces`),
-  // ONE entry per namespace however many components list it.
-  const ownedAudienceNamespaces = new Set();
-  // Nexus services this biome's workers PROVIDE and REQUIRE (worker protocol
-  // v2). Declared intent only, exactly like resources: the edition resolver
-  // binds each requirement to the ONE shipped provider of the same
-  // (service, version) and seals the answer in the lock's `nexusBindings`.
-  const nexusProvides = [];
-  const nexusRequires = [];
-  // `component → its task queues`, for every protocol worker/v2 component —
-  // see `componentWorkerTaskQueues`.
-  const workerTaskQueues = {};
-  // `service → the worker queues it starts workflows on` — see
-  // `componentWorkflowClients`.
-  const workflowClients = {};
-  // `worker → { imageOf, entry }` for every worker that runs a sibling
-  // service's image — see `sharedImageWorker`.
-  const workerImages = {};
-  if (imageComponents.length > 0) {
-    const imageNames = new Set();
-    for (const component of imageComponents) {
-      const protocol =
-        component.protocol !== null && typeof component.protocol === 'object'
-          ? component.protocol
-          : {};
-      const name = claimBiomeImageName(component, { rel, id, target, taken: imageNames });
-      const where = `${rel}: xema.components[] "${name}"`;
-      const requirements = parseComponentResourceDeclaration(
-        'ResourceRequirementsSchema',
-        protocol.resources,
-        `${where} protocol.resources`,
-      );
-      const provisions = parseComponentResourceDeclaration(
-        'ResourceProvisionsSchema',
-        protocol.providesResources,
-        `${where} protocol.providesResources`,
-      );
-      const nexus = componentNexusDeclarations(component, name, protocol, where);
-      if (isRuntimeImageComponent(component)) {
-        // A Nexus binding names the provider COMPONENT the deploy plane points
-        // an endpoint at, which must be a rostered image; a component launched
-        // per allocation is not one. Refused rather than dropped.
-        if (nexus.provides.length > 0 || nexus.requires.length > 0) {
-          throw new Error(
-            `${where} declares scheduler "runtime" and protocol.nexus — a Nexus ` +
-              `binding names a rostered worker, and a component that is never ` +
-              `scheduled is not one`,
-          );
-        }
-        // A resource binding is admitted against the caller's VERIFIED SERVICE
-        // identity, and a runtime component — launched per allocation — is not
-        // a rostered service that identity could name. Refused rather than
-        // dropped: a skipped declaration would reach no lock and fail nothing.
-        if (requirements.length > 0 || provisions.length > 0) {
-          throw new Error(
-            `${where} declares scheduler "runtime" and protocol.resources / ` +
-              `protocol.providesResources — a resource binding names a rostered ` +
-              `service, and a component that is never scheduled is not one`,
-          );
-        }
-        // Never scheduled, so `requiresServices` — an edge between two ROSTERED
-        // services — is meaningless on it, exactly as it was for the legacy
-        // `workload: "runtime-component"` shape.
-        if (
-          Array.isArray(protocol.requiresServices) &&
-          protocol.requiresServices.length > 0
-        ) {
-          throw new Error(
-            `${rel}: xema.components[] "${name}" declares scheduler "runtime" and ` +
-              `protocol.requiresServices — a component that is never scheduled ` +
-              `cannot carry a service-dependency edge`,
-          );
-        }
-        // An operation grant is admitted for a rostered workload caller, and a
-        // runtime component is not one. Refused rather than dropped.
-        for (const field of PRINCIPAL_PRIVILEGE_FIELDS) {
-          if (component[field] !== undefined) {
-            throw new Error(
-              `${where} declares scheduler "runtime" and ${field} — a ` +
-                `privilege names a rostered workload, and a component that is ` +
-                `never scheduled is not one`,
-            );
-          }
-        }
-        runtimeComponents.push(name);
-        runtimeComponentKeys[component.key] = name;
-        continue;
-      }
-      if (component.scheduler !== 'platform') {
-        throw new Error(
-          `${rel}: xema.components[] "${name}" declares scheduler ` +
-            `"${String(component.scheduler)}" — every image component must declare ` +
-            `"platform" (the deploy plane rosters a standing workload) or "runtime" ` +
-            `(the runtime plane launches it on demand)`,
-        );
-      }
-      const requiredServices = protocol.requiresServices ?? [];
-      if (
-        !Array.isArray(requiredServices) ||
-        requiredServices.some(
-          (service) => typeof service !== 'string' || service.length === 0,
-        )
-      ) {
-        throw new Error(
-          `${rel}: xema.components[] "${name}" protocol.requiresServices must be an ` +
-            `array of non-empty service names`,
-        );
-      }
-      // The shared-biome-cluster database key this service opens, declared ONLY
-      // when it is neither the biome id nor the service name minus `-api`.
-      // org-database-pool-api's ownership fence can derive those two and nothing
-      // else, so a service whose schema name outlived a rename
-      // (`scm-connector-api` → schema `scm-integration`) is unreachable unless
-      // the component says so. The v5 spelling is `protocol.databaseKey`; the
-      // legacy one below is `ships.apis[].database`.
-      if (protocol.databaseKey !== undefined) {
-        if (
-          typeof protocol.databaseKey !== 'string' ||
-          !/^[a-z][a-z0-9-]*$/.test(protocol.databaseKey)
-        ) {
-          throw new Error(
-            `${rel}: xema.components[] "${name}" has protocol.databaseKey ` +
-              `"${String(protocol.databaseKey)}" — expected lowercase kebab-case ` +
-              `(it becomes a Postgres schema name)`,
-          );
-        }
-        serviceDatabases[name] = protocol.databaseKey;
-      }
-      // The PostgreSQL extensions this service's database must carry BEFORE its
-      // first migration runs (`protocol.databaseExtensions`, the sibling of
-      // `databaseKey`). A database-level prerequisite the deployment's
-      // privileged bootstrap satisfies, never something the service creates —
-      // so it has to travel from the manifest to the lock, which is the one
-      // artifact the deploy plane reads without the biome sources. Validated
-      // here exactly as the kernel manifest schema does (closed set, no
-      // repeats), because this projection reads the RAW manifest and the full
-      // kernel schema is deliberately not applied on this path. ABSENT and
-      // `[]` make the same claim — no extension — and project to no key.
-      //
-      // Deliberately NO legacy `ships.apis[]` spelling: that shape predates the
-      // field, and every service that has an extension requirement is on the
-      // component contract.
-      if (protocol.databaseExtensions !== undefined) {
-        const extensions = parseDatabaseExtensions(
-          protocol.databaseExtensions,
-          `${rel}: xema.components[] "${name}"`,
-        );
-        if (extensions.length > 0) {
-          serviceDatabaseExtensions[name] = extensions;
-        }
-      }
-      for (const requirement of requirements) {
-        serviceResources.push({
-          consumerService: name,
-          kind: requirement.kind,
-          logicalName: requirement.logicalName,
-          scope: requirement.scope,
-          inclusion: requirement.inclusion,
-          ...(requirement.sharing === undefined ? {} : { sharing: requirement.sharing }),
-        });
-      }
-      for (const provision of provisions) {
-        providesResources.push({ service: name, kind: provision.kind });
-      }
-      nexusProvides.push(...nexus.provides);
-      nexusRequires.push(...nexus.requires);
-      services.push(name);
-      serviceProcessFacts[name] = componentProcessFacts(component, where);
-      const operations = componentOperationRequirements(component, where);
-      if (operations !== null) {operationRequirements[name] = operations;}
-      const optionalOperations = componentOptionalOperationRequirements(component, where);
-      if (optionalOperations !== null) {optionalOperationRequirements[name] = optionalOperations;}
-      const installed = componentInstalledOperationRequests(component, where);
-      if (installed !== null) {installedOperationRequests[name] = installed;}
-      if (componentRelaysOrgContext(component, where)) {orgContextRelayers.push(name);}
-      if (component.editionInputs !== undefined) {
-        const families = component.editionInputs;
-        if (
-          !Array.isArray(families) ||
-          families.some((family) => typeof family !== 'string' || family.length === 0)
-        ) {
-          throw new Error(
-            `${where} has editionInputs ${JSON.stringify(families)} — expected an array ` +
-              `of non-empty edition input family names`,
-          );
-        }
-        if (families.length > 0) {
-          componentEditionInputs[name] = [...new Set(families)].sort(compareStrings);
-        }
-      }
-      const subscriptions = componentEventSubscriptionRequirements(component, where);
-      if (subscriptions !== null) {eventSubscriptionRequirements[name] = subscriptions;}
-      const sweeps = componentOrganizationSweepRequirements(component, where);
-      if (sweeps !== null) {organizationSweepRequirements[name] = sweeps;}
-      const audiences = componentAudienceRequirements(component, where);
-      if (audiences !== null) {audienceRequirements[name] = audiences;}
-      for (const namespace of componentOwnedAudienceNamespaces(component, where) ?? []) {
-        ownedAudienceNamespaces.add(namespace);
-      }
-      const queues = componentWorkerTaskQueues(component, protocol, where);
-      if (queues !== null) {workerTaskQueues[name] = queues;}
-      const clients = componentWorkflowClients(protocol, where);
-      if (clients !== null) {workflowClients[name] = clients;}
-      const shared = sharedImageWorker(component, components, where);
-      if (shared !== null) {workerImages[name] = shared;}
-      serviceRequirements.push({
-        consumerService: name,
-        requiredServices: [...new Set(requiredServices)].sort(compareStrings),
-      });
-    }
-  } else {
-    for (const api of legacyApis) {
-      if (!api || typeof api.name !== 'string' || api.name.length === 0) {
-        throw new Error(
-          `${rel}: xema.ships.apis[] entry is missing a non-empty "name"`,
-        );
-      }
-      if (target !== 'server') {
-        throw new Error(
-          `${rel}: web biome "${id}" cannot own deployable API service "${api.name}"`,
-        );
-      }
-      const workload = api.workload ?? DEFAULT_BIOME_WORKLOAD_KIND;
-      if (!BIOME_WORKLOAD_KINDS.has(workload)) {
-        throw new Error(
-          `${rel}: xema.ships.apis[] "${api.name}" has unknown workload ` +
-            `"${String(workload)}" — expected one of ${[...BIOME_WORKLOAD_KINDS].join(', ')}`,
-        );
-      }
-      if (workload === 'runtime-component') {
-        // A runtime component has no standing workload, so `requiresServices`
-        // (an edge between two ROSTERED services) is meaningless on it.
-        if (
-          Array.isArray(api.requiresServices) &&
-          api.requiresServices.length > 0
-        ) {
-          throw new Error(
-            `${rel}: xema.ships.apis[] "${api.name}" declares workload ` +
-              `"runtime-component" and requiresServices — a component that is never ` +
-              `scheduled cannot carry a service-dependency edge`,
-          );
-        }
-        runtimeComponents.push(api.name);
-        continue;
-      }
-      const requiredServices = api.requiresServices ?? [];
-      if (
-        !Array.isArray(requiredServices) ||
-        requiredServices.some(
-          (service) => typeof service !== 'string' || service.length === 0,
-        )
-      ) {
-        throw new Error(
-          `${rel}: xema.ships.apis[] "${api.name}" requiresServices must be an array of non-empty service names`,
-        );
-      }
-      services.push(api.name);
-      // The shared-biome-cluster database key this service opens, declared ONLY
-      // when it is neither the biome id nor the service name minus `-api`.
-      // org-database-pool-api's ownership fence can derive those two and
-      // nothing else, so a service whose schema name outlived a rename
-      // (`scm-connector-api` → schema `scm-integration`) is unreachable unless
-      // the biome says so here. Carried into the lock, which is where the fence
-      // reads it — a distribution-time fact, never a request-time claim.
-      if (api.database !== undefined) {
-        if (typeof api.database !== 'string' || !/^[a-z][a-z0-9-]*$/.test(api.database)) {
-          throw new Error(
-            `${rel}: xema.ships.apis[] "${api.name}" has database ` +
-              `"${String(api.database)}" — expected lowercase kebab-case (it becomes a Postgres schema name)`,
-          );
-        }
-        serviceDatabases[api.name] = api.database;
-      }
-      serviceRequirements.push({
-        consumerService: api.name,
-        requiredServices: [...new Set(requiredServices)].sort(compareStrings),
-      });
-    }
-  }
-  services.sort(compareStrings);
-  runtimeComponents.sort(compareStrings);
-  serviceRequirements.sort((a, b) =>
-    compareStrings(a.consumerService, b.consumerService),
-  );
-  serviceResources.sort(compareResourceRows);
-  nexusProvides.sort(compareNexusRows);
-  nexusRequires.sort(compareNexusRows);
-  providesResources.sort(
-    (a, b) => compareStrings(a.service, b.service) || compareStrings(a.kind, b.kind),
-  );
-  // The two arrays partition the biome's images — a name in both would be
-  // simultaneously rostered and unschedulable.
-  for (const name of runtimeComponents) {
-    if (services.includes(name)) {
-      throw new Error(
-        `${rel}: xema.ships.apis[] "${name}" is declared both as a service and ` +
-          `as a runtime component — an image is either scheduled or it is not`,
-      );
-    }
-  }
-
-  // Biomes this one REQUIRES, read from the committed generated index rather
-  // than restated in the manifest.
-  //
-  // This used to union three manifest fields: `xema.dependencies` (server
-  // biomes), `xema.requires` (an object form NO manifest has ever declared and
-  // the strict schema now rejects — dead, and deleted with this change), and
-  // `xema.requiresServerBiomes` (web biomes). That last one was never authored:
-  // it was a generator-owned projection of "package dependencies ∩ generated
-  // api-clients whose owner is a server biome". A web biome carries no
-  // `xema.dependencies`, so it was the ONLY producer of `requires` for a web
-  // biome — reading it after the field was deleted would silently produce
-  // `requires: []`, which makes `requiresServerBiomesSatisfied` permanently
-  // true and kills orphan detection outright.
-  //
-  // `requiredBiomeDependencyIds` answers the same question for BOTH targets
-  // from one typed, evidence-carrying edge set: `xema.dependencies` for server
-  // biomes and the derived client edges for web ones, filtered to
-  // kind=biome + strength=required (service/connector/capability/host-abi edges
-  // and optional edges are excluded by construction). Parsing with the kernel
-  // schema first means a malformed or foreign index fails here rather than
-  // resolving to an empty list.
-  const kernelBiome = loadKernelBiomeContracts();
-  let parsedIndex;
-  try {
-    parsedIndex = kernelBiome.BiomeBundleGeneratedIndexSchema.parse(generatedIndex);
-  } catch (error) {
-    throw new Error(
-      `${rel}: the committed ${BIOME_GENERATED_INDEX_FILENAME} is not a valid generated index: ${error.message}`,
-    );
-  }
-  if (parsedIndex.biome.biomeId !== id) {
-    throw new Error(
-      `${rel}: ${BIOME_GENERATED_INDEX_FILENAME} declares biomeId "${parsedIndex.biome.biomeId}" but the ` +
-        `manifest declares "${id}" — the index does not describe this biome`,
-    );
-  }
-  if (parsedIndex.biome.version !== version) {
-    throw new Error(
-      `${rel}: ${BIOME_GENERATED_INDEX_FILENAME} declares version "${parsedIndex.biome.version}" but the ` +
-        `manifest declares "${version}" — the index is stale; run \`pnpm derive:biome-index:write\``,
-    );
-  }
-  // Already de-duplicated and sorted by the kernel helper.
-  const requiresUnique = [...kernelBiome.requiredBiomeDependencyIds(parsedIndex.biome)];
-  // The runtime components this biome's components dispatch: the kernel's
-  // `runtime-image` edges, reduced to their distinct targets. "Needs that
-  // image" and nothing else — the kernel keeps them out of
-  // `requiredBiomeDependencyIds`, and they never enter `requires`: the edition
-  // resolver carries the target's image without installing its biome.
-  const dispatchesRuntimeComponents = [
-    ...new Map(
-      parsedIndex.biome.edges
-        .filter((edge) => edge.kind === kernelBiome.BiomeGeneratedEdgeKind.RuntimeImage)
-        .map((edge) => projectDispatchedTarget(id, edge.target))
-        .map((target) => [dispatchedEdgeIdentity(target), target]),
-    ).values(),
-  ].sort(compareDispatchedEdges);
-
-  // Optional server biomes a web biome can integrate with but does not require
-  // (never cause an ORPHANED resolution). Carried separately from `requires`.
-  const optionalServerBiomes = Array.isArray(xema.optionalServerBiomes)
-    ? [...new Set(xema.optionalServerBiomes)].sort()
-    : [];
-
-  // Capability DOMAINS this biome claims to own (manifest
-  // `xema.ownsCapabilityDomains`). The claim is carried verbatim into the index
-  // and then into the lock, where — and ONLY where — it becomes trustworthy:
-  // being present in a RESOLVED, COMMITTED, drift-checked lock makes ownership a
-  // distribution-author decision rather than a biome's self-declaration. See
-  // `first-party-capability-domains.ts` in @xemahq/contracts.
-  //
-  // The claim is EXPLICIT — it never defaults to `capabilityDomain` or `id`. An
-  // implicit default would silently make every locked biome first-party in its
-  // own id-domain, which would newly REFUSE org provider bindings that are
-  // legitimately org-bound today (e.g. `media:transcribe@1`).
-  const ownsCapabilityDomains = Array.isArray(xema.ownsCapabilityDomains)
-    ? [...new Set(xema.ownsCapabilityDomains)].sort(compareStrings)
-    : [];
-  for (const domain of ownsCapabilityDomains) {
-    if (!isKernelCapabilityDomain(domain)) {
-      throw new Error(
-        `${rel}: xema.ownsCapabilityDomains contains ${JSON.stringify(domain)}, ` +
-          `which is not a valid capability domain`,
-      );
-    }
-  }
-  // A biome that declares a projection domain MUST also own it — otherwise it
-  // projects refs into a domain any org could shadow with a provider binding.
-  if (
-    typeof xema.capabilityDomain === 'string' &&
-    xema.capabilityDomain.length > 0 &&
-    !ownsCapabilityDomains.includes(xema.capabilityDomain)
-  ) {
-    throw new Error(
-      `${rel}: xema.capabilityDomain "${xema.capabilityDomain}" is not listed in ` +
-        `xema.ownsCapabilityDomains [${ownsCapabilityDomains.join(', ')}] — a biome that ` +
-        `projects capabilities into a domain must also claim ownership of it.`,
-    );
-  }
-
-  // --- Catalog projection (consumed by biome-host's DistributionCatalogSource) ---
-  // The index/lock is the single source of truth for the biome CATALOG (which
-  // biomes exist + the facts the web/server registry DTOs need), replacing the
-  // filesystem-scan + vendored-manifest path. We carry the RAW manifest fields
-  // the catalog derivation needs; biome-host applies the SAME `@xemahq/biome-sdk`
-  // helpers (isSystemSurface / isBiomeStoreListed / defaultEnabledFor) it already
-  // uses, so the derivation logic lives in exactly one place (no reimplementation
-  // here, no drift).
-  const displayName =
-    typeof xema.displayName === 'string' && xema.displayName.length > 0
-      ? xema.displayName
-      : id;
-  // npm/workspace package name. For WEB biomes this is the SPA's import specifier
-  // (load-bearing) — required. For server biomes it is cosmetic.
-  const packageName = typeof raw.name === 'string' ? raw.name : null;
-  if (target === 'web' && !packageName) {
-    throw new Error(
-      `${rel}: web biome is missing a top-level "name" (the SPA import specifier).`,
-    );
-  }
-  // Raw `xema.display` block (icon/category/summary/accent), passed through
-  // verbatim; absent → omitted.
-  const display =
-    xema.display && typeof xema.display === 'object' ? xema.display : undefined;
-  // Raw `xema.systemSurface` flag (renders in the org rail vs the store). Only a
-  // boolean is meaningful; absence is normal and handled by the sdk helper.
-  const systemSurface =
-    typeof xema.systemSurface === 'boolean' ? xema.systemSurface : undefined;
-  // Content-addressed source-manifest hash — lets biome-host (and diagnostics)
-  // detect when a biome's authored manifest changed, distinct from distribution
-  // resolution. Hash of the canonical manifest JSON.
-  const { computeBiomeSourceManifestHash } = await loadKernelDistributionSchemas();
-  const sourceManifestHash = await computeBiomeSourceManifestHash(raw);
-
-  // --- Installation class (the `{ installationClass }` selector's input) -----
-  // HOW ESSENTIAL this biome is, folded from its components' declarations by
-  // the KERNEL's `foldInstallationClass` — most essential wins. The fold is not
-  // re-implemented here for the same reason `storeListed` calls
-  // `isBiomeStoreListed`: a second implementation of a kernel rule is a second
-  // answer waiting to drift, and this one decides whether a biome is on an
-  // edition's FLOOR.
-  //
-  // The class is declared per COMPONENT and selected per BIOME because the
-  // biome is the unit a distribution installs. Measured on 2026-09-05 across
-  // all 34 classified manifests in repos/xema-base: NO biome mixes classes
-  // across its runnable components, so today the fold is exact rather than
-  // lossy. It is still a fold, and the kernel's docblock says which direction
-  // it takes and why.
-  //
-  // OMITTED when no component declares a class — the third answer, never a
-  // default. That also keeps the index byte-stable for every biome that
-  // declares nothing, which at `origin/main` is currently all of them.
-  const installationClass = kernelBiome.foldInstallationClass(
-    components.map((component) =>
-      component !== null && typeof component === 'object'
-        ? component.installationClass
-        : undefined,
-    ),
-  );
-
-  return {
-    id,
-    tier,
-    target,
-    origin,
-    version,
-    audience,
-    storeListed,
-    // The kernel fold of the components' own declarations; OMITTED when none
-    // declares one (see above), so an unclassed biome stays byte-stable.
-    ...(installationClass !== undefined ? { installationClass } : {}),
-    services,
-    // Omitted when empty — which is almost every biome — so the index stays
-    // byte-stable for everything that needs no declaration.
-    ...(Object.keys(serviceDatabases).length > 0
-      ? {
-          serviceDatabases: Object.fromEntries(
-            Object.entries(serviceDatabases).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // Same omission rule as `serviceDatabases`, for the same reason: at
-    // `origin/main` no manifest declares an extension, so an unconditional key
-    // would move the bytes of every one of the ~117 entries for a fact none of
-    // them carries.
-    ...(Object.keys(serviceDatabaseExtensions).length > 0
-      ? {
-          serviceDatabaseExtensions: Object.fromEntries(
-            Object.entries(serviceDatabaseExtensions).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    runtimeComponents,
-    // Omitted when the biome has no runtime component (almost every biome),
-    // so the index stays byte-stable for everything that declares none.
-    ...(Object.keys(runtimeComponentKeys).length > 0
-      ? {
-          runtimeComponentKeys: Object.fromEntries(
-            Object.entries(runtimeComponentKeys).sort(([a], [b]) => compareStrings(a, b)),
-          ),
-        }
-      : {}),
-    // Omitted when the biome dispatches nothing, for the same reason.
-    ...(dispatchesRuntimeComponents.length > 0 ? { dispatchesRuntimeComponents } : {}),
-    hostModules,
-    // Omitted when the biome declares none, or when its host modules already
-    // carry it — see the projection above. At `origin/develop` that is every
-    // committed entry, which is what keeps `biome-index.json` byte-stable.
-    ...(bundleSource !== undefined ? { bundleSource } : {}),
-    // The biome's authorization module (plan biome-declared-authorization.md
-    // §2.1): the author's SOURCE manifest `{ envelope, moduleFiles, testFile }`
-    // and the `signedBiome` facts the sealer STAMPS onto it with the kernel's
-    // `stampAuthorizationModuleContribution` — derived here, from this pinned
-    // manifest and its generated index, never from the author's envelope.
-    // Omitted when the biome ships none — every committed biome today — so
-    // `biome-index.json` stays byte-stable.
-    ...(authorizationModule !== undefined
-      ? {
-          authorizationModule: {
-            source: authorizationModule,
-            signedBiome: {
-              tier,
-              declaredBiomeDependencies: requiresUnique,
-              serviceNames: [
-                ...new Set(
-                  (Array.isArray(xema.components) ? xema.components : [])
-                    .map((component) => component?.protocol?.serviceName)
-                    .filter((name) => typeof name === 'string' && name.length > 0),
-                ),
-              ].sort(compareStrings),
-              // The capabilities the signed biome declares (a delegation
-              // origination may lend only these) — the runtime's rule, which
-              // biome-host's `signedBiomeFacts` (xema-base) computes and this
-              // MUST agree with byte for byte: the sorted unique union of the
-              // refs of the `capability` contributions the biome ITSELF ships
-              // (descriptor files and inline entries) and the manifest's
-              // `requiresCapabilitiesForService`. `exposesCapabilities` is not
-              // part of it.
-              declaredCapabilities: signedBiomeDeclaredCapabilities(parsedIndex.biome, xema),
-            },
-          },
-        }
-      : {}),
-    serviceRequirements,
-    // Omitted when empty — which is every biome today — so the index stays
-    // byte-stable for everything that declares nothing.
-    ...(serviceResources.length > 0 ? { serviceResources } : {}),
-    ...(providesResources.length > 0 ? { providesResources } : {}),
-    // Omitted when empty — every committed biome today — so the index stays
-    // byte-stable for everything that declares no Nexus service.
-    ...(nexusProvides.length > 0 ? { nexusProvides } : {}),
-    ...(nexusRequires.length > 0 ? { nexusRequires } : {}),
-    // The v2 workers' task queues; omitted when the biome ships none (every
-    // committed biome today), so the index stays byte-stable.
-    ...(Object.keys(workerTaskQueues).length > 0
-      ? {
-          workerTaskQueues: Object.fromEntries(
-            Object.entries(workerTaskQueues).sort(([a], [b]) => compareStrings(a, b)),
-          ),
-        }
-      : {}),
-    // The queues each http service starts workflows on; omitted when no
-    // component declares any, so the index stays byte-stable.
-    ...(Object.keys(workflowClients).length > 0
-      ? {
-          workflowClients: Object.fromEntries(
-            Object.entries(workflowClients).sort(([a], [b]) => compareStrings(a, b)),
-          ),
-        }
-      : {}),
-    // The workers that run a sibling service's image with their own entry
-    // module; omitted when the biome has none, so the index stays byte-stable.
-    ...(Object.keys(workerImages).length > 0
-      ? {
-          workerImages: Object.fromEntries(
-            Object.entries(workerImages).sort(([a], [b]) => compareStrings(a, b)),
-          ),
-        }
-      : {}),
-    // Every platform-scheduled image this biome ships, with the facts a
-    // composed process is graded on. Present for EVERY service of a
-    // component-contract biome — a service declaring nothing still gets its
-    // derived `componentKind` + `scalingMode`, because absent facts are what
-    // the kernel grades as `unknown-member`. Omitted only when the biome ships
-    // no platform-scheduled image (and for the retired `ships.apis[]` shape,
-    // which declares no scaling class to read).
-    ...(Object.keys(serviceProcessFacts).length > 0
-      ? {
-          serviceProcessFacts: Object.fromEntries(
-            Object.entries(serviceProcessFacts).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The service-to-service operations each workload component requires;
-    // omitted when none declares any, so the index stays byte-stable.
-    ...(Object.keys(operationRequirements).length > 0
-      ? {
-          operationRequirements: Object.fromEntries(
-            Object.entries(operationRequirements).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The operations each workload component uses only when their owner is
-    // served; omitted when none declares any.
-    ...(Object.keys(optionalOperationRequirements).length > 0
-      ? {
-          optionalOperationRequirements: Object.fromEntries(
-            Object.entries(optionalOperationRequirements).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The operations each workload component asks to exercise for the
-    // installing organization; omitted when none declares any.
-    ...(Object.keys(installedOperationRequests).length > 0
-      ? {
-          installedOperationRequests: Object.fromEntries(
-            Object.entries(installedOperationRequests).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The workload components that relay an organization context; omitted when
-    // none does.
-    ...(orgContextRelayers.length > 0
-      ? { orgContextRelayers: [...orgContextRelayers].sort(compareStrings) }
-      : {}),
-    // The edition input families each service component declares, keyed by the
-    // lock name in code-unit order, each list sorted and unique; omitted when
-    // none declares any.
-    ...(Object.keys(componentEditionInputs).length > 0
-      ? {
-          componentEditionInputs: Object.fromEntries(
-            Object.entries(componentEditionInputs).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The event subscription clauses each workload component declares, in the
-    // kernel's canonical order; omitted when none declares any.
-    ...(Object.keys(eventSubscriptionRequirements).length > 0
-      ? {
-          eventSubscriptionRequirements: Object.fromEntries(
-            Object.entries(eventSubscriptionRequirements).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The organization sweeps each workload component may hold; omitted when
-    // none declares any.
-    ...(Object.keys(organizationSweepRequirements).length > 0
-      ? {
-          organizationSweepRequirements: Object.fromEntries(
-            Object.entries(organizationSweepRequirements).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The exact audiences each workload component requires; omitted when none
-    // declares any.
-    ...(Object.keys(audienceRequirements).length > 0
-      ? {
-          audienceRequirements: Object.fromEntries(
-            Object.entries(audienceRequirements).sort(([a], [b]) =>
-              compareStrings(a, b),
-            ),
-          ),
-        }
-      : {}),
-    // The audience namespaces this biome owns; omitted when it owns none.
-    ...(ownedAudienceNamespaces.size > 0
-      ? { ownsAudienceNamespaces: [...ownedAudienceNamespaces].sort(compareStrings) }
-      : {}),
-    // The biome's signed dependency contract — DERIVED by the builder from the
-    // SDK seams its code calls, read from the committed generated index and
-    // validated there by the kernel schema. The edge set positive closure
-    // closes over. Omitted when the biome has not adopted one, which is every
-    // committed biome today, so `biome-index.json` stays byte-stable; a
-    // positive-closure edition REFUSES a root or required biome that lacks it.
-    ...(parsedIndex.biome.dependencyContract === undefined
-      ? {}
-      : { dependencyContract: parsedIndex.biome.dependencyContract }),
-    repo,
-    path,
-    requires: requiresUnique,
-    // --- catalog projection ---
-    // Omitted entirely when the biome claims nothing, so the index stays stable
-    // for the overwhelming majority of biomes that own no domain.
-    ...(ownsCapabilityDomains.length > 0 ? { ownsCapabilityDomains } : {}),
-    displayName,
-    packageName,
-    optionalServerBiomes,
-    ...(display ? { display } : {}),
-    ...(systemSurface !== undefined ? { systemSurface } : {}),
-    sourceManifestHash,
-  };
-}
-
-/**
- * Build the full biome index (array of entries) by walking every manifest.
- * Sorted deterministically by (tier order, id, target, repo).
- */
-function buildServiceOwners(entries, platformServiceIndex) {
-  const serviceOwners = new Map();
-  const registerOwner = (serviceName, owner, sourceDescription) => {
-    const existing = serviceOwners.get(serviceName);
-    if (existing !== undefined) {
-      throw new Error(
-        `service "${serviceName}" has ambiguous owners: ${existing.sourceDescription} and ${sourceDescription}`,
-      );
-    }
-    serviceOwners.set(serviceName, { owner, sourceDescription });
-  };
-  for (const entry of entries) {
-    for (const serviceName of entry.services) {
-      registerOwner(
-        serviceName,
-        {
-          kind: 'biome',
-          biomeId: entry.id,
-          target: entry.target,
-          repo: entry.repo,
-          path: entry.path,
-          version: entry.version,
-          sourceManifestHash: entry.sourceManifestHash,
-        },
-        `biome "${entry.id}" (${entry.target}@${entry.repo}/${entry.path})`,
-      );
-    }
-  }
-  for (const source of platformServiceIndex.services) {
-    registerOwner(
-      source.name,
-      { kind: 'platform', source },
-      `platform service (${source.sourceCommit}@${source.repo}/${source.path})`,
-    );
-  }
-  return serviceOwners;
-}
-
-export function resolveServiceDependencyOwners(entries, platformServiceIndex) {
-  const serviceOwners = buildServiceOwners(entries, platformServiceIndex);
-  for (const entry of entries) {
-    const serviceDependencies = [];
-    for (const requirement of entry.serviceRequirements) {
-      for (const requiredService of requirement.requiredServices) {
-        const resolved = serviceOwners.get(requiredService);
-        if (!resolved) {
-          throw new Error(
-            `biome "${entry.id}" API "${requirement.consumerService}" requires unknown service "${requiredService}"`,
-          );
-        }
-        if (
-          resolved.owner.kind === 'biome' &&
-          resolved.owner.target !== 'server'
-        ) {
-          throw new Error(
-            `biome "${entry.id}" API "${requirement.consumerService}" requires service "${requiredService}" ` +
-              `owned by cross-target ${resolved.owner.target} biome "${resolved.owner.biomeId}"`,
-          );
-        }
-        serviceDependencies.push({
-          consumerService: requirement.consumerService,
-          requiredService,
-          owner: resolved.owner,
-        });
-      }
-    }
-    serviceDependencies.sort((a, b) => {
-      const consumer = compareStrings(a.consumerService, b.consumerService);
-      return consumer === 0
-        ? compareStrings(a.requiredService, b.requiredService)
-        : consumer;
-    });
-    entry.serviceDependencies = serviceDependencies;
-    delete entry.serviceRequirements;
-  }
-  return entries;
-}
-
-/**
- * Offline parity guard for the committed index: every recorded edge must still
- * name the one canonical owner identity carried by that same index plus the
- * committed platform-service index.
- */
-export function validateServiceDependencyOwnerParity(
-  entries,
-  platformServiceIndex,
-) {
-  const serviceOwners = buildServiceOwners(entries, platformServiceIndex);
-  for (const entry of entries) {
-    if (!Array.isArray(entry.serviceDependencies)) {
-      throw new Error(
-        `biome "${entry.id}" has no serviceDependencies projection`,
-      );
-    }
-    for (const edge of entry.serviceDependencies) {
-      const canonical = serviceOwners.get(edge.requiredService);
-      if (!canonical) {
-        throw new Error(
-          `biome "${entry.id}" API "${edge.consumerService}" requires unknown service "${edge.requiredService}"`,
-        );
-      }
-      if (
-        canonical.owner.kind === 'biome' &&
-        canonical.owner.target !== 'server'
-      ) {
-        throw new Error(
-          `biome "${entry.id}" API "${edge.consumerService}" requires cross-target service "${edge.requiredService}"`,
-        );
-      }
-      if (serializeJson(edge.owner) !== serializeJson(canonical.owner)) {
-        throw new Error(
-          `biome "${entry.id}" API "${edge.consumerService}" service "${edge.requiredService}" ` +
-            `owner identity does not match ${canonical.sourceDescription}`,
-        );
-      }
-    }
-  }
-  return entries;
-}
-
-/**
- * The adapter host's resolved `@xemahq/contracts` / `@xemahq/biome-sdk` versions, read from its source
- * repository's pnpm-lock.yaml at the pinned commit. An INDEX field only: the distribution lock never carries it.
- */
-function adapterHostPackageVersions(manifest) {
-  const services = (manifest.raw.xema.components ?? []).filter(
-    (component) => component?.kind === 'service' && component.artifact?.kind === 'oci-image',
-  );
-  if (services.length !== 1) {
-    throw new Error(`${manifest.rel}: the adapter host declares ${services.length} oci-image service components; exactly one carries its package`);
-  }
-  const lockfilePath = 'pnpm-lock.yaml';
-  return readHostPackageVersions({
-    lockfileText: manifest.readRepositoryText(lockfilePath),
-    importer: `${manifest.manifestDirectory}/${services[0].artifact.path}`,
-    lockfilePath: `${manifest.repo}/${lockfilePath}`,
-    parseYaml,
-  });
-}
-
-export async function buildBiomeIndex(
-  platformServiceIndex,
-  sourceRepositories = distributionBiomeSourceRepositories(),
-  sourceAuthority,
-) {
-  const authority =
-    sourceAuthority ??
-    createSourceAuthority({
-      knownRepositories: sourceRepositories.map(({ repo }) => repo),
-    });
-  const entries = [];
-  for (const manifest of await committedBiomeManifests(sourceRepositories, authority)) {
-    const entry = await manifestToIndexEntry(manifest);
-    entries.push(
-      entry.id === ADAPTER_HOST_BIOME_ID
-        ? { ...entry, hostPackageVersions: adapterHostPackageVersions(manifest) }
-        : entry,
-    );
-  }
-  resolveServiceDependencyOwners(entries, platformServiceIndex);
-  assertDeclaredDatabasesUnowned(entries);
-  entries.sort(compareIndexEntries);
-  return entries;
-}
-
-/**
- * A declared `serviceDatabases` key must name a database NOTHING else in the
- * platform already answers to.
- *
- * This is the bound on the entitlement. org-database-pool-api hands out the
- * shared cluster's credential for whatever key the caller is entitled to, and
- * the two derived entitlements (biome id, service name minus `-api`) are
- * self-evidently non-transferable because they are derivations of the caller's
- * own verified identity. A DECLARED key is not — it is a free string in a
- * manifest — so the only thing that keeps it from naming `llm-registry` is
- * this check. The pool re-asserts it when it loads the lock; failing here too
- * means a manifest that would strand or hijack a database fails the build
- * instead of the fleet.
- */
-export function assertDeclaredDatabasesUnowned(entries) {
-  const claimedBy = new Map();
-  for (const entry of entries) {
-    claimedBy.set(entry.id, `biome "${entry.id}"`);
-  }
-  for (const entry of entries) {
-    for (const service of entry.services ?? []) {
-      claimedBy.set(service.replace(/-api$/, ''), `service "${service}"`);
-    }
-  }
-  for (const entry of entries) {
-    for (const [service, key] of Object.entries(entry.serviceDatabases ?? {})) {
-      if (key === service.replace(/-api$/, '') || key === entry.id) {
-        // Already reachable by derivation; the declaration widens nothing.
-        continue;
-      }
-      const claimant = claimedBy.get(key);
-      if (claimant !== undefined) {
-        throw new Error(
-          `biome "${entry.id}" declares database "${key}" for service ` +
-            `"${service}", but "${key}" is already the database of ${claimant}. ` +
-            `A declared database must name one no other biome or service owns — ` +
-            `otherwise the declaration hands "${service}" another principal's schema.`,
-        );
-      }
-      claimedBy.set(key, `service "${service}"`);
-    }
-  }
-}
-
-/**
- * Build the `capabilityDomainOwners` reservation table from the FULL biome
- * index — every biome the packaging pipeline discovered, NOT the subset an
- * edition selects.
- *
- * WHY THE FULL INDEX (this is the whole point of the table):
- *
- *   Ownership is a property of the PLATFORM, not of what an edition happens to
- *   preload. If the table were built from the selected set, a trimmed edition
- *   (`appliance-lean`) that ships without `knowledge-base` would
- *   leave `kb` unowned — and an org admin could then install `knowledge-base`
- *   from the store and bind `kb:page.read@1` to a URL they control, silently
- *   shadowing the platform data plane. Being AUTHORED by a first-party biome is
- *   what makes a domain un-shadowable; whether a given edition preloads that
- *   biome is a packaging choice and must never change the security answer.
- *
- *   So every edition gets the IDENTICAL table. A domain is reserved even when
- *   its owning biome is absent from the lock — that is precisely the case the
- *   reservation exists to cover.
- *
- * Sorted by `domain` for deterministic, diffable output.
- *
- * @throws when two biomes claim the same domain. Ambiguous ownership decides
- * whether an org may bind refs under the domain, so it has no safe resolution
- * and must fail the build rather than pick a winner.
- */
-export function buildCapabilityDomainOwners(index) {
-  const owners = new Map();
-  for (const entry of index) {
-    for (const domain of entry.ownsCapabilityDomains ?? []) {
-      const incumbent = owners.get(domain);
-      if (incumbent !== undefined && incumbent !== entry.id) {
-        throw new Error(
-          `capability domain "${domain}" is claimed by BOTH biome "${incumbent}" and biome "${entry.id}". ` +
-            `A domain has exactly one owner — ownership decides whether an org may bind refs in it, ` +
-            `so an ambiguous claim is refused.`,
-        );
-      }
-      owners.set(domain, entry.id);
-    }
-  }
-  return [...owners.entries()]
-    .map(([domain, biomeId]) => ({ domain, biomeId }))
-    .sort((a, b) => compareStrings(a.domain, b.domain));
-}
-
-/**
- * The audience-namespace ownership table of the lock: namespace -> owning
- * biome, from every index entry's `ownsAudienceNamespaces`, like
- * {@link buildCapabilityDomainOwners} (the whole index, so a trimmed edition
- * names an unserved owner rather than an unowned audience). One row per
- * (namespace, biome): an entry repeated for one biome id (server and web
- * targets) adds nothing. Sorted by namespace.
- *
- * @throws when two biomes claim the same namespace.
- */
-export function buildAudienceNamespaceOwners(index) {
-  const owners = new Map();
-  for (const entry of index) {
-    for (const namespace of entry.ownsAudienceNamespaces ?? []) {
-      const incumbent = owners.get(namespace);
-      if (incumbent !== undefined && incumbent !== entry.id) {
-        throw new Error(
-          `audience namespace "${namespace}" is claimed by BOTH biome "${incumbent}" and biome "${entry.id}". ` +
-            'A namespace has exactly one owner, so an ambiguous claim is refused.',
-        );
-      }
-      owners.set(namespace, entry.id);
-    }
-  }
-  return [...owners.entries()]
-    .map(([namespace, biomeId]) => ({ namespace, biomeId }))
-    .sort((a, b) => compareStrings(a.namespace, b.namespace));
-}
-
-/** Deterministic ordering used for both the index and the lock. */
-export function compareIndexEntries(a, b) {
-  const order = biomeTierOrder();
-  const ta = order.indexOf(a.tier);
-  const tb = order.indexOf(b.tier);
-  if (ta !== tb) {return ta - tb;}
-  if (a.id !== b.id) {return a.id < b.id ? -1 : 1;}
-  if (a.target !== b.target) {return a.target < b.target ? -1 : 1;}
-  if (a.repo !== b.repo) {return a.repo < b.repo ? -1 : 1;}
-  return 0;
-}
-
-/** Stable JSON serialization (pretty, trailing newline) for committed files. */
-export function serializeJson(value) {
-  return `${JSON.stringify(value, null, 2)}\n`;
-}
-
-/**
- * Shared generated-artifact currency gate. Callers supply canonical serialized
- * bytes; any authority change must make a previously committed projection fail.
- */
-export function assertGeneratedArtifactCurrent(
-  label,
-  committed,
-  generated,
-  regenerateCommand,
-) {
-  if (committed !== generated) {
-    throw new Error(
-      `${label} is out of date. Run \`${regenerateCommand}\`.`,
-    );
-  }
-}
-
-/** sha256 hex of a string. */
-export function sha256Hex(input) {
-  return createHash('sha256').update(input).digest('hex');
-}
-
-const EXACT_SEMVER_PATTERN =
-  /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+(?:[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-const IMAGE_REPOSITORY_SEGMENT_PATTERN =
-  /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;
-const MAX_REGISTRY_HOST_LENGTH = 253;
-const MAX_DNS_LABEL_LENGTH = 63;
-const MAX_REPOSITORY_PATH_LENGTH = 255;
-
-function isCanonicalRegistryPort(port) {
-  if (port === undefined) {return true;}
-  if (!/^[0-9]+$/.test(port)) {return false;}
-  const numericPort = Number(port);
-  return numericPort >= 1 && numericPort <= 65535;
-}
-
-function isCanonicalDnsHost(host) {
-  if (
-    host.length === 0 ||
-    host.length > MAX_REGISTRY_HOST_LENGTH ||
-    host !== host.toLowerCase() ||
-    host.endsWith('.')
-  ) {
-    return false;
-  }
-  if (/^[0-9.]+$/.test(host)) {return isIP(host) === 4;}
-  const labels = host.split('.');
-  return labels.every(
-    (label) =>
-      label.length >= 1 &&
-      label.length <= MAX_DNS_LABEL_LENGTH &&
-      /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),
-  );
-}
-
-export function isCanonicalRegistryAuthority(authority) {
-  if (authority.startsWith('[')) {
-    const closingBracket = authority.indexOf(']');
-    if (closingBracket < 0) {return false;}
-    const address = authority.slice(1, closingBracket);
-    const suffix = authority.slice(closingBracket + 1);
-    if (
-      address.length === 0 ||
-      address !== address.toLowerCase() ||
-      isIP(address) !== 6
-    ) {
-      return false;
-    }
-    if (suffix.length === 0) {return true;}
-    return suffix.startsWith(':') && isCanonicalRegistryPort(suffix.slice(1));
-  }
-
-  const firstColon = authority.indexOf(':');
-  const lastColon = authority.lastIndexOf(':');
-  if (firstColon !== lastColon) {return false;}
-  const host = lastColon < 0 ? authority : authority.slice(0, lastColon);
-  const port = lastColon < 0 ? undefined : authority.slice(lastColon + 1);
-  return isCanonicalDnsHost(host) && isCanonicalRegistryPort(port);
-}
-
-function isUntaggedImageRepository(imageRef) {
-  if (
-    typeof imageRef !== 'string' ||
-    imageRef.length === 0 ||
-    imageRef.trim() !== imageRef ||
-    imageRef.includes('@') ||
-    imageRef.includes('://') ||
-    imageRef.includes('//') ||
-    imageRef.endsWith('/')
-  ) {
-    return false;
-  }
-  const [authority, ...segments] = imageRef.split('/');
-  const repositoryPath = segments.join('/');
-  if (
-    segments.length === 0 ||
-    repositoryPath.length > MAX_REPOSITORY_PATH_LENGTH ||
-    !isCanonicalRegistryAuthority(authority) ||
-    segments.some(
-      (segment) =>
-        segment.includes(':') ||
-        !IMAGE_REPOSITORY_SEGMENT_PATTERN.test(segment),
-    )
-  ) {
-    return false;
-  }
-  return true;
-}
-
-export const IMAGE_PRODUCER_EVIDENCE_PREREQUISITE =
-  'a complete authorized signed image-producer evidence set that binds the ' +
-  'exact distribution inputHash, source repository commit, sourceManifestHash, ' +
-  'source-tree contentHash, image repository, OCI manifest digest, complete ' +
-  'platform set, SBOM, provenance, distribution release, and customer entitlement';
-
-/**
- * Enforce the immutable fields carried by the existing DistributionLock
- * schema. The kernel schema owns the shape; this packaging-plane guard owns
- * the stronger provenance invariant: a resolved lock may contain only exact
- * versions and full sha256 source-manifest identities.
- */
-export function validateImmutableBiomeIndex(index) {
-  for (const biome of index) {
-    if (!EXACT_SEMVER_PATTERN.test(biome.version)) {
-      throw new Error(
-        `biome "${biome.id}" has mutable or invalid ` +
-          `version "${biome.version}" — resolved locks require an exact semantic version`,
-      );
-    }
-    if (!SHA256_HEX_PATTERN.test(biome.sourceManifestHash)) {
-      throw new Error(
-        `biome "${biome.id}" has invalid ` +
-          `sourceManifestHash "${String(biome.sourceManifestHash)}" — expected 64 lowercase sha256 hex characters`,
-      );
-    }
-    const services = new Set();
-    for (const service of biome.services ?? []) {
-      if (services.has(service)) {
-        throw new Error(
-          `biome "${biome.id}" owns duplicate service "${service}"`,
-        );
-      }
-      services.add(service);
-    }
-    // Runtime components are built/signed/mirrored like services but never
-    // rostered. They must be a disjoint set from `services` — a name in both
-    // would be simultaneously scheduled and unschedulable.
-    const runtimeComponents = new Set();
-    for (const component of biome.runtimeComponents ?? []) {
-      if (runtimeComponents.has(component)) {
-        throw new Error(
-          `biome "${biome.id}" owns duplicate runtime component "${component}"`,
-        );
-      }
-      if (services.has(component)) {
-        throw new Error(
-          `biome "${biome.id}" declares "${component}" both as a service and as a ` +
-            `runtime component — an image is either scheduled or it is not`,
-        );
-      }
-      runtimeComponents.add(component);
-    }
-    for (const [key, image] of Object.entries(biome.runtimeComponentKeys ?? {})) {
-      if (!runtimeComponents.has(image)) {
-        throw new Error(
-          `biome "${biome.id}" keys runtime component "${key}" to "${String(image)}", which is not one of its runtime components`,
-        );
-      }
-    }
-    const dispatched = new Set();
-    for (const edge of biome.dispatchesRuntimeComponents ?? []) {
-      const edgeKey = dispatchedEdgeIdentity(projectDispatchedTarget(biome.id, edge));
-      if (dispatched.has(edgeKey)) {
-        throw new Error(
-          isSupplementalEdge(edge)
-            ? `biome "${biome.id}" dispatches ${edgeKey} more than once`
-            : `biome "${biome.id}" dispatches runtime component "${edge.componentKey}" of biome "${edge.biomeId}" more than once`,
-        );
-      }
-      dispatched.add(edgeKey);
-    }
-    const edges = new Set();
-    for (const edge of biome.serviceDependencies ?? []) {
-      if (!services.has(edge.consumerService)) {
-        throw new Error(
-          `biome "${biome.id}" service dependency names unknown consumer API "${edge.consumerService}"`,
-        );
-      }
-      const edgeKey = `${edge.consumerService}\0${edge.requiredService}`;
-      if (edges.has(edgeKey)) {
-        throw new Error(
-          `biome "${biome.id}" has duplicate service dependency ${edge.consumerService} -> ${edge.requiredService}`,
-        );
-      }
-      edges.add(edgeKey);
-      if (edge.owner?.kind === 'biome') {
-        if (edge.owner.target !== 'server') {
-          throw new Error(
-            `biome "${biome.id}" service dependency ${edge.consumerService} -> ${edge.requiredService} ` +
-              `has cross-target ${String(edge.owner.target)} owner`,
-          );
-        }
-        if (!EXACT_SEMVER_PATTERN.test(edge.owner.version)) {
-          throw new Error(
-            `biome "${biome.id}" service dependency owner "${edge.owner.biomeId}" has invalid exact version`,
-          );
-        }
-        if (!SHA256_HEX_PATTERN.test(edge.owner.sourceManifestHash)) {
-          throw new Error(
-            `biome "${biome.id}" service dependency owner "${edge.owner.biomeId}" has invalid sourceManifestHash`,
-          );
-        }
-      } else if (edge.owner?.kind === 'platform') {
-        if (edge.owner.source?.name !== edge.requiredService) {
-          throw new Error(
-            `biome "${biome.id}" service dependency ${edge.consumerService} -> ${edge.requiredService} ` +
-              `has mismatched platform owner "${String(edge.owner.source?.name)}"`,
-          );
-        }
-      } else {
-        throw new Error(
-          `biome "${biome.id}" service dependency ${edge.consumerService} -> ${edge.requiredService} has no recognized owner`,
-        );
-      }
-    }
-  }
-  return index;
-}
-
-/**
- * Whether a raw distribution lock DECLARES the unsealed shape (carries
- * `unsealedSchema`). Dispatch is on the declared shape only, never on a parse
- * failure: a sealed (schemaVersion 5) lock that is incomplete stays sealed and
- * is refused by the sealed parsers.
- */
-export function isUnsealedDistributionLock(raw) {
-  return raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw;
-}
-
-/**
- * The distribution lock as the resolve pipeline reads it: the UNSEALED
- * document a resolve just wrote, or the SEALED v5 lock a prior seal committed.
- * Both carry the same body; the kernel's two parsers each refuse the other
- * shape, so this dispatches on the document's own marker and never guesses.
- * A pre-v5 lock is refused by the kernel (`unsupported-schema-version`).
- */
-export function parseResolvedDistributionLock(schemas, raw) {
-  return isUnsealedDistributionLock(raw)
-    ? schemas.parseUnsealedDistributionLock(raw)
-    : schemas.parseDistributionLockForReading(raw);
-}
-
-/**
- * The text two distribution locks are compared by: the UNSEALED projection of
- * each, with the resolve timestamp removed. A committed lock is sealed (v5) and
- * a fresh resolve is unsealed; the kernel's `unsealedProjection` maps the first
- * onto the shape of the second (its key order is stable, so the comparison is
- * byte for byte). Anything that is not one of the two v5 shapes is refused by
- * the kernel's parsers, a pre-v5 lock with `unsupported-schema-version`.
- */
-export function comparableDistributionLock(schemas, raw) {
-  const unsealed = schemas.parseUnsealedDistributionLock(
-    isUnsealedDistributionLock(raw)
-      ? raw
-      : schemas.unsealedProjection(schemas.parseDistributionLock(raw)),
-  );
-  const { resolvedAt: _resolvedAt, ...rest } = unsealed;
-  return serializeJson(rest);
-}
-
-export function validateImmutableDistributionLock(lock) {
-  if (!SHA256_HEX_PATTERN.test(lock.inputHash)) {
-    throw new Error(
-      `distribution "${lock.distributionId}" has invalid inputHash "${String(lock.inputHash)}" — ` +
-        'expected 64 lowercase sha256 hex characters',
-    );
-  }
-  try {
-    validateImmutableBiomeIndex(lock.biomes ?? []);
-  } catch (error) {
-    throw new Error(`distribution "${lock.distributionId}": ${error.message}`, {
-      cause: error,
-    });
-  }
-  return lock;
-}
-
-/**
- * Enforce source-addressed image identities after canonical ImageLock parsing.
- * `imageRef` is deliberately an untagged repository; the immutable build tag
- * is the exact sha256 `contentHash` under the lock's explicit hash algorithm.
- */
-export function validateImmutableImageLock(lock, schemas) {
-  if (!schemas) {
-    throw new Error('trusted kernel distribution schemas are required');
-  }
-  assertKernelSealsComposedMembership(schemas, lock.subjects, `distribution "${lock.distributionId}"`);
-  // The revisions the loaded kernel reads (`ImageLockSchemaVersion`).
-  const readableVersions =
-    schemas.ImageLockSchemaVersion === undefined
-      ? [PRE_V14_IMAGE_LOCK_SCHEMA_VERSION]
-      : Object.values(schemas.ImageLockSchemaVersion).filter((version) => Number.isInteger(version));
-  if (
-    !readableVersions.includes(lock.schemaVersion) ||
-    lock.sourceHashAlgorithm !== schemas.ImageSourceHashAlgorithm.ImageInputV2
-  ) {
-    throw new Error(
-      `distribution "${lock.distributionId}" has incompatible image-lock schema ${String(lock.schemaVersion)} ` +
-        `and sourceHashAlgorithm "${String(lock.sourceHashAlgorithm)}"`,
-    );
-  }
-  const identities = new Set();
-  const namedSubjects = new Set();
-  for (const subject of lock.subjects ?? []) {
-    namedSubjects.add(`${subject.kind}:${subject.id}`);
-    const identity = imageSubjectIdentity(subject);
-    if (identities.has(identity)) {
-      throw new Error(
-        `distribution "${lock.distributionId}" has duplicate runtime image subject "${identity}"`,
-      );
-    }
-    identities.add(identity);
-    if (!isUntaggedImageRepository(subject.imageRef)) {
-      throw new Error(
-        `distribution "${lock.distributionId}": runtime subject "${subject.kind}:${subject.id}" has mutable or invalid ` +
-          `imageRef "${subject.imageRef}" — expected an untagged image repository`,
-      );
-    }
-    if (!SHA256_HEX_PATTERN.test(subject.contentHash)) {
-      throw new Error(
-        `distribution "${lock.distributionId}": runtime subject "${subject.kind}:${subject.id}" has invalid ` +
-          `contentHash "${String(subject.contentHash)}" — expected 64 lowercase sha256 hex characters`,
-      );
-    }
-    const owners = new Set();
-    for (const owner of subject.owners ?? []) {
-      const key = serializeJson(owner);
-      if (owners.has(key)) {
-        throw new Error(
-          `distribution "${lock.distributionId}": runtime subject "${subject.kind}:${subject.id}" has a duplicate owner`,
-        );
-      }
-      owners.add(key);
-    }
-  }
-  const platformServices = new Set();
-  for (const binding of lock.platformServiceBindings ?? []) {
-    if (platformServices.has(binding.platformService)) {
-      throw new Error(
-        `distribution "${lock.distributionId}" has duplicate runtime image binding for platform service "${binding.platformService}"`,
-      );
-    }
-    platformServices.add(binding.platformService);
-    if (!namedSubjects.has(`${binding.subjectKind}:${binding.subjectId}`)) {
-      throw new Error(
-        `distribution "${lock.distributionId}": platform service "${binding.platformService}" binds unknown runtime subject "${binding.subjectKind}:${binding.subjectId}"`,
-      );
-    }
-  }
-  return lock;
-}
-
-/**
- * Assert that an exact 40-hex commit exists in a source repository. Delegates
- * to `@xemahq/distribution-source-hash` — the tooling holds no second copy of
- * the Git-object reader the content hash is built on.
- */
-export function assertGitCommitExists(repoDir, commit) {
-  return distributionSourceHash().assertGitCommitExists(repoDir, commit);
-}
-
-/** Split the NUL-delimited output of a `-z` Git plumbing command. */
-function decodeNullDelimitedGitRecords(raw, context) {
-  return distributionSourceHash().decodeNullDelimitedGitRecords(raw, context);
-}
-
-/**
- * Hash the immutable tree of an exact Git commit — a distribution image
- * subject's `contentHash`, and therefore its published image tag.
- */
-export function hashGitSourceTree(
-  repoDir,
-  repoRelativeSourcePath,
-  commit,
-  algorithm,
-) {
-  return distributionSourceHash().hashGitSourceTree(
-    repoDir,
-    repoRelativeSourcePath,
-    commit,
-    algorithm,
-  );
-}
-
-/**
- * Every workspace package in a repository at an exact commit, keyed by name.
- *
- * Delegates to `@xemahq/distribution-source-hash`. The tooling holds no second
- * copy of the workspace-graph reader: it is derived by walking the commit's
- * tree for `package.json` files rather than by expanding `pnpm-workspace.yaml`
- * globs, and a hand-rolled YAML parser on the critical path of a release
- * coordinate is exactly what that package exists to avoid.
- */
-export function workspacePackagesAtCommit(repoDir, commit, tree) {
-  return distributionSourceHash().workspacePackagesAtCommit(repoDir, commit, tree);
-}
-
-/**
- * The path index of one commit's tree — the input `workspacePackagesAtCommit`
- * scans for `package.json` files.
- *
- * Exposed so a caller can build it ONCE per repository and reuse it across
- * every biome in that repository. Building it per biome would re-read the whole
- * tree 123 times for one index.
- */
-export function gitCommitTreeIndex(repoDir, commit) {
-  return distributionSourceHash().GitCommitTreeIndex.atCommit(repoDir, commit);
-}
-
-/**
- * The transitive workspace-package closure of one package directory, EXCLUDING
- * the root — the root is hashed separately as its own source tree, so
- * including it would frame one digest twice.
- *
- * Returns `[]` for a directory that is not a workspace member at all. For a
- * BIOME that is the correct answer and not a gap: a biome with no
- * `package.json` runs no build, so nothing outside its directory can change its
- * bundle's bytes. `check-biome-bundle-closure-derivable` pins the premise that
- * makes that true — a biome shipping BUILT OUTPUT always has a manifest.
- */
-export function workspaceClosure(rootDirectory, graph, commit) {
-  return distributionSourceHash().workspaceClosure(rootDirectory, graph, commit);
-}
-
-/**
- * Length-framed hash update — the same framing the image content hash uses.
- *
- * Framing is not decoration: without it, two different component lists can
- * concatenate to identical bytes and collide onto one coordinate. Delegated
- * rather than re-implemented for that reason.
- */
-export function updateFramedHash(hash, field, value) {
-  return distributionSourceHash().updateFramedHash(hash, field, value);
-}
-
-/**
- * Hash the FULL build-input closure of one service image — the subject's
- * `contentHash`, and therefore its published image tag.
- *
- * Delegates to `@xemahq/distribution-source-hash`, which is the same code every
- * producing repository's CI runs to derive the tag it pushes. The tooling holds
- * no second copy: a divergence would resolve a lock whose images sit at a
- * coordinate nothing published.
- */
-export function hashImageBuildInputs(request, algorithm) {
-  return distributionSourceHash().hashImageBuildInputs(request, algorithm);
-}
-