@cejel/cejel 0.6.6 → 0.6.8

package/dist/{chunk-BG4ZRBQ5.js → chunk-KNTBED5T.js}

@@ -5,19 +5,19 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-JNTTFAHQ.js";
+} from "./chunk-KJVFCZZ3.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/dist/{chunk-VGBFZBZQ.js → chunk-NIWSYJ6N.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-5PFYOIOS.js → chunk-WXPGEQBE.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-VGBFZBZQ.js";
+} from "./chunk-NIWSYJ6N.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/index.js

@@ -3,10 +3,11 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-BG4ZRBQ5.js";
+} from "./chunk-KNTBED5T.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
+  EXTERNAL_FINDINGS_DISPLAY_LIMIT,
   PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
@@ -15,6 +16,8 @@ import {
   buildVerdictExplanation,
   computeApplicableMeasuredCoverage,
   createWitanAttestation,
+  describeInputBindingRecord,
+  describeScannedSubject,
   formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
@@ -22,27 +25,33 @@ import {
   formatDimensionsMeasuredSentence,
   formatExternalSourceLine,
   formatLowConfidenceSentence,
+  importedAdjustmentSentence,
+  inheritedFindingNote,
+  inputBindingHeadline,
   isProspectiveRubricVersion,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
+  resolveIngestFilePath,
   runCejelScan,
   serializeWitanReport,
+  stripTerminalControls,
+  verifyRecordedInputDigests,
   verifyWitanAttestationBinding
-} from "./chunk-JNTTFAHQ.js";
-import "./chunk-VGBFZBZQ.js";
+} from "./chunk-KJVFCZZ3.js";
+import "./chunk-NIWSYJ6N.js";
 import {
   external_exports
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/index.ts
 init_esm_shims();
 import { createHash as createHash3 } from "crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
-import { dirname, join, resolve as resolve2 } from "path";
+import { existsSync, readFileSync, realpathSync } from "fs";
+import { dirname, join as join2, resolve as resolve3 } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
 // src/issuance/index.ts
@@ -578,6 +587,68 @@ function resolvedToLocalTree(env, cwd) {
   return first !== void 0 && first === resolve(cwd, "node_modules", ".bin");
 }
 
+// src/output-files.ts
+init_esm_shims();
+import { closeSync, constants, lstatSync, mkdirSync, openSync, writeFileSync } from "fs";
+import { join, resolve as resolve2 } from "path";
+var O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+function isSymbolicLink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function refusal(what, subject) {
+  return new Error(
+    `Cejel: refusing to write ${what}: ${subject} is a symbolic link. Nothing was written; remove the link or choose another output path.`
+  );
+}
+function refuseSymlinkedDirectory(dir, what) {
+  if (isSymbolicLink(resolve2(dir))) throw refusal(what, `output directory ${dir}`);
+}
+function refuseSymlinkedFile(path, what) {
+  if (isSymbolicLink(resolve2(path))) throw refusal(what, path);
+}
+function refuseSymlinkedOutputs(dir, names, what) {
+  refuseSymlinkedDirectory(dir, what);
+  for (const name of names) refuseSymlinkedFile(join(dir, name), what);
+}
+function writeOutputFileNoFollow(path, contents, what) {
+  let fd;
+  try {
+    fd = openSync(
+      path,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | O_NOFOLLOW,
+      438
+    );
+  } catch (error) {
+    if (error.code === "ELOOP") {
+      throw new Error(
+        `Cejel: refusing to write ${what}: ${path} is a symbolic link (the open was refused without following it).`
+      );
+    }
+    throw error;
+  }
+  try {
+    writeFileSync(fd, contents, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function writeOutputFile(path, contents, what) {
+  refuseSymlinkedFile(path, what);
+  writeOutputFileNoFollow(path, contents, what);
+}
+function writeOutputFiles(dir, files, what) {
+  const names = files.map((file) => file.name);
+  refuseSymlinkedOutputs(dir, names, what);
+  mkdirSync(dir, { recursive: true });
+  refuseSymlinkedDirectory(dir, what);
+  for (const file of files) writeOutputFileNoFollow(join(dir, file.name), file.contents, what);
+}
+
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
@@ -601,9 +672,6 @@ function renderMinScoreCoverageFailure(coverage, minScore) {
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because fewer than half of the applicable dimensions were measured in at least one score (${formatCoverageSummary(coverage)}). Resolve the reported evidence gaps and re-scan.
 `;
 }
-function stripTerminalControls(text) {
-  return text.replace(/[\t\n]/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
-}
 function renderTerminalCertificate(summary, report) {
   const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
@@ -634,7 +702,7 @@ function renderTerminalCertificate(summary, report) {
       `Scope: ${relyingPartySummary.scope}`,
       `What was examined: ${stripTerminalControls(relyingPartySummary.examined)}`,
       `What was established: ${relyingPartySummary.established}`,
-      `What was not established: ${relyingPartySummary.notEstablished}`,
+      `What was not established: ${stripTerminalControls(relyingPartySummary.notEstablished)}`,
       `What to do next: ${relyingPartySummary.next}`,
       ""
     );
@@ -657,7 +725,7 @@ function renderTerminalCertificate(summary, report) {
     const reads = summary.contentReadSummary;
     const errnoCounts = Object.entries(reads.unreadableByErrno).map(([errno, count]) => `${errno}: ${count}`).join(", ");
     lines.push(
-      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}).`
+      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}${reads.byReason.lfsPointer ? `; Git LFS pointer: ${reads.byReason.lfsPointer}` : ""}).`
     );
     if (reads.affectedCriteria.length > 0) {
       lines.push(
@@ -675,6 +743,20 @@ function renderTerminalCertificate(summary, report) {
     }
     lines.push("");
   }
+  if (report?.inputBinding) {
+    lines.push(stripTerminalControls(inputBindingHeadline(report.inputBinding)));
+    lines.push(`  ${stripTerminalControls(describeScannedSubject(report.inputBinding))}`);
+    for (const input of report.inputBinding.inputs.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT)) {
+      lines.push(`  ${stripTerminalControls(describeInputBindingRecord(input))}`);
+    }
+    const remaining = report.inputBinding.inputs.length - EXTERNAL_FINDINGS_DISPLAY_LIMIT;
+    if (remaining > 0) lines.push(`  ...and ${remaining} more \u2014 see report.json inputBinding.`);
+    for (const criterion of report.criteria) {
+      const sentence = importedAdjustmentSentence(criterion);
+      if (sentence) lines.push(`  ${criterion.id}: ${sentence}`);
+    }
+    lines.push("");
+  }
   const measurements = report?.criteria.flatMap(
     (criterion) => criterion.metrics.map((metric) => ({
       criterionId: criterion.id,
@@ -687,7 +769,7 @@ function renderTerminalCertificate(summary, report) {
     lines.push("Measurements:");
     for (const measurement of measurements ?? []) {
       lines.push(
-        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${measurement.value} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
+        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${stripTerminalControls(measurement.value)} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
       );
     }
     lines.push("");
@@ -721,6 +803,8 @@ function renderTerminalCertificate(summary, report) {
       lines.push(
         `  [${finding.severity}] ${stripTerminalControls(finding.label)} \u2192 ${finding.dimension}: ${stripTerminalControls(finding.ruleId)} \u2014 ${stripTerminalControls(finding.message)}${finding.location ? ` (${stripTerminalControls(finding.location)})` : ""}`
       );
+      const note = inheritedFindingNote(finding.ruleId);
+      if (note) lines.push(`    Note: ${note}`);
     }
     const remaining = summary.externalFindingCount - summary.topExternalFindings.length;
     if (remaining > 0) {
@@ -744,6 +828,15 @@ function formatScore(score) {
 
 // src/index.ts
 var DEFAULT_OUT_DIR = ".cejel";
+var SCAN_OUTPUT_FILES = [
+  "report.json",
+  "attestation.json",
+  "certificate.html",
+  "badge.json",
+  "badge.svg",
+  "summary.json"
+];
+var ISSUANCE_OUTPUT_FILE = "issuance.json";
 var ISSUER_SIGNERS_FILE = "issuer-signers";
 var ISSUER_REVOCATIONS_FILE = "issuer-revocations";
 var SECURITY_FILE_CANDIDATES = ["../docs/security/", "../../docs/security/"];
@@ -790,6 +883,17 @@ var CLI_FLAG_SPECS = [
     description: "fold in a SARIF/JSON scanner report (repeatable)",
     kind: "ingest"
   },
+  {
+    tokens: ["--subject-repository"],
+    value: "<repo>",
+    description: "name this repository (e.g. github.com/owner/repo) so ingested inputs declaring another repository are recorded as mismatched",
+    kind: "subjectRepository"
+  },
+  {
+    tokens: ["--strict-ingest"],
+    description: "refuse ingested inputs for another repository or commit, observed before this commit, or duplicated (default: record only)",
+    kind: "strictIngest"
+  },
   {
     tokens: ["--rubric-pin"],
     value: "<version>",
@@ -882,6 +986,8 @@ ${usageOptions}
 Verify options:
   --signers <file>       use this allowed-signers file instead of the published one
   --revocations <file>   use this revocations file instead of the published one
+  --input <file>         an ingested input (repeatable); fails unless the supplied set of files
+                         has exactly the sha256 digests report.json records in inputBinding
 
 Issue options:
   --report <file>        the report.json being countersigned (required)
@@ -893,6 +999,7 @@ Issue options:
   --name <display>       pass exactly what the original scan used, or the bytes will not reproduce
   --rubric-pin <version> pass exactly what the original scan used, or the bytes will not reproduce
   --ingest <file>        pass exactly what the original scan used, or the bytes will not reproduce
+                         (--strict-ingest and --subject-repository are read from report.json's inputBinding)
 
 cejel never signs and never reads private key material.
 
@@ -956,6 +1063,7 @@ async function runWitanCli(args, rubricVersion) {
     return 0;
   }
   const effectiveRubricVersion = options.rubricPin ?? rubricVersion;
+  refuseSymlinkedOutputs(options.outDir, SCAN_OUTPUT_FILES, "scan output");
   const { report, summary, generatedAt } = runCejelScan({
     repoPath: options.repoPath,
     ...options.productName ? { productName: options.productName } : {},
@@ -963,6 +1071,8 @@ async function runWitanCli(args, rubricVersion) {
     ...effectiveRubricVersion ? { rubricVersion: effectiveRubricVersion } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet,
+    ...options.strictIngest ? { strictIngest: true } : {},
+    ...options.subjectRepository ? { subjectRepository: options.subjectRepository } : {},
     toolVersion: cliVersion()
   });
   const attestation = createWitanAttestation(report, {
@@ -970,29 +1080,25 @@ async function runWitanCli(args, rubricVersion) {
     generatedAt,
     ...options.runAttempt ? { githubRunAttempt: options.runAttempt } : {}
   });
-  mkdirSync(options.outDir, { recursive: true });
-  writeFileSync(join(options.outDir, "report.json"), serializeWitanReport(report), "utf8");
-  writeFileSync(
-    join(options.outDir, "attestation.json"),
-    JSON.stringify(attestation, null, 2),
-    "utf8"
-  );
-  writeFileSync(
-    join(options.outDir, "certificate.html"),
-    renderWitanHtmlReport(report, {
-      cliVersion: cliVersion(),
-      generatedAt,
-      ...options.runAttempt ? { runAttempt: options.runAttempt } : {}
-    }),
-    "utf8"
-  );
-  writeFileSync(
-    join(options.outDir, "badge.json"),
-    JSON.stringify(renderWitanBadgeEndpoint(report), null, 2),
-    "utf8"
+  writeOutputFiles(
+    options.outDir,
+    [
+      { name: "report.json", contents: serializeWitanReport(report) },
+      { name: "attestation.json", contents: JSON.stringify(attestation, null, 2) },
+      {
+        name: "certificate.html",
+        contents: renderWitanHtmlReport(report, {
+          cliVersion: cliVersion(),
+          generatedAt,
+          ...options.runAttempt ? { runAttempt: options.runAttempt } : {}
+        })
+      },
+      { name: "badge.json", contents: JSON.stringify(renderWitanBadgeEndpoint(report), null, 2) },
+      { name: "badge.svg", contents: renderWitanBadgeSvg(report) },
+      { name: "summary.json", contents: JSON.stringify(summary, null, 2) }
+    ],
+    "scan output"
   );
-  writeFileSync(join(options.outDir, "badge.svg"), renderWitanBadgeSvg(report), "utf8");
-  writeFileSync(join(options.outDir, "summary.json"), JSON.stringify(summary, null, 2), "utf8");
   if (!options.quiet) {
     process.stdout.write(renderTerminalCertificate(summary, report));
     process.stdout.write(
@@ -1102,8 +1208,8 @@ function parseExportArgs(args) {
   return {
     command: "export",
     format,
-    reportPath: resolve2(reportPath),
-    outPath: resolve2(outPath)
+    reportPath: resolve3(reportPath),
+    outPath: resolve3(outPath)
   };
 }
 function runExport(invocation) {
@@ -1121,24 +1227,36 @@ ${members.map((member) => `  - ${member}`).join("\n")}
     return 1;
   }
   const result = exportGitLabCodeQuality(reportResult.data);
-  writeFileSync(invocation.outPath, `${JSON.stringify(result.entries, null, 2)}
-`, "utf8");
+  writeOutputFile(
+    invocation.outPath,
+    `${JSON.stringify(result.entries, null, 2)}
+`,
+    "export output"
+  );
   process.stderr.write(renderGitLabCodeQualityFooter(result));
   return 0;
 }
-var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>]`;
+var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>] [--input <file>...]`;
 function parseVerifyArgs(args) {
   const positionals = [];
   let signersPath;
   let revocationsPath;
+  const inputPaths = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === void 0) continue;
+    if (arg === "--input") {
+      const value = args[index + 1];
+      if (!value) throw new Error(`Missing value for ${arg}`);
+      inputPaths.push(resolve3(value));
+      index += 1;
+      continue;
+    }
     if (arg === "--signers" || arg === "--revocations") {
       const value = args[index + 1];
       if (!value) throw new Error(`Missing value for ${arg}`);
-      if (arg === "--signers") signersPath = resolve2(value);
-      else revocationsPath = resolve2(value);
+      if (arg === "--signers") signersPath = resolve3(value);
+      else revocationsPath = resolve3(value);
       index += 1;
       continue;
     }
@@ -1150,12 +1268,13 @@ function parseVerifyArgs(args) {
   if (!reportPath || !attestationPath) throw new Error(VERIFY_USAGE());
   return {
     command: "verify",
-    reportPath: resolve2(reportPath),
-    attestationPath: resolve2(attestationPath),
-    ...issuancePath ? { issuancePath: resolve2(issuancePath) } : {},
-    ...issuanceSignaturePath ? { issuanceSignaturePath: resolve2(issuanceSignaturePath) } : {},
+    reportPath: resolve3(reportPath),
+    attestationPath: resolve3(attestationPath),
+    ...issuancePath ? { issuancePath: resolve3(issuancePath) } : {},
+    ...issuanceSignaturePath ? { issuanceSignaturePath: resolve3(issuanceSignaturePath) } : {},
     ...signersPath ? { signersPath } : {},
-    ...revocationsPath ? { revocationsPath } : {}
+    ...revocationsPath ? { revocationsPath } : {},
+    ...inputPaths.length > 0 ? { inputPaths } : {}
   };
 }
 function parseIssueArgs(args) {
@@ -1179,15 +1298,15 @@ function parseIssueArgs(args) {
     if (arg === void 0) continue;
     switch (arg) {
       case "--report":
-        reportPath = resolve2(takeValue(arg, index + 1));
+        reportPath = resolve3(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--attestation":
-        attestationPath = resolve2(takeValue(arg, index + 1));
+        attestationPath = resolve3(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--key":
-        keyPath = resolve2(takeValue(arg, index + 1));
+        keyPath = resolve3(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--engagement-ref":
@@ -1196,7 +1315,7 @@ function parseIssueArgs(args) {
         continue;
       case "--out":
       case "--out-dir":
-        outDir = resolve2(takeValue(arg, index + 1));
+        outDir = resolve3(takeValue(arg, index + 1));
         index += 1;
         continue;
       case "--product-name":
@@ -1240,7 +1359,7 @@ function parseIssueArgs(args) {
     throw new Error("--product-name and --name cannot be used together");
   }
   return {
-    repoPath: resolve2(repoPath ?? "."),
+    repoPath: resolve3(repoPath ?? "."),
     reportPath,
     attestationPath,
     keyPath,
@@ -1280,6 +1399,26 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
     return 1;
   }
   process.stdout.write("Cejel: report/attestation binding verified.\n");
+  if (invocation.inputPaths) {
+    let inputCheck;
+    try {
+      inputCheck = verifyRecordedInputDigests(
+        reportResult.data,
+        invocation.inputPaths,
+        (path) => readFileSync(resolveIngestFilePath(path))
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `Cejel: input digests not verified \u2014 ${stripTerminalControls(message.replace(/^Cejel: /, ""))}
+`
+      );
+      return 1;
+    }
+    for (const line of inputCheck.lines) process.stdout.write(`${stripTerminalControls(line)}
+`);
+    if (!inputCheck.valid) return 1;
+  }
   if (!invocation.issuancePath || !invocation.issuanceSignaturePath) {
     process.stdout.write("Cejel: signature and signer identity were not verified.\n");
     return 0;
@@ -1410,6 +1549,7 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     throw new Error(`Cejel: could not read --key file ${options.keyPath}: ${message}`);
   }
   const issuerKey = parseIssuerPublicKey(keyContents);
+  refuseSymlinkedOutputs(options.outDir, [ISSUANCE_OUTPUT_FILE], "issuance output");
   const reproduction = runCejelScan({
     repoPath: options.repoPath,
     ...options.productName ? { productName: options.productName } : {},
@@ -1417,6 +1557,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     ...options.rubricPin ? { rubricVersion: options.rubricPin } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: true,
+    // The binding policy and the named subject repository are part of the invocation the report
+    // records, so the reproduction reads them from the report it is reproducing rather than from
+    // flags an issuer could forget. Anything else a report states differently fails the byte
+    // comparison below, as it always has.
+    ...suppliedReport.inputBinding?.policy === "strict" ? { strictIngest: true } : {},
+    ...suppliedReport.inputBinding?.scannedSubject.repository ? { subjectRepository: suppliedReport.inputBinding.scannedSubject.repository } : {},
     toolVersion: cliVersion()
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
@@ -1444,9 +1590,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
     engagementRef: options.engagementRef
   });
-  mkdirSync(options.outDir, { recursive: true });
-  const issuancePath = join(options.outDir, "issuance.json");
-  writeFileSync(issuancePath, serializeWitanIssuance(statement), "utf8");
+  const issuancePath = join2(options.outDir, ISSUANCE_OUTPUT_FILE);
+  writeOutputFiles(
+    options.outDir,
+    [{ name: ISSUANCE_OUTPUT_FILE, contents: serializeWitanIssuance(statement) }],
+    "issuance output"
+  );
   process.stdout.write(
     [
       `Cejel: reproduced report.json byte for byte (sha256:${reportSha256}).`,
@@ -1492,6 +1641,8 @@ function parseArgs(args) {
   let showVersion = false;
   let rubricPin;
   let runAttempt;
+  let strictIngest = false;
+  let subjectRepository;
   const ingestPatterns = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -1570,6 +1721,16 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "strictIngest":
+          strictIngest = true;
+          break;
+        case "subjectRepository": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --subject-repository");
+          subjectRepository = value;
+          index += 1;
+          break;
+        }
         case "runAttempt": {
           const value = args[index + 1];
           if (!value) throw new Error("Missing value for --run-attempt");
@@ -1593,7 +1754,7 @@ function parseArgs(args) {
     throw new Error("--product-name and --name cannot be used together");
   }
   return {
-    repoPath: resolve2(repoPath ?? "."),
+    repoPath: resolve3(repoPath ?? "."),
     outDir,
     ...minScore != null ? { minScore } : {},
     ...productName ? { productName } : {},
@@ -1602,6 +1763,8 @@ function parseArgs(args) {
     showHelp,
     showVersion,
     ingestPatterns,
+    ...strictIngest ? { strictIngest } : {},
+    ...subjectRepository ? { subjectRepository } : {},
     ...rubricPin ? { rubricPin } : {},
     ...runAttempt ? { runAttempt } : {}
   };

package/dist/mcp/index.js

@@ -3,13 +3,13 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-BG4ZRBQ5.js";
-import "../chunk-JNTTFAHQ.js";
-import "../chunk-VGBFZBZQ.js";
-import "../chunk-FSMZV3Y6.js";
+} from "../chunk-KNTBED5T.js";
+import "../chunk-KJVFCZZ3.js";
+import "../chunk-NIWSYJ6N.js";
+import "../chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "../chunk-O3MHSK25.js";
+} from "../chunk-AWLKQUI4.js";
 
 // src/mcp/index.ts
 init_esm_shims();

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-5PFYOIOS.js";
+} from "../../chunk-WXPGEQBE.js";
 import {
   execGit
-} from "../../chunk-VGBFZBZQ.js";
+} from "../../chunk-NIWSYJ6N.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-FSMZV3Y6.js";
+} from "../../chunk-AMVP7L26.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {