@runveric/cli 0.1.1 → 0.2.0

package/dist/runveric.mjs

@@ -212,14 +212,18 @@ var require_wire_identity = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PROBLEM_TYPE_BASE = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
+    exports.PROBLEM_TYPE_BASE = exports.CATALOG_ARTIFACT_MEDIA_TYPE = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = exports.CATALOG_RELEASE_SCHEMA_V1 = exports.EVIDENCE_PACK_SCHEMA_VERSION = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
     exports.problemType = problemType;
-    exports.PACKAGE_RESULT_PROTOCOL_VERSION = "opera.dev/package-result/v1";
-    exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "opera.dev/package-execution/v1";
-    exports.ACTION_MANIFEST_API_VERSION = "opera.dev/action/v1";
-    exports.PACKAGE_WORK_ITEM_VERSION = "opera.dev/package-work-item/v1";
-    exports.RUNNER_PROTOCOL_VERSION = "opera.dev/runner-channel/v2";
-    exports.PROBLEM_TYPE_BASE = "https://opera.cloud/errors";
+    exports.PACKAGE_RESULT_PROTOCOL_VERSION = "runveric.dev/package-result/v1";
+    exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "runveric.dev/package-execution/v1";
+    exports.ACTION_MANIFEST_API_VERSION = "runveric.dev/action/v1";
+    exports.PACKAGE_WORK_ITEM_VERSION = "runveric.dev/package-work-item/v1";
+    exports.RUNNER_PROTOCOL_VERSION = "runveric.dev/runner-channel/v2";
+    exports.EVIDENCE_PACK_SCHEMA_VERSION = "runveric.dev/evidence-pack/v1";
+    exports.CATALOG_RELEASE_SCHEMA_V1 = "runveric.dev/catalog-release/v1";
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = "runveric.dev/catalog-action/v1";
+    exports.CATALOG_ARTIFACT_MEDIA_TYPE = "application/vnd.runveric.catalog-artifact+json";
+    exports.PROBLEM_TYPE_BASE = "https://runveric.dev/errors";
     function problemType(slug) {
       return `${exports.PROBLEM_TYPE_BASE}/${slug}`;
     }
@@ -301,6 +305,13 @@ var require_permissions = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
+    exports.PLATFORM_PERMISSIONS = void 0;
+    exports.PLATFORM_PERMISSIONS = [
+      // Which catalog release is live for every workspace (docs/121). Pinning one changes what EVERY
+      // workspace can run, so it is neither `policy:manage` (one workspace's own governance) nor
+      // `catalog:read` (the right to browse).
+      "catalog:release"
+    ];
   }
 });
 
@@ -443,6 +454,41 @@ var require_groups = __commonJS({
   }
 });
 
+// ../contracts/dist/catalog-policy.js
+var require_catalog_policy = __commonJS({
+  "../contracts/dist/catalog-policy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CATALOG_RULE_EFFECTS = exports.CATALOG_DEFAULT_MODE_WHEN_UNSET = exports.CATALOG_DEFAULT_MODES = void 0;
+    exports.effectiveCatalogAccess = effectiveCatalogAccess;
+    var CATALOG_DEFAULT_MODE_SET = {
+      allow_all: true,
+      deny_all: true
+    };
+    exports.CATALOG_DEFAULT_MODES = Object.keys(CATALOG_DEFAULT_MODE_SET);
+    exports.CATALOG_DEFAULT_MODE_WHEN_UNSET = "allow_all";
+    var CATALOG_RULE_EFFECT_SET = {
+      allow: true,
+      deny: true
+    };
+    exports.CATALOG_RULE_EFFECTS = Object.keys(CATALOG_RULE_EFFECT_SET);
+    var RULE_ACCESS = {
+      allow: "allowed",
+      deny: "blocked"
+    };
+    var UNRULED_ACCESS = {
+      allow_all: "allowed",
+      deny_all: "blocked"
+    };
+    function effectiveCatalogAccess(defaultMode, rule) {
+      return rule !== null ? RULE_ACCESS[rule] : UNRULED_ACCESS[defaultMode];
+    }
+    __name(effectiveCatalogAccess, "effectiveCatalogAccess");
+  }
+});
+
 // ../contracts/dist/catalog.js
 var require_catalog = __commonJS({
   "../contracts/dist/catalog.js"(exports) {
@@ -450,7 +496,7 @@ var require_catalog = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.NEW_ACTION_WINDOW_DAYS = exports.PARAMETER_CONTROLS = exports.ACTION_LIFECYCLE_LABELS = exports.INACTIVE_ACTION_LIFECYCLES = exports.RUNNABLE_ACTION_LIFECYCLES = exports.LISTED_ACTION_LIFECYCLES = exports.ACTION_LIFECYCLE_STANDING = exports.ACTION_LIFECYCLES = void 0;
+    exports.NEW_ACTION_WINDOW_DAYS = exports.PARAMETER_ORDER_KEY = exports.PARAMETER_CONTROLS = exports.ACTION_LIFECYCLE_LABELS = exports.INACTIVE_ACTION_LIFECYCLES = exports.RUNNABLE_ACTION_LIFECYCLES = exports.LISTED_ACTION_LIFECYCLES = exports.ACTION_LIFECYCLE_STANDING = exports.ACTION_LIFECYCLES = void 0;
     exports.orderedParameterEntries = orderedParameterEntries;
     exports.withParameterOrder = withParameterOrder;
     exports.isNewAction = isNewAction;
@@ -513,9 +559,10 @@ var require_catalog = __commonJS({
       "switch",
       "info"
     ];
+    exports.PARAMETER_ORDER_KEY = "x-runveric-order";
     function orderedParameterEntries(schema) {
       const properties = schema.properties ?? {};
-      const declared = schema["x-opera-order"] ?? [];
+      const declared = schema[exports.PARAMETER_ORDER_KEY] ?? [];
       const seen = /* @__PURE__ */ new Set();
       const ordered = [];
       for (const id of declared) {
@@ -540,7 +587,7 @@ var require_catalog = __commonJS({
     function withParameterOrder(schema) {
       return {
         ...schema,
-        "x-opera-order": Object.keys(schema.properties ?? {})
+        [exports.PARAMETER_ORDER_KEY]: Object.keys(schema.properties ?? {})
       };
     }
     __name(withParameterOrder, "withParameterOrder");
@@ -557,6 +604,315 @@ var require_catalog = __commonJS({
   }
 });
 
+// ../contracts/dist/catalog-release.js
+var require_catalog_release = __commonJS({
+  "../contracts/dist/catalog-release.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ARTIFACT_DIGEST_PATTERN = exports.ARTIFACT_REPOSITORY_PATTERN = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = exports.CATALOG_RELEASE_SCHEMA_VERSIONS = void 0;
+    var wire_identity_1 = require_wire_identity();
+    exports.CATALOG_RELEASE_SCHEMA_VERSIONS = [
+      wire_identity_1.CATALOG_RELEASE_SCHEMA_V1
+    ];
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = [
+      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V1
+    ];
+    exports.ARTIFACT_REPOSITORY_PATTERN = /^[a-z0-9][a-z0-9.-]*(:[0-9]+)?(\/[a-z0-9][a-z0-9._-]*)+$/;
+    exports.ARTIFACT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+  }
+});
+
+// ../contracts/dist/action-repository.js
+var require_action_repository = __commonJS({
+  "../contracts/dist/action-repository.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ACTION_REPOSITORY_PREFIX = void 0;
+    exports.actionKeyRefusal = actionKeyRefusal;
+    exports.isActionKey = isActionKey;
+    exports.actionRepositoryName = actionRepositoryName;
+    exports.actionKeyOf = actionKeyOf;
+    exports.actionPackageRefusal = actionPackageRefusal3;
+    exports.ACTION_REPOSITORY_PREFIX = "action-";
+    var WORD = /^[a-z][a-z0-9]*$/;
+    var VERB = /^[a-z][a-z0-9]*(?:[A-Z][a-z0-9]+)*$/;
+    function actionKeyRefusal(key) {
+      const shape = "an action key is <provider>.<resource>.<verb>: provider and resource are one lowercase word (a-z, then a-z or 0-9), the verb is camelCase with no two capitals in a row \u2014 so the key maps to exactly one repository name and back.";
+      const segments = key.split(".");
+      if (segments.length !== 3) {
+        return `"${key}" is not an action key: it has ${segments.length} dot-separated segment(s), not 3; ${shape}`;
+      }
+      const [provider, resource, verb] = segments;
+      const not = /* @__PURE__ */ __name((what) => `"${key}" is not an action key: ${what}; ${shape}`, "not");
+      if (!WORD.test(provider)) return not(`its provider "${provider}" is not one lowercase word`);
+      if (!WORD.test(resource)) return not(`its resource "${resource}" is not one lowercase word`);
+      if (!VERB.test(verb)) return not(`its verb "${verb}" is not camelCase without two capitals in a row`);
+      return null;
+    }
+    __name(actionKeyRefusal, "actionKeyRefusal");
+    function isActionKey(key) {
+      return actionKeyRefusal(key) === null;
+    }
+    __name(isActionKey, "isActionKey");
+    var kebab = /* @__PURE__ */ __name((verb) => verb.replace(/[A-Z]/g, (capital) => `-${capital.toLowerCase()}`), "kebab");
+    function actionRepositoryName(key) {
+      const refusal = actionKeyRefusal(key);
+      if (refusal !== null) throw new Error(refusal);
+      const [provider, resource, verb] = key.split(".");
+      return `${exports.ACTION_REPOSITORY_PREFIX}${provider}-${resource}-${kebab(verb)}`;
+    }
+    __name(actionRepositoryName, "actionRepositoryName");
+    function actionKeyOf(name) {
+      if (!name.startsWith(exports.ACTION_REPOSITORY_PREFIX)) return null;
+      const [provider, resource, first2, ...rest] = name.slice(exports.ACTION_REPOSITORY_PREFIX.length).split("-");
+      if (provider === void 0 || resource === void 0 || first2 === void 0) return null;
+      const verb = first2 + rest.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+      const key = `${provider}.${resource}.${verb}`;
+      return isActionKey(key) && actionRepositoryName(key) === name ? key : null;
+    }
+    __name(actionKeyOf, "actionKeyOf");
+    function actionPackageRefusal3(key, artifactRef) {
+      const keyRefusal = actionKeyRefusal(key);
+      if (keyRefusal !== null) return `${keyRefusal} No package can carry it.`;
+      const cut = artifactRef.lastIndexOf("/");
+      const named = artifactRef.slice(cut + 1);
+      const expected = actionRepositoryName(key);
+      if (named === expected) return null;
+      return `action "${key}" is published only from a package named "${expected}" (${artifactRef.slice(0, cut + 1)}${expected}), not "${named}". An action's package carries its key's name, so an artifact cannot claim an identity its package does not carry.`;
+    }
+    __name(actionPackageRefusal3, "actionPackageRefusal");
+  }
+});
+
+// ../contracts/dist/catalog-release-spec.js
+var require_catalog_release_spec = __commonJS({
+  "../contracts/dist/catalog-release-spec.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CatalogReleaseSpecError = void 0;
+    exports.splitArtifactReference = splitArtifactReference;
+    exports.parseCatalogReleaseSpec = parseCatalogReleaseSpec2;
+    var CatalogReleaseSpecError = class CatalogReleaseSpecError extends Error {
+      static {
+        __name(this, "CatalogReleaseSpecError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogReleaseSpecError";
+      }
+    };
+    exports.CatalogReleaseSpecError = CatalogReleaseSpecError;
+    function splitArtifactReference(reference) {
+      const at = reference.indexOf("@");
+      if (at <= 0 || at === reference.length - 1) return null;
+      return {
+        artifactRef: reference.slice(0, at),
+        digest: reference.slice(at + 1)
+      };
+    }
+    __name(splitArtifactReference, "splitArtifactReference");
+    var isMapping2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+    function parseCatalogReleaseSpec2(value) {
+      if (!isMapping2(value)) {
+        throw new CatalogReleaseSpecError("release.yaml is not a mapping of `version` and `actions`.");
+      }
+      const unknown = Object.keys(value).filter((key) => key !== "version" && key !== "actions");
+      if (unknown.length > 0) {
+        throw new CatalogReleaseSpecError(`release.yaml carries ${unknown.map((key) => `"${key}"`).join(", ")}; it has exactly two fields, \`version\` and \`actions\`.`);
+      }
+      const { version: version2, actions } = value;
+      if (typeof version2 !== "string" || version2.trim().length === 0) {
+        throw new CatalogReleaseSpecError(`release.yaml's version is ${JSON.stringify(version2 ?? null)}, not a label. Write it as a quoted string \u2014 version: "2026.10.1" \u2014 because YAML reads an unquoted 2026.10 as a number.`);
+      }
+      if (actions === null || actions === void 0 || isMapping2(actions) && Object.keys(actions).length === 0) {
+        throw new CatalogReleaseSpecError("release.yaml declares no action. An empty release is refused: pinned, it would declare a catalog with nothing in it.");
+      }
+      if (!isMapping2(actions)) {
+        throw new CatalogReleaseSpecError("release.yaml's actions is not a mapping of action key to <repository>@<digest>.");
+      }
+      return {
+        version: version2,
+        actions: Object.entries(actions).map(([key, reference]) => {
+          const split = typeof reference === "string" ? splitArtifactReference(reference) : null;
+          if (split === null) {
+            throw new CatalogReleaseSpecError(`release.yaml's ${key} is ${JSON.stringify(reference)}, not <repository>@<digest>.`);
+          }
+          return {
+            key,
+            ...split
+          };
+        })
+      };
+    }
+    __name(parseCatalogReleaseSpec2, "parseCatalogReleaseSpec");
+  }
+});
+
+// ../contracts/dist/catalog-lock.js
+var require_catalog_lock = __commonJS({
+  "../contracts/dist/catalog-lock.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CatalogLockError = exports.CATALOG_LOCK_FILE = exports.CATALOG_LOCK_SCHEMA_V1 = void 0;
+    exports.parseCatalogLock = parseCatalogLock;
+    exports.catalogLockText = catalogLockText;
+    exports.authoredElsewhere = authoredElsewhere;
+    var action_repository_1 = require_action_repository();
+    var catalog_release_1 = require_catalog_release();
+    exports.CATALOG_LOCK_SCHEMA_V1 = "runveric.catalog-lock/v1";
+    exports.CATALOG_LOCK_FILE = "release.lock.json";
+    var CatalogLockError = class CatalogLockError extends Error {
+      static {
+        __name(this, "CatalogLockError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogLockError";
+      }
+    };
+    exports.CatalogLockError = CatalogLockError;
+    var SHA256_HEX = /^[0-9a-f]{64}$/;
+    function objectAt(path, value, keys) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new CatalogLockError(`${path} is not an object.`);
+      }
+      const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+      if (unknown.length > 0) {
+        throw new CatalogLockError(`${path} carries ${unknown.map((key) => `"${key}"`).join(", ")}, which a lock does not have. A lock is written by catalog:vendor and never edited; re-vendor instead.`);
+      }
+      return value;
+    }
+    __name(objectAt, "objectAt");
+    function stringAt(path, value, pattern, expected) {
+      if (typeof value !== "string" || value.length === 0) {
+        throw new CatalogLockError(`${path} is not a non-empty string.`);
+      }
+      if (pattern !== void 0 && !pattern.test(value)) {
+        throw new CatalogLockError(`${path} is "${value}", which is not ${expected}.`);
+      }
+      return value;
+    }
+    __name(stringAt, "stringAt");
+    function parseCatalogLock(value) {
+      const root = objectAt("the lock", value, [
+        "schemaVersion",
+        "release",
+        "actions"
+      ]);
+      if (root.schemaVersion !== exports.CATALOG_LOCK_SCHEMA_V1) {
+        throw new CatalogLockError(`the lock declares schemaVersion ${JSON.stringify(root.schemaVersion)}; this build reads ${exports.CATALOG_LOCK_SCHEMA_V1} only.`);
+      }
+      const release = objectAt("release", root.release, [
+        "artifactRef",
+        "digest",
+        "version"
+      ]);
+      const lock = {
+        schemaVersion: exports.CATALOG_LOCK_SCHEMA_V1,
+        release: {
+          artifactRef: stringAt("release.artifactRef", release.artifactRef, catalog_release_1.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+          digest: stringAt("release.digest", release.digest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          version: stringAt("release.version", release.version)
+        },
+        actions: []
+      };
+      if (!Array.isArray(root.actions) || root.actions.length === 0) {
+        throw new CatalogLockError("actions is not a non-empty array. A release names at least one action.");
+      }
+      root.actions.forEach((entry, index) => {
+        const path = `actions[${index}]`;
+        const action = objectAt(path, entry, [
+          "key",
+          "artifactRef",
+          "digest",
+          "manifestSha256",
+          "provenance"
+        ]);
+        const key = stringAt(`${path}.key`, action.key);
+        const artifactRef = stringAt(`${path}.artifactRef`, action.artifactRef, catalog_release_1.ARTIFACT_REPOSITORY_PATTERN, "a registry repository");
+        const misnamed = (0, action_repository_1.actionPackageRefusal)(key, artifactRef);
+        if (misnamed !== null) throw new CatalogLockError(`${path}: ${misnamed}`);
+        const previous = lock.actions[lock.actions.length - 1];
+        if (previous !== void 0 && !(previous.key < key)) {
+          throw new CatalogLockError(`${path}.key "${key}" follows "${previous.key}": a lock names each action once, sorted by key.`);
+        }
+        const provenance2 = objectAt(`${path}.provenance`, action.provenance, [
+          "repository",
+          "commit"
+        ]);
+        lock.actions.push({
+          key,
+          artifactRef,
+          digest: stringAt(`${path}.digest`, action.digest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          manifestSha256: stringAt(`${path}.manifestSha256`, action.manifestSha256, SHA256_HEX, "64 lowercase hex characters"),
+          provenance: {
+            repository: stringAt(`${path}.provenance.repository`, provenance2.repository),
+            commit: stringAt(`${path}.provenance.commit`, provenance2.commit)
+          }
+        });
+      });
+      return lock;
+    }
+    __name(parseCatalogLock, "parseCatalogLock");
+    function catalogLockText(lock) {
+      const ordered = {
+        schemaVersion: lock.schemaVersion,
+        release: {
+          artifactRef: lock.release.artifactRef,
+          digest: lock.release.digest,
+          version: lock.release.version
+        },
+        actions: [
+          ...lock.actions
+        ].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map((action) => ({
+          key: action.key,
+          artifactRef: action.artifactRef,
+          digest: action.digest,
+          manifestSha256: action.manifestSha256,
+          provenance: {
+            repository: action.provenance.repository,
+            commit: action.provenance.commit
+          }
+        }))
+      };
+      return `${JSON.stringify(ordered, null, 2)}
+`;
+    }
+    __name(catalogLockText, "catalogLockText");
+    function authoredElsewhere(lock, key) {
+      const namespace = lock.release.artifactRef.slice(0, lock.release.artifactRef.lastIndexOf("/"));
+      const organisation = namespace.slice(namespace.lastIndexOf("/") + 1);
+      return `${key} is authored in ${organisation}/${(0, action_repository_1.actionRepositoryName)(key)} \u2014 change it there, publish, assemble, vendor`;
+    }
+    __name(authoredElsewhere, "authoredElsewhere");
+  }
+});
+
+// ../contracts/dist/catalog-manifest-placeholders.js
+var require_catalog_manifest_placeholders = __commonJS({
+  "../contracts/dist/catalog-manifest-placeholders.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.MANIFEST_PLACEHOLDER_PATTERN = exports.MANIFEST_PLACEHOLDERS = void 0;
+    var brand_1 = require_brand();
+    exports.MANIFEST_PLACEHOLDERS = {
+      BRAND_SHORT_NAME: brand_1.BRAND_SHORT_NAME,
+      BRAND_NAME: brand_1.BRAND_NAME
+    };
+    exports.MANIFEST_PLACEHOLDER_PATTERN = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+  }
+});
+
 // ../contracts/dist/change-control.js
 var require_change_control = __commonJS({
   "../contracts/dist/change-control.js"(exports) {
@@ -856,8 +1212,8 @@ var require_package_provenance = __commonJS({
       pair.accepted,
       pair.revoked
     ]);
-    function poolProvenanceAuditAction(provenance, accepted) {
-      const pair = exports.POOL_PROVENANCE_AUDIT_ACTIONS[provenance];
+    function poolProvenanceAuditAction(provenance2, accepted) {
+      const pair = exports.POOL_PROVENANCE_AUDIT_ACTIONS[provenance2];
       return accepted ? pair.accepted : pair.revoked;
     }
     __name(poolProvenanceAuditAction, "poolProvenanceAuditAction");
@@ -916,7 +1272,9 @@ var require_packages = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PACKAGE_IMPORT_WARNING_REASONS = exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = exports.PACKAGE_IMPORT_SKIP_REASONS = exports.PACKAGE_IMPORT_LIMITS = exports.PACKAGE_DRAFT_FILTER_LABELS = exports.PACKAGE_DRAFT_FILTERS = exports.PACKAGE_INTERPRETER_LABEL = exports.PARAMETER_DETECTION_UNAVAILABLE = exports.PARAMETER_DETECTION_SOURCES = exports.PACKAGE_PARAMETERS_UNRESOLVED_COPY = exports.PACKAGE_PARAMETERS_UNRESOLVED_REASONS = exports.PACKAGE_DRAFT_STATES = exports.PACKAGE_VERSION_MODES = exports.ACTION_UNRUNNABLE_REASONS = exports.PACKAGE_SOURCE_RECONNECT_OUTCOMES = exports.ADOPTION_REVIEW_DIRECTIONS = exports.ADOPTION_CHANGE_SEVERITY = exports.ADOPTION_CHANGE_KINDS = exports.ADOPTION_CHANGE_SEVERITIES = exports.ADOPTION_STATUSES = exports.PACKAGE_INTERPRETERS = exports.PACKAGE_RUNTIME_KINDS = exports.PACKAGE_RUNNER_CONNECTOR_KEY = void 0;
+    exports.PACKAGE_IMPORT_WARNING_REASONS = exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = exports.PACKAGE_IMPORT_SKIP_REASONS = exports.PACKAGE_IMPORT_LIMITS = exports.PACKAGE_DRAFT_FILTER_LABELS = exports.PACKAGE_DRAFT_FILTERS = exports.PACKAGE_INTERPRETER_LABEL = exports.PARAMETER_DETECTION_UNAVAILABLE = exports.PARAMETER_DETECTION_SOURCES = exports.PACKAGE_PARAMETERS_UNRESOLVED_COPY = exports.PACKAGE_PARAMETERS_UNRESOLVED_REASONS = exports.PACKAGE_DRAFT_STATES = exports.PACKAGE_VERSION_MODES = exports.ACTION_UNRUNNABLE_REASONS = exports.PACKAGE_SOURCE_RECONNECT_OUTCOMES = exports.ADOPTION_REVIEW_DIRECTIONS = exports.ADOPTION_CHANGE_SEVERITY = exports.ADOPTION_CHANGE_KINDS = exports.ADOPTION_CHANGE_SEVERITIES = exports.ADOPTION_STATUSES = exports.PACKAGE_INTERPRETERS = exports.PACKAGE_RUNTIME_KINDS = exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY = exports.PACKAGE_RUNNER_CONNECTOR_KEY = void 0;
+    exports.isPackageRunnerConnectorKey = isPackageRunnerConnectorKey;
+    exports.canonicalConnectorKey = canonicalConnectorKey;
     exports.packageSourceConnectedRemovalMessage = packageSourceConnectedRemovalMessage;
     exports.packageVersionAdoptedRemovalMessage = packageVersionAdoptedRemovalMessage;
     exports.actionUnrunnableCopy = actionUnrunnableCopy;
@@ -927,7 +1285,16 @@ var require_packages = __commonJS({
     __exportStar(require_package_provenance(), exports);
     __exportStar(require_package_tier(), exports);
     var brand_1 = require_brand();
-    exports.PACKAGE_RUNNER_CONNECTOR_KEY = "opera.package-runner";
+    exports.PACKAGE_RUNNER_CONNECTOR_KEY = "runveric.package-runner";
+    exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY = "opera.package-runner";
+    function isPackageRunnerConnectorKey(connectorKey) {
+      return connectorKey === exports.PACKAGE_RUNNER_CONNECTOR_KEY || connectorKey === exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY;
+    }
+    __name(isPackageRunnerConnectorKey, "isPackageRunnerConnectorKey");
+    function canonicalConnectorKey(connectorKey) {
+      return isPackageRunnerConnectorKey(connectorKey) ? exports.PACKAGE_RUNNER_CONNECTOR_KEY : connectorKey;
+    }
+    __name(canonicalConnectorKey, "canonicalConnectorKey");
     exports.PACKAGE_RUNTIME_KINDS = [
       "interpreter",
       "oci"
@@ -1248,7 +1615,7 @@ var require_packages = __commonJS({
       "editor_metadata",
       "os_metadata",
       "lockfile",
-      "opera_scratch",
+      "runveric_scratch",
       "not_text"
     ];
     exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = {
@@ -1258,7 +1625,7 @@ var require_packages = __commonJS({
       editor_metadata: "editor settings",
       os_metadata: "operating-system metadata",
       lockfile: "a dependency lockfile",
-      opera_scratch: "scratch written by `runveric test`",
+      runveric_scratch: "scratch written by `runveric test`",
       not_text: "not UTF-8 text"
     };
     exports.PACKAGE_IMPORT_WARNING_REASONS = [
@@ -1274,7 +1641,7 @@ var require_validation = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.TARGET_COMPARISON_KINDS = exports.TARGETS_NO_SCOPE = exports.TARGETS_NOT_COUNTED = exports.TARGET_COUNT_ABSENCES = void 0;
+    exports.TARGET_COMPARISON_KINDS = exports.DECISION_CODES = exports.REFUSAL_CODES = exports.CHECK_LEVELS = exports.TARGETS_NO_SCOPE = exports.TARGETS_NOT_COUNTED = exports.TARGET_COUNT_ABSENCES = void 0;
     exports.isTargetCountAbsence = isTargetCountAbsence;
     exports.singleTarget = singleTarget;
     exports.noTargetsResolved = noTargetsResolved;
@@ -1284,6 +1651,9 @@ var require_validation = __commonJS({
     exports.eligibleTargetCount = eligibleTargetCount;
     exports.targetsValidationCheck = targetsValidationCheck;
     exports.targetSummaryOf = targetSummaryOf;
+    exports.isCheckLevel = isCheckLevel;
+    exports.isRefusalCode = isRefusalCode;
+    exports.isDecisionCode = isDecisionCode;
     exports.scopeFailureDetail = scopeFailureDetail;
     exports.targetsUnavailableFrom = targetsUnavailableFrom;
     exports.compareTargets = compareTargets;
@@ -1400,6 +1770,38 @@ var require_validation = __commonJS({
       return exports.TARGETS_NOT_COUNTED;
     }
     __name(targetSummaryOf, "targetSummaryOf");
+    exports.CHECK_LEVELS = [
+      "info",
+      "warn",
+      "error"
+    ];
+    function isCheckLevel(value) {
+      return typeof value === "string" && exports.CHECK_LEVELS.includes(value);
+    }
+    __name(isCheckLevel, "isCheckLevel");
+    exports.REFUSAL_CODES = [
+      "disk.notUnattached",
+      "disk.locked",
+      "disk.shared",
+      "disk.inRecoveryPlan",
+      "disk.keyUnusable",
+      "disk.unverifiable"
+    ];
+    function isRefusalCode(value) {
+      return typeof value === "string" && exports.REFUSAL_CODES.includes(value);
+    }
+    __name(isRefusalCode, "isRefusalCode");
+    exports.DECISION_CODES = [
+      "disk.recentlyDetached",
+      "disk.customerKey",
+      "disk.customerKeyUnverified",
+      "disk.guestEncrypted",
+      "disk.noSnapshot"
+    ];
+    function isDecisionCode(value) {
+      return typeof value === "string" && exports.DECISION_CODES.includes(value);
+    }
+    __name(isDecisionCode, "isDecisionCode");
     function scopeFailureDetail(error) {
       const raw = error instanceof Error ? error.message : String(error);
       const oneLine = raw.replace(/\s+/g, " ").trim().replace(/[.!]+$/, "");
@@ -1470,7 +1872,7 @@ var require_execution = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
+    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.REFUSAL_CODES = exports.isRefusalCode = exports.isDecisionCode = exports.isCheckLevel = exports.DECISION_CODES = exports.CHECK_LEVELS = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
     exports.executionLogStreamSentence = executionLogStreamSentence;
     exports.actionRunnabilityCopy = actionRunnabilityCopy;
     exports.actionRunnabilityHeadline = actionRunnabilityHeadline;
@@ -1481,6 +1883,42 @@ var require_execution = __commonJS({
     var brand_1 = require_brand();
     exports.SUBSCRIPTION_ID_FIELD_RENAMED = "`subscriptionId` is not accepted on this route. It named an `azure_subscription.id` while this route has always resolved a `connection_scope.id`. The two were the same value while one shim gave a scope the registry row's id; a scope discovered since has an id of its own, and the registry id is either nobody's scope or another connector's. Send `connectionScopeId` \u2014 the value `ExecutionDto.connectionScopeId` reports for a run.";
     var validation_1 = require_validation();
+    Object.defineProperty(exports, "CHECK_LEVELS", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.CHECK_LEVELS;
+      }, "get")
+    });
+    Object.defineProperty(exports, "DECISION_CODES", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.DECISION_CODES;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isCheckLevel", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isCheckLevel;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isDecisionCode", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isDecisionCode;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isRefusalCode", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isRefusalCode;
+      }, "get")
+    });
+    Object.defineProperty(exports, "REFUSAL_CODES", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.REFUSAL_CODES;
+      }, "get")
+    });
     Object.defineProperty(exports, "compareTargets", {
       enumerable: true,
       get: /* @__PURE__ */ __name(function() {
@@ -1622,6 +2060,7 @@ var require_execution = __commonJS({
     }
     __name(executionLogStreamSentence, "executionLogStreamSentence");
     var ACTION_RUNNABILITY_CAUSE_KIND_SET = {
+      catalog_blocked: true,
       connector_unregistered: true,
       package: true,
       runner_pool: true,
@@ -1631,8 +2070,12 @@ var require_execution = __commonJS({
     };
     exports.ACTION_RUNNABILITY_CAUSE_KINDS = Object.keys(ACTION_RUNNABILITY_CAUSE_KIND_SET);
     exports.CONNECTOR_UNAVAILABLE_MESSAGE = "This action is not yet available to run.";
+    var CATALOG_BLOCKED_CAUSE = "This workspace does not permit this action.";
+    var CATALOG_BLOCKED_REMEDY = "An administrator of this workspace decides which catalog actions may run here, and can allow it.";
     function actionRunnabilityCopy(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return `${CATALOG_BLOCKED_CAUSE} ${CATALOG_BLOCKED_REMEDY}`;
         case "package":
           return (0, packages_2.actionUnrunnableCopy)(cause.detail);
         case "runner_pool": {
@@ -1664,7 +2107,7 @@ var require_execution = __commonJS({
     }
     __name(describeRoutingPlaces, "describeRoutingPlaces");
     function runnerPoolClauses(cause) {
-      const provenance = cause.provenance ? `is ${packages_1.PACKAGE_PROVENANCE_CLAUSES[cause.provenance]}` : (
+      const provenance2 = cause.provenance ? `is ${packages_1.PACKAGE_PROVENANCE_CLAUSES[cause.provenance]}` : (
         // every other value this sentence could take is a claim about where bytes came from.
         "has no recorded provenance"
       );
@@ -1682,7 +2125,7 @@ var require_execution = __commonJS({
          * credential it acts with. A refusal that dropped those would be telling an admin the
          * decision no longer matters.
          */
-        cause: `${provenance}, and would run on the private runner pool "${cause.poolName}", because that is where runs using this connection execute \u2014 on a machine you own, in a container that shares its host's kernel and acts with this connection's credential.`,
+        cause: `${provenance2}, and would run on the private runner pool "${cause.poolName}", because that is where runs using this connection execute \u2014 on a machine you own, in a container that shares its host's kernel and acts with this connection's credential.`,
         remedy: `${acceptedClause(cause.accepts)} ${POOL_CONSENT_REMEDY}`
       };
     }
@@ -1721,6 +2164,8 @@ var require_execution = __commonJS({
     var POOL_CONSENT_REMEDY = `${brand_1.BRAND_SHORT_NAME} does not vouch for what runs on your machines \u2014 the owner of this pool does. An administrator can accept this provenance under Settings \u2192 Runners, and until they do, nothing of this provenance will be sent there. Built-in actions still run in that pool.`;
     function actionRunnabilityHeadline(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return "this workspace does not permit its action \u2014 an administrator of this workspace can allow it";
         case "package":
           return (0, packages_2.actionUnrunnableHeadline)(cause.detail);
         case "runner_pool":
@@ -1738,6 +2183,8 @@ var require_execution = __commonJS({
     __name(actionRunnabilityHeadline, "actionRunnabilityHeadline");
     function actionRunnabilityRefusal(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return `${CATALOG_BLOCKED_CAUSE} ${CATALOG_BLOCKED_REMEDY} Nothing was started.`;
         case "package":
           return (0, packages_2.actionUnrunnableRefusal)(cause.detail, cause);
         case "runner_pool": {
@@ -1762,6 +2209,80 @@ var require_execution = __commonJS({
   }
 });
 
+// ../contracts/dist/decisions.js
+var require_decisions = __commonJS({
+  "../contracts/dist/decisions.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.DECISION_ACKNOWLEDGEMENT = void 0;
+    exports.recordedDecisionsOf = recordedDecisionsOf;
+    exports.raisedDecisionCodes = raisedDecisionCodes;
+    exports.decisionMismatch = decisionMismatch;
+    exports.decisionMismatchSentence = decisionMismatchSentence;
+    var validation_1 = require_validation();
+    function recordedDecisionsOf(stored) {
+      if (!Array.isArray(stored)) return [];
+      const read = [];
+      for (const entry of stored) {
+        if (typeof entry !== "object" || entry === null) continue;
+        const { code, acknowledgedBy, acknowledgedAt } = entry;
+        if (!(0, validation_1.isDecisionCode)(code)) continue;
+        if (typeof acknowledgedBy !== "string" || acknowledgedBy.length === 0) continue;
+        if (typeof acknowledgedAt !== "string" || Number.isNaN(Date.parse(acknowledgedAt))) continue;
+        if (read.some((decision) => decision.code === code)) continue;
+        read.push({
+          code,
+          acknowledgedBy,
+          acknowledgedAt
+        });
+      }
+      return read;
+    }
+    __name(recordedDecisionsOf, "recordedDecisionsOf");
+    function raisedDecisionCodes(checks) {
+      const raised = [];
+      for (const check of checks) {
+        if (check.decision && !raised.includes(check.decision)) raised.push(check.decision);
+      }
+      return raised;
+    }
+    __name(raisedDecisionCodes, "raisedDecisionCodes");
+    function decisionMismatch(raised, acknowledged) {
+      const unacknowledged = raised.filter((code) => !acknowledged.includes(code));
+      const notRaised = acknowledged.filter((code) => !raised.includes(code));
+      return unacknowledged.length === 0 && notRaised.length === 0 ? null : {
+        unacknowledged,
+        notRaised
+      };
+    }
+    __name(decisionMismatch, "decisionMismatch");
+    function decisionMismatchSentence(mismatch) {
+      const parts = [];
+      if (mismatch.unacknowledged.length > 0) {
+        parts.push(`the plan raised ${quoteCodes(mismatch.unacknowledged)}, which ${mismatch.unacknowledged.length === 1 ? "was" : "were"} not acknowledged`);
+      }
+      if (mismatch.notRaised.length > 0) {
+        parts.push(`${quoteCodes(mismatch.notRaised)} ${mismatch.notRaised.length === 1 ? "was" : "were"} acknowledged but the plan does not raise ${mismatch.notRaised.length === 1 ? "it" : "them"}`);
+      }
+      return `This run was not submitted: ${parts.join(", and ")}. The checks were run again at submit and decide what needs acknowledging \u2014 review the plan and submit again.`;
+    }
+    __name(decisionMismatchSentence, "decisionMismatchSentence");
+    function quoteCodes(codes) {
+      return codes.map((code) => `"${code}"`).join(", ");
+    }
+    __name(quoteCodes, "quoteCodes");
+    exports.DECISION_ACKNOWLEDGEMENT = {
+      "disk.recentlyDetached": "Delete it even though it was detached recently",
+      "disk.customerKey": "Delete it \u2014 restoring later depends on this key staying enabled",
+      "disk.customerKeyUnverified": "Delete it without confirmation that the key is enabled",
+      "disk.guestEncrypted": "Delete it \u2014 restoring later depends on the guest's encryption secrets",
+      "disk.noSnapshot": "Delete it with no snapshot \u2014 this cannot be undone"
+    };
+  }
+});
+
 // ../contracts/dist/execution-site.js
 var require_execution_site = __commonJS({
   "../contracts/dist/execution-site.js"(exports) {
@@ -1846,7 +2367,13 @@ var require_resources = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.DISCOVERY_TYPE_PATTERN = exports.DISCOVERABLE_RESOURCE_TYPES = exports.DISCOVERY_VOCABULARY = void 0;
+    exports.DISCOVERY_TYPE_PATTERN = exports.LEGACY_DISCOVERY_PROVIDER = exports.DISCOVERY_VOCABULARY = void 0;
+    exports.discoveryTypesOf = discoveryTypesOf;
+    exports.declaredDiscoveryTypes = declaredDiscoveryTypes;
+    exports.liveDiscoveryTypes = liveDiscoveryTypes;
+    exports.canonicalDiscoveryId = canonicalDiscoveryId;
+    exports.resolveDiscoveryType = resolveDiscoveryType;
+    exports.isSecretReference = isSecretReference;
     exports.parseDiscoveryType = parseDiscoveryType;
     exports.formatDiscoveryType = formatDiscoveryType;
     exports.discoveryTypeSpec = discoveryTypeSpec;
@@ -1862,16 +2389,20 @@ var require_resources = __commonJS({
       resourceGroup: {
         requires: [],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       // ROUTABLE BUT NOT NAMABLE, and the two are different questions. A rule matches a vault by
       // its NAME and its tags, which discovery supplies; an ARM vault id needs the resource group
       // this vocabulary never asks for (`requires` is empty so vaults list subscription-wide). See
       // `identity` on the spec above — null is the honest answer, not an omission.
+      // NOT a secret reference: a vault CONTAINS secrets, and naming one reveals nothing a run
+      // could read. The secret inside it is the reference (`keyVaultSecret` below).
       keyVault: {
         requires: [],
         routable: true,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       // ★ A DATA-PLANE URI, NOT AN ARM PATH, AND IT IS WHAT DISCOVERY ALREADY RETURNS. The Key
       // Vault SDK reports `SecretProperties.id` as `https://<vault>.vault.azure.net/secrets/<name>`
@@ -1883,27 +2414,33 @@ var require_resources = __commonJS({
           "vault"
         ],
         routable: true,
-        identity: "https://{vault}.vault.azure.net/secrets/{name}"
+        identity: "https://{vault}.vault.azure.net/secrets/{name}",
+        // ★ THE ONE TYPE TODAY WHOSE VALUE POINTS AT A SECRET (docs/122 §3.5). The parameter holds
+        // the secret's NAME within its vault; nothing in the platform ever reads the value behind it.
+        secretRef: true
       },
       // A catalogue value. Nothing is reached by naming a region.
       location: {
         requires: [],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       managedDisk: {
         requires: [
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/disks/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/disks/{name}",
+        secretRef: false
       },
       sqlServer: {
         requires: [
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{name}",
+        secretRef: false
       },
       sqlDatabase: {
         requires: [
@@ -1911,7 +2448,8 @@ var require_resources = __commonJS({
           "server"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{server}/databases/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{server}/databases/{name}",
+        secretRef: false
       },
       // The one type where LISTING and IDENTIFYING are different questions. It lists
       // SUBSCRIPTION-WIDE when no resource group is given (`virtualMachines.listAll()`,
@@ -1931,7 +2469,8 @@ var require_resources = __commonJS({
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/{name}",
+        secretRef: false
       },
       // The sizes ONE machine can actually be resized to right now — not the region's SKU
       // catalogue. `requires` is genuinely both fields' answer here: the safe set cannot be
@@ -1945,16 +2484,53 @@ var require_resources = __commonJS({
           "vm"
         ],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       }
     };
-    exports.DISCOVERY_VOCABULARY = {
+    var DECLARED_DISCOVERY = {
       azure: AZURE_DISCOVERY_TYPES,
       aws: {},
       gcp: {},
       terraform: {}
     };
-    exports.DISCOVERABLE_RESOURCE_TYPES = Object.keys(AZURE_DISCOVERY_TYPES);
+    exports.DISCOVERY_VOCABULARY = DECLARED_DISCOVERY;
+    exports.LEGACY_DISCOVERY_PROVIDER = "azure";
+    function discoveryTypesOf(provider) {
+      return Object.keys(exports.DISCOVERY_VOCABULARY[provider]).map((type) => formatDiscoveryType(provider, type));
+    }
+    __name(discoveryTypesOf, "discoveryTypesOf");
+    function declaredDiscoveryTypes() {
+      return enums_1.PROVIDERS.flatMap(discoveryTypesOf);
+    }
+    __name(declaredDiscoveryTypes, "declaredDiscoveryTypes");
+    function liveDiscoveryTypes(registered) {
+      const providers = new Set(registered);
+      return enums_1.PROVIDERS.filter((provider) => providers.has(provider)).flatMap(discoveryTypesOf);
+    }
+    __name(liveDiscoveryTypes, "liveDiscoveryTypes");
+    function canonicalDiscoveryId(value) {
+      const parsed = parseDiscoveryType(value.trim(), exports.LEGACY_DISCOVERY_PROVIDER);
+      return parsed ? formatDiscoveryType(parsed.provider, parsed.type) : null;
+    }
+    __name(canonicalDiscoveryId, "canonicalDiscoveryId");
+    function resolveDiscoveryType(value) {
+      const parsed = parseDiscoveryType(value.trim(), exports.LEGACY_DISCOVERY_PROVIDER);
+      if (!parsed) return null;
+      const spec = discoveryTypeSpec(parsed.provider, parsed.type);
+      if (!spec) return null;
+      return {
+        id: formatDiscoveryType(parsed.provider, parsed.type),
+        provider: parsed.provider,
+        type: parsed.type,
+        spec
+      };
+    }
+    __name(resolveDiscoveryType, "resolveDiscoveryType");
+    function isSecretReference(discover) {
+      return discover ? resolveDiscoveryType(discover)?.spec.secretRef === true : false;
+    }
+    __name(isSecretReference, "isSecretReference");
     exports.DISCOVERY_TYPE_PATTERN = /^(?:([a-z][a-z0-9]*)\/)?([a-z][a-zA-Z0-9]{0,63})$/;
     function parseDiscoveryType(value, fallbackProvider) {
       const match = exports.DISCOVERY_TYPE_PATTERN.exec(value);
@@ -1978,7 +2554,9 @@ var require_resources = __commonJS({
     }
     __name(formatDiscoveryType, "formatDiscoveryType");
     function discoveryTypeSpec(provider, type) {
-      return exports.DISCOVERY_VOCABULARY[provider]?.[type];
+      if (!Object.prototype.hasOwnProperty.call(exports.DISCOVERY_VOCABULARY, provider)) return void 0;
+      const vocabulary = exports.DISCOVERY_VOCABULARY[provider];
+      return Object.prototype.hasOwnProperty.call(vocabulary, type) ? vocabulary[type] : void 0;
     }
     __name(discoveryTypeSpec, "discoveryTypeSpec");
     function dependsOnLookup(keys, dependsOn) {
@@ -2279,6 +2857,28 @@ var require_runs = __commonJS({
   }
 });
 
+// ../contracts/dist/evidence-pack.js
+var require_evidence_pack = __commonJS({
+  "../contracts/dist/evidence-pack.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.EVIDENCE_EXPORTED_AUDIT_ACTION = exports.EVIDENCE_DIGEST_HEADER = void 0;
+    exports.evidencePackFilename = evidencePackFilename;
+    exports.EVIDENCE_DIGEST_HEADER = "X-Evidence-Digest";
+    exports.EVIDENCE_EXPORTED_AUDIT_ACTION = "operation.evidence_exported";
+    function evidencePackFilename(operationKey, from, to) {
+      return `${operationKey}-evidence-${compactInstant(from)}-${compactInstant(to)}.json`;
+    }
+    __name(evidencePackFilename, "evidencePackFilename");
+    function compactInstant(iso) {
+      return iso.replace(/\.\d+(?=Z|[+-]\d{2}:?\d{2}$)/, "").replace(/[-:]/g, "");
+    }
+    __name(compactInstant, "compactInstant");
+  }
+});
+
 // ../contracts/dist/package-egress.js
 var require_package_egress = __commonJS({
   "../contracts/dist/package-egress.js"(exports) {
@@ -2352,18 +2952,18 @@ var require_package_execution = __commonJS({
     exports.PACKAGE_CONTAINER_ENV = {
       /** The control-plane origin the container redeems its work item at and reports to. */
       callbackBaseUrl: "OPERA_CALLBACK_BASE_URL",
-      executionId: "OPERA_EXECUTION_ID",
+      executionId: "RUNVERIC_EXECUTION_ID",
       /** Single-use; spent on the first redemption. Never copied into the package's own env. */
       runToken: "OPERA_RUN_TOKEN",
       /** What the bytes it fetched must hash to. Travels beside the work item, never inside it. */
-      contentDigest: "OPERA_CONTENT_DIGEST",
+      contentDigest: "RUNVERIC_CONTENT_DIGEST",
       /** Which runtime image this is, recorded on the run. */
       runnerImageDigest: "OPERA_RUNNER_IMAGE_DIGEST",
       /** Where the PACKAGE's outbound traffic is pointed. Absent when it declared no network. */
-      egressProxyUrl: "OPERA_EGRESS_PROXY_URL",
+      egressProxyUrl: "RUNVERIC_EGRESS_PROXY_URL",
       /** The runner-only control channel. Never copied into the package's own env. */
-      egressControlUrl: "OPERA_EGRESS_CONTROL_URL",
-      egressControlToken: "OPERA_EGRESS_CONTROL_TOKEN"
+      egressControlUrl: "RUNVERIC_EGRESS_CONTROL_URL",
+      egressControlToken: "RUNVERIC_EGRESS_CONTROL_TOKEN"
     };
   }
 });
@@ -2375,17 +2975,17 @@ var require_runner_confinement = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.RUNNER_NAMESPACE = exports.CONFINEMENT_FINDING_LABEL = exports.CONFINEMENT_FINDING_SENTENCE = exports.RUNNER_ISOLATION_BLOCKS_UNDECLARED_EGRESS = exports.CONFINEMENT_FINDING_BLOCKS_EGRESS = exports.CONFINEMENT_FINDINGS = exports.RUNNER_SUBSTRATE_LABEL = exports.RUNNER_SUBSTRATES = exports.EGRESS_GATE_SHUT = exports.EGRESS_GATE_OPEN = exports.EGRESS_GATE_PREFIX = exports.EGRESS_PROBE_TIMEOUT_MS = exports.EGRESS_PROBE_BLOCKED = exports.EGRESS_PROBE_REACHED = exports.EGRESS_PROBE_PREFIX = void 0;
+    exports.CONFINEMENT_FINDING_LABEL = exports.CONFINEMENT_FINDING_SENTENCE = exports.RUNNER_ISOLATION_BLOCKS_UNDECLARED_EGRESS = exports.CONFINEMENT_FINDING_BLOCKS_EGRESS = exports.CONFINEMENT_FINDINGS = exports.RUNNER_SUBSTRATE_LABEL = exports.RUNNER_SUBSTRATES = exports.EGRESS_GATE_SHUT = exports.EGRESS_GATE_OPEN = exports.EGRESS_GATE_PREFIX = exports.EGRESS_PROBE_TIMEOUT_MS = exports.EGRESS_PROBE_BLOCKED = exports.EGRESS_PROBE_REACHED = exports.EGRESS_PROBE_PREFIX = void 0;
     exports.effectiveBlocksUndeclaredEgress = effectiveBlocksUndeclaredEgress;
     exports.confinementOverclaims = confinementOverclaims;
     exports.runnerBlocksUndeclaredEgress = runnerBlocksUndeclaredEgress;
     exports.poolConfinementSentence = poolConfinementSentence;
     var brand_1 = require_brand();
-    exports.EGRESS_PROBE_PREFIX = "opera.egress-probe";
+    exports.EGRESS_PROBE_PREFIX = "runveric.egress-probe";
     exports.EGRESS_PROBE_REACHED = "REACHED";
     exports.EGRESS_PROBE_BLOCKED = "BLOCKED";
     exports.EGRESS_PROBE_TIMEOUT_MS = 5e3;
-    exports.EGRESS_GATE_PREFIX = "opera.egress-gate";
+    exports.EGRESS_GATE_PREFIX = "runveric.egress-gate";
     exports.EGRESS_GATE_OPEN = "OPEN";
     exports.EGRESS_GATE_SHUT = "SHUT";
     exports.RUNNER_SUBSTRATES = [
@@ -2440,7 +3040,69 @@ var require_runner_confinement = __commonJS({
       return `Only ${confined} of ${findings.length} runners in this pool block undeclared outbound traffic. A run cannot choose which runner claims it, so this pool is not relied on to confine egress and packages that need their allowlist enforced are not sent here.`;
     }
     __name(poolConfinementSentence, "poolConfinementSentence");
-    exports.RUNNER_NAMESPACE = "opera-runner";
+  }
+});
+
+// ../contracts/dist/runner-install.js
+var require_runner_install = __commonJS({
+  "../contracts/dist/runner-install.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.POD_ROLE_BROKER = exports.POD_EGRESS_CONFINED = exports.POD_EGRESS_LABEL = exports.POD_RUNNER = exports.POD_ROLE = exports.POD_MANAGED_BY_VALUE = exports.POD_MANAGED_BY = exports.RUNNER_NETWORK_POLICY_NAME = exports.RUNNER_REPORT_DIRECTORY = exports.RUNNER_STATE_DIRECTORY = exports.RUNNER_CONTAINER_PREFIX = exports.RUNNER_NAMESPACE = exports.RUNNER_HOST_ENV = void 0;
+    exports.RUNNER_HOST_ENV = {
+      /** `docker` or `kubernetes`. Absent means `docker`; present and wrong is refused by name. */
+      substrate: "RUNVERIC_RUNNER_SUBSTRATE",
+      /** The https origin the runner long-polls. */
+      controlPlaneUrl: "RUNVERIC_CONTROL_PLANE_URL",
+      /** The operator-chosen name, also the container's and the Deployment's. */
+      runnerName: "RUNVERIC_RUNNER_NAME",
+      /** Single-use; spent by the first registration. */
+      registrationToken: "RUNVERIC_RUNNER_REGISTRATION_TOKEN",
+      /** The image the dispatcher starts one container of per step. */
+      stepImage: "RUNVERIC_RUNNER_STEP_IMAGE",
+      /** Optional. Absent means the runner runs built-in actions only. */
+      packageImage: "RUNVERIC_RUNNER_PACKAGE_IMAGE",
+      /** Where the credential and the stashed reports live across restarts. */
+      reportDirectory: "RUNVERIC_RUNNER_REPORT_DIR"
+    };
+    exports.RUNNER_NAMESPACE = "runveric-runner";
+    exports.RUNNER_CONTAINER_PREFIX = "runveric-";
+    exports.RUNNER_STATE_DIRECTORY = "/var/lib/runveric-runner";
+    exports.RUNNER_REPORT_DIRECTORY = `${exports.RUNNER_STATE_DIRECTORY}/reports`;
+    exports.RUNNER_NETWORK_POLICY_NAME = "runveric-confined-egress";
+    exports.POD_MANAGED_BY = "runveric.dev/managed-by";
+    exports.POD_MANAGED_BY_VALUE = "runveric-dispatcher";
+    exports.POD_ROLE = "runveric.dev/role";
+    exports.POD_RUNNER = "runveric.dev/runner";
+    exports.POD_EGRESS_LABEL = "runveric.dev/egress";
+    exports.POD_EGRESS_CONFINED = "confined";
+    exports.POD_ROLE_BROKER = "egress-broker";
+  }
+});
+
+// ../contracts/dist/authoring-cli.js
+var require_authoring_cli = __commonJS({
+  "../contracts/dist/authoring-cli.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.RETIRED_AUTHORING_CLI_ENV = exports.AUTHORING_CLI_ENV = void 0;
+    exports.AUTHORING_CLI_ENV = {
+      /** `runveric publish`: the access token. */
+      token: "RUNVERIC_TOKEN",
+      /** `runveric publish`: the control plane's origin. */
+      url: "RUNVERIC_URL",
+      /** `runveric test`: the runner image to run in, digest-pinned — the Author page shows it. */
+      runnerImage: "RUNVERIC_RUNNER_IMAGE"
+    };
+    exports.RETIRED_AUTHORING_CLI_ENV = {
+      token: "OPERA_TOKEN",
+      url: "OPERA_URL",
+      runnerImage: "OPERA_RUNNER_IMAGE"
+    };
   }
 });
 
@@ -2464,9 +3126,10 @@ var require_runners = __commonJS({
       }, "get")
     });
     var package_provenance_1 = require_package_provenance();
-    exports.RUNNER_REGISTRATION_TOKEN_HEADER = "x-opera-runner-registration-token";
-    exports.RUNNER_CREDENTIAL_HEADER = "x-opera-runner-credential";
-    exports.RUNNER_AUTHORIZATION_TOKEN_HEADER = "x-opera-runner-authorization";
+    var runner_install_1 = require_runner_install();
+    exports.RUNNER_REGISTRATION_TOKEN_HEADER = "x-runveric-runner-registration-token";
+    exports.RUNNER_CREDENTIAL_HEADER = "x-runveric-runner-credential";
+    exports.RUNNER_AUTHORIZATION_TOKEN_HEADER = "x-runveric-runner-authorization";
     exports.RUNNER_POOL_ACCEPTS_PROVENANCE_BY_DEFAULT = {
       // Imported from a Git source this tenant connected. Still not accepted by default: a pool
       // is a machine inside a customer's network, and nothing about it is implied by connecting a
@@ -2480,13 +3143,13 @@ var require_runners = __commonJS({
       authored: false
     };
     exports.RUNNER_POOL_DEFAULT_ACCEPTS_PROVENANCE = package_provenance_1.PACKAGE_PROVENANCE_KINDS.filter((kind) => exports.RUNNER_POOL_ACCEPTS_PROVENANCE_BY_DEFAULT[kind]);
-    function poolAcceptsProvenance(accepts, provenance) {
-      if (provenance === null) return false;
-      return accepts.includes(provenance);
+    function poolAcceptsProvenance(accepts, provenance2) {
+      if (provenance2 === null) return false;
+      return accepts.includes(provenance2);
     }
     __name(poolAcceptsProvenance, "poolAcceptsProvenance");
     function containerNameFor(runnerName) {
-      return `opera-${runnerName.trim()}`;
+      return `${runner_install_1.RUNNER_CONTAINER_PREFIX}${runnerName.trim()}`;
     }
     __name(containerNameFor, "containerNameFor");
     exports.RUNNER_LIFECYCLES = [
@@ -3309,12 +3972,12 @@ var require_workspace_domain = __commonJS({
       "challenge_expired",
       "held_elsewhere"
     ];
-    exports.DOMAIN_VERIFICATION_RECORD_PREFIX = "opera-domain-verification=";
-    function domainVerificationRecord(domain, token) {
+    exports.DOMAIN_VERIFICATION_RECORD_PREFIX = "runveric-domain-verification=";
+    function domainVerificationRecord(domain, token2) {
       return {
         name: domain,
         type: "TXT",
-        value: `${exports.DOMAIN_VERIFICATION_RECORD_PREFIX}${token}`
+        value: `${exports.DOMAIN_VERIFICATION_RECORD_PREFIX}${token2}`
       };
     }
     __name(domainVerificationRecord, "domainVerificationRecord");
@@ -3497,9 +4160,16 @@ var require_dist = __commonJS({
     __exportStar(require_tenant_users(), exports);
     __exportStar(require_invitations(), exports);
     __exportStar(require_groups(), exports);
+    __exportStar(require_catalog_policy(), exports);
     __exportStar(require_catalog(), exports);
+    __exportStar(require_catalog_release(), exports);
+    __exportStar(require_action_repository(), exports);
+    __exportStar(require_catalog_release_spec(), exports);
+    __exportStar(require_catalog_lock(), exports);
+    __exportStar(require_catalog_manifest_placeholders(), exports);
     __exportStar(require_change_control(), exports);
     __exportStar(require_execution(), exports);
+    __exportStar(require_decisions(), exports);
     __exportStar(require_execution_site(), exports);
     __exportStar(require_run_placement(), exports);
     __exportStar(require_connections(), exports);
@@ -3510,12 +4180,15 @@ var require_dist = __commonJS({
     __exportStar(require_scheduling(), exports);
     __exportStar(require_operations(), exports);
     __exportStar(require_runs(), exports);
+    __exportStar(require_evidence_pack(), exports);
     __exportStar(require_package_tier(), exports);
     __exportStar(require_package_provenance(), exports);
     __exportStar(require_packages(), exports);
     __exportStar(require_package_egress(), exports);
     __exportStar(require_package_execution(), exports);
     __exportStar(require_runner_confinement(), exports);
+    __exportStar(require_runner_install(), exports);
+    __exportStar(require_authoring_cli(), exports);
     __exportStar(require_runners(), exports);
     __exportStar(require_runner_pool_presence(), exports);
     __exportStar(require_routable_target(), exports);
@@ -3670,6 +4343,7 @@ var require_manifest_schema = __commonJS({
         return contracts_1.RISK_LEVELS;
       }, "get")
     });
+    var contracts_2 = require_dist();
     exports.MANIFEST_FIELDS = [
       "apiVersion",
       "id",
@@ -3695,7 +4369,7 @@ var require_manifest_schema = __commonJS({
       "secrets",
       "credentialScopes",
       "license",
-      "minOperaVersion"
+      "minRunvericVersion"
     ];
     exports.PACKAGE_ID_PATTERN = /^[a-z0-9-]+\/[a-z0-9-]+$/;
     exports.SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
@@ -3708,12 +4382,18 @@ var require_manifest_schema = __commonJS({
       "properties",
       "required",
       "additionalProperties",
-      // Opera's own annotation, carried INSIDE the schema it orders rather than in a second
+      // Our own annotation, carried INSIDE the schema it orders rather than in a second
       // column: the two would otherwise separate, and a schema whose order lives elsewhere is a
       // schema that renders in the wrong order the first time one of them is copied without the
       // other. Allowed here so a normalized schema round-trips through this validator rather than
       // being rejected as an unknown field.
-      "x-opera-order"
+      //
+      // ⛔ THIS LIST IS A REJECT-UNKNOWN ALLOWLIST. `x-opera-order` left it LAST in docs/108 —
+      // after the writer stopped stamping it, 0089 stripped it from every row, and the readers
+      // stopped reading it. Nothing re-validates a STORED schema (every caller of this validator
+      // is handed authored bytes), so the order was safe; an author's file that still carries the
+      // retired key is now refused by name, as any unknown field is.
+      contracts_2.PARAMETER_ORDER_KEY
     ];
     exports.PARAMETER_PROPERTY_FIELDS = [
       "type",
@@ -3814,7 +4494,7 @@ var require_manifest_validator = __commonJS({
       });
       validateCredentialScopes(value.credentialScopes, errors);
       requiredString(value, "license", errors, manifest_schema_1.SPDX_ID_PATTERN, "an SPDX identifier");
-      requiredString(value, "minOperaVersion", errors, manifest_schema_1.SEMVER_PATTERN, "MAJOR.MINOR.PATCH");
+      requiredString(value, "minRunvericVersion", errors, manifest_schema_1.SEMVER_PATTERN, "MAJOR.MINOR.PATCH");
       return errors.length === 0 && runtime !== void 0 ? {
         ok: true,
         // The normalized runtime replaces the authored one, exactly as `discover` ids are
@@ -3853,7 +4533,7 @@ var require_manifest_validator = __commonJS({
           const declaredType = validateParameterProperty(name, property, errors);
           normalizedProperties[name] = isRecord(property) ? validateDiscoveryAnnotations(name, property, declaredType, value.properties, declarationOrder, context?.providers, errors, warnings) : property;
         }
-        validateParameterOrder(value["x-opera-order"], declarationOrder, errors);
+        validateParameterOrder(value[contracts_1.PARAMETER_ORDER_KEY], contracts_1.PARAMETER_ORDER_KEY, declarationOrder, errors);
       }
       if (!Array.isArray(value.required) || !value.required.every(isString)) {
         add(errors, "parameters.required", "Expected an array of property names.", "type");
@@ -4153,9 +4833,9 @@ var require_manifest_validator = __commonJS({
       }
     }
     __name(validateDependency, "validateDependency");
-    function validateParameterOrder(value, declarationOrder, errors) {
+    function validateParameterOrder(value, key, declarationOrder, errors) {
       if (value === void 0) return;
-      const path = "parameters.x-opera-order";
+      const path = `parameters.${key}`;
       if (!Array.isArray(value) || !value.every(isString)) {
         add(errors, path, "Expected an array of property names.", "type");
         return;
@@ -5011,7 +5691,7 @@ var require_authoring_lint = __commonJS({
         if (!isRecord(permission) || !Array.isArray(permission.actions)) return;
         permission.actions.forEach((action, actionIndex) => {
           if (typeof action !== "string" || action.includes("*")) return;
-          if (permissionTokens(action).some((token) => haystack.includes(token))) return;
+          if (permissionTokens(action).some((token2) => haystack.includes(token2))) return;
           findings.push({
             severity: "warning",
             rule: "package/permission-possibly-unused",
@@ -5086,7 +5766,7 @@ var require_authoring_lint = __commonJS({
       ".sh",
       ".py"
     ];
-    var RESULT_FILE_VARIABLE = "OPERA_RESULT_FILE";
+    var RESULT_FILE_VARIABLE = "RUNVERIC_RESULT_FILE";
     var ENTRYPOINT_PHASES = [
       {
         field: "entrypoint",
@@ -5675,7 +6355,7 @@ summary: ${yamlString(`${input.name} \u2014 describe in one line what an operato
 category: compute
 providers:
   - azure
-connectorKey: opera.package-runner
+connectorKey: ${contracts_1.PACKAGE_RUNNER_CONNECTOR_KEY}
 
 # \u2500\u2500 How it runs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 runtime:
@@ -5715,7 +6395,7 @@ secrets: []
 
 # \u2500\u2500 Publishing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 license: MIT
-minOperaVersion: 1.0.0
+minRunvericVersion: 1.0.0
 `;
     }
     __name(manifest, "manifest");
@@ -5752,12 +6432,12 @@ minOperaVersion: 1.0.0
       return `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 # OPERA'S WRAPPER. This file is the CONTRACT; ${bodyPath} is YOURS.
 #
-# ${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at ${sigil}OPERA_RESULT_FILE. A script
+# ${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at ${sigil}RUNVERIC_RESULT_FILE. A script
 # that exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} says so rather than inventing
 # a result. This file is what makes that impossible to get wrong by accident:
 #
 #   * it starts ${bodyPath} \u2014 your script, unchanged;
-#   * if your script wrote ${sigil}OPERA_RESULT_FILE itself, this file leaves it exactly alone;
+#   * if your script wrote ${sigil}RUNVERIC_RESULT_FILE itself, this file leaves it exactly alone;
 #   * otherwise it writes one for you \u2014 succeeded when your script exits 0, failed with the exit
 #     code and a result.error when it does not \u2014 carrying whatever your script printed as the
 #     message.
@@ -5768,21 +6448,21 @@ minOperaVersion: 1.0.0
 # WHERE YOUR SCRIPT RUNS. This file moves to the PACKAGE ROOT before starting yours, so a
 # relative path in your script means what it meant on your laptop \u2014 \`source ./lib/util.sh\` and
 # \`. ./lib/helpers.ps1\` resolve against the package, not against wherever the runner happened
-# to start. The package root is READ-ONLY and NON-EXECUTABLE: write to ${sigil}OPERA_WORK_DIR,
+# to start. The package root is READ-ONLY and NON-EXECUTABLE: write to ${sigil}RUNVERIC_WORK_DIR,
 # and call another script through your interpreter (\`bash ./tool.sh\`) rather than executing it
-# directly. ${sigil}OPERA_PACKAGE_ROOT is exported so your script can be explicit rather than
+# directly. ${sigil}RUNVERIC_PACKAGE_ROOT is exported so your script can be explicit rather than
 # assume.
 #
 # THE CONTRACT (docs/22), identical in every language:
-#   ${sigil}OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   ${sigil}OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   ${sigil}OPERA_RESULT_FILE       where the result is WRITTEN \u2014 the only result channel
-#   ${sigil}OPERA_DRY_RUN           "true" when the operator asked for a rehearsal. PASSED
+#   ${sigil}RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   ${sigil}RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   ${sigil}RUNVERIC_RESULT_FILE       where the result is WRITTEN \u2014 the only result channel
+#   ${sigil}RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal. PASSED
 #                             THROUGH, never acted on here: only your script knows which of
 #                             its steps change anything.
-#   ${sigil}OPERA_WORK_DIR          scratch space; nothing else is writable
-#   ${sigil}OPERA_PACKAGE_ROOT      this package's root, and the working directory
-# Anything printed to stdout becomes a log line. A line starting with OPERA_EVENT becomes a
+#   ${sigil}RUNVERIC_WORK_DIR          scratch space; nothing else is writable
+#   ${sigil}RUNVERIC_PACKAGE_ROOT      this package's root, and the working directory
+# Anything printed to stdout becomes a log line. A line starting with RUNVERIC_EVENT becomes a
 # structured event.
 #
 # The runner starts run/${entryFile} the same way this file starts ${bodyPath}.
@@ -5829,7 +6509,7 @@ $ErrorActionPreference = 'Continue'
 # setting only the first is a classic way to get a script that resolves paths differently from
 # the tools it calls.
 $operaPackageRoot = (Resolve-Path -LiteralPath (Join-Path $PSScriptRoot '..')).Path
-$env:OPERA_PACKAGE_ROOT = $operaPackageRoot
+$env:RUNVERIC_PACKAGE_ROOT = $operaPackageRoot
 Set-Location -LiteralPath $operaPackageRoot
 [Environment]::CurrentDirectory = $operaPackageRoot
 
@@ -5846,7 +6526,7 @@ $operaCaptured = [System.Collections.Generic.List[string]]::new()
 
 # \u2500\u2500\u2500 THE OPERATOR'S ANSWERS, BOUND TO YOUR OWN param() BLOCK \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 #
-# ${contracts_1.BRAND_SHORT_NAME} delivers the operator's answers as JSON at $env:OPERA_PARAMETERS_FILE. A script written
+# ${contracts_1.BRAND_SHORT_NAME} delivers the operator's answers as JSON at $env:RUNVERIC_PARAMETERS_FILE. A script written
 # outside ${contracts_1.BRAND_SHORT_NAME} receives its values through its param() block. THOSE ARE DIFFERENT MECHANISMS,
 # and nothing joins them unless this file does \u2014 so without the lines below a run form built from
 # a param() block would collect six answers and hand your script none of them.
@@ -5865,7 +6545,7 @@ $operaCaptured = [System.Collections.Generic.List[string]]::new()
 #
 # An answer your script does not declare is IGNORED, not an error \u2014 your script is the authority
 # on what it takes. A script with no param() block gets no arguments at all and reads
-# $env:OPERA_PARAMETERS_FILE itself, exactly as before.
+# $env:RUNVERIC_PARAMETERS_FILE itself, exactly as before.
 $operaDeclared = @()
 try {
     $operaTokens = $null
@@ -5884,10 +6564,10 @@ try {
 }
 
 $operaArguments = @()
-if ($operaDeclared.Count -gt 0 -and (Test-Path -LiteralPath $env:OPERA_PARAMETERS_FILE)) {
+if ($operaDeclared.Count -gt 0 -and (Test-Path -LiteralPath $env:RUNVERIC_PARAMETERS_FILE)) {
     $operaAnswers = $null
     try {
-        $operaAnswers = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
+        $operaAnswers = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
     } catch {
         $operaAnswers = $null
     }
@@ -5939,8 +6619,8 @@ $operaStatus = $LASTEXITCODE
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-$operaWritten = (Test-Path -LiteralPath $env:OPERA_RESULT_FILE) -and
-    ((Get-Item -LiteralPath $env:OPERA_RESULT_FILE).Length -gt 0)
+$operaWritten = (Test-Path -LiteralPath $env:RUNVERIC_RESULT_FILE) -and
+    ((Get-Item -LiteralPath $env:RUNVERIC_RESULT_FILE).Length -gt 0)
 if (-not $operaWritten) {
     $operaOutput = ($operaCaptured -join "\`n").Trim()
     # result.message is bounded at 4096 characters. Keep the TAIL, which is where a failure says
@@ -5965,7 +6645,7 @@ if (-not $operaWritten) {
             }
         }
     }
-    $operaResult | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8
+    $operaResult | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8
 }
 
 # The body's exit code is this package's exit code. ${contracts_1.BRAND_SHORT_NAME} cross-checks the two \u2014 a result that
@@ -5981,16 +6661,16 @@ exit $operaStatus
         return `${wrapperHeader(interpreter, "$", bodyPath)}
 # THE PACKAGE ROOT, and the working directory your script starts in \u2014 so \`source ./lib/util.sh\`
 # resolves against the package rather than against the scratch directory the runner starts in.
-OPERA_PACKAGE_ROOT="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-export OPERA_PACKAGE_ROOT
-cd "\${OPERA_PACKAGE_ROOT}"
+RUNVERIC_PACKAGE_ROOT="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+export RUNVERIC_PACKAGE_ROOT
+cd "\${RUNVERIC_PACKAGE_ROOT}"
 
 # THE ONE PLACE the author's path is written into this file. Everything below refers to the
 # variable, so an entrypoint containing a quote or a \`$\` is a string here and cannot become
 # syntax. The marker is how \`authoredEntrypointOf\` reads this line back \u2014 see that function.
 opera_body_path=${bashLiteral(bodyPath)} # ${ENTRYPOINT_MARKER}
-opera_body="\${OPERA_PACKAGE_ROOT}/\${opera_body_path}"
-opera_capture="\${OPERA_WORK_DIR}/.opera-body-output"
+opera_body="\${RUNVERIC_PACKAGE_ROOT}/\${opera_body_path}"
+opera_capture="\${RUNVERIC_WORK_DIR}/.runveric-body-output"
 
 # Both streams merged, so the transcript below is in the order the operator saw; \`tee\` keeps
 # every line arriving live rather than held until the body ends. errexit is lifted for exactly
@@ -6002,17 +6682,17 @@ set -e
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-if [ ! -s "\${OPERA_RESULT_FILE}" ]; then
-  OPERA_BODY_STATUS="\${opera_status}" OPERA_BODY_CAPTURE="\${opera_capture}" \\
-    OPERA_BODY_PATH="\${opera_body_path}" \\
-    python3 - > "\${OPERA_RESULT_FILE}" <<'PY'
+if [ ! -s "\${RUNVERIC_RESULT_FILE}" ]; then
+  RUNVERIC_BODY_STATUS="\${opera_status}" RUNVERIC_BODY_CAPTURE="\${opera_capture}" \\
+    RUNVERIC_BODY_PATH="\${opera_body_path}" \\
+    python3 - > "\${RUNVERIC_RESULT_FILE}" <<'PY'
 import json, os
 
 ${FALLBACK_RESULT_PYTHON}
 
-with open(os.environ["OPERA_BODY_CAPTURE"], encoding="utf-8", errors="replace") as handle:
+with open(os.environ["RUNVERIC_BODY_CAPTURE"], encoding="utf-8", errors="replace") as handle:
     captured = handle.read()
-print(json.dumps(opera_result(int(os.environ["OPERA_BODY_STATUS"]), captured, os.environ["OPERA_BODY_PATH"])))
+print(json.dumps(opera_result(int(os.environ["RUNVERIC_BODY_STATUS"]), captured, os.environ["RUNVERIC_BODY_PATH"])))
 PY
 fi
 
@@ -6037,7 +6717,7 @@ ${FALLBACK_RESULT_PYTHON}
 # or \`import\` resolves against the package rather than against the scratch directory the runner
 # starts in. os.chdir moves this process, and the body inherits it.
 opera_package_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-os.environ["OPERA_PACKAGE_ROOT"] = opera_package_root
+os.environ["RUNVERIC_PACKAGE_ROOT"] = opera_package_root
 os.chdir(opera_package_root)
 
 # THE ONE PLACE the author's path is written into this file. Everything below refers to the
@@ -6064,7 +6744,7 @@ opera_status = opera_process.wait()
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-opera_result_file = os.environ["OPERA_RESULT_FILE"]
+opera_result_file = os.environ["RUNVERIC_RESULT_FILE"]
 opera_written = os.path.exists(opera_result_file) and os.path.getsize(opera_result_file) > 0
 if not opera_written:
     with open(opera_result_file, "w", encoding="utf-8") as handle:
@@ -6084,27 +6764,27 @@ sys.exit(opera_status)
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   $env:OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   $env:OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   $env:OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   $env:RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   $env:RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   $env:RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                                anything below changes something
-#   $env:OPERA_WORK_DIR          scratch space; nothing else is writable
+#   $env:RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 $env:OPERA_PACKAGE_ROOT \u2014 so
+# WHERE YOU ARE. Your script runs from the package root \u2014 $env:RUNVERIC_PACKAGE_ROOT \u2014 so
 # \`. ./lib/helpers.ps1\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to $env:OPERA_WORK_DIR, and start another script through its
+# and NON-EXECUTABLE: write to $env:RUNVERIC_WORK_DIR, and start another script through its
 # interpreter (\`pwsh ./tool.ps1\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to $env:OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.ps1 says how.
+# to $env:RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.ps1 says how.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
-$parameters = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
-$context = Get-Content -LiteralPath $env:OPERA_CONTEXT_FILE -Raw | ConvertFrom-Json
-$dryRun = $env:OPERA_DRY_RUN -eq 'true'
+$parameters = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
+$context = Get-Content -LiteralPath $env:RUNVERIC_CONTEXT_FILE -Raw | ConvertFrom-Json
+$dryRun = $env:RUNVERIC_DRY_RUN -eq 'true'
 
 # Strict mode makes reading an absent property an error rather than an empty string, so an
 # optional parameter is asked for explicitly. That is the point of strict mode: the failure
@@ -6118,85 +6798,85 @@ Write-Output "Running for execution $($context.executionId)."
 Write-Output "Note: \${note}"
 
 if ($dryRun) {
-    Write-Output 'OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
+    Write-Output 'RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
 } else {
     # Do the real work here.
-    Write-Output 'OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
+    Write-Output 'RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
 }
 `,
       bash: `# YOUR SCRIPT. run/main.sh \u2014 ${contracts_1.BRAND_SHORT_NAME}'s wrapper \u2014 starts this file and writes the run's result
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   $OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   $OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   $OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   $RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   $RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   $RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                            anything below changes something
-#   $OPERA_WORK_DIR          scratch space; nothing else is writable
+#   $RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 $OPERA_PACKAGE_ROOT \u2014 so
+# WHERE YOU ARE. Your script runs from the package root \u2014 $RUNVERIC_PACKAGE_ROOT \u2014 so
 # \`source ./lib/util.sh\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to $OPERA_WORK_DIR, and start another script through its
+# and NON-EXECUTABLE: write to $RUNVERIC_WORK_DIR, and start another script through its
 # interpreter (\`bash ./tool.sh\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to $OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.sh says how.
+# to $RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.sh says how.
 #
 # Started with \`bash -euo pipefail\`, so a failing command ends the run instead of continuing
 # past it.
 
-note="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["OPERA_PARAMETERS_FILE"])).get("note",""))')"
-execution_id="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["OPERA_CONTEXT_FILE"]))["executionId"])')"
+note="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["RUNVERIC_PARAMETERS_FILE"])).get("note",""))')"
+execution_id="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["RUNVERIC_CONTEXT_FILE"]))["executionId"])')"
 
 echo "Running for execution \${execution_id}."
 echo "Note: \${note}"
 
-if [ "\${OPERA_DRY_RUN}" = "true" ]; then
-  echo 'OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
+if [ "\${RUNVERIC_DRY_RUN}" = "true" ]; then
+  echo 'RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
 else
   # Do the real work here.
-  echo 'OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
+  echo 'RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
 fi
 `,
       python: `# YOUR SCRIPT. run/main.py \u2014 ${contracts_1.BRAND_SHORT_NAME}'s wrapper \u2014 starts this file and writes the run's result
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                           anything below changes something
-#   OPERA_WORK_DIR          scratch space; nothing else is writable
+#   RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 OPERA_PACKAGE_ROOT \u2014 so a relative
+# WHERE YOU ARE. Your script runs from the package root \u2014 RUNVERIC_PACKAGE_ROOT \u2014 so a relative
 # \`open()\` or \`import\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to OPERA_WORK_DIR, and start another script through its interpreter
+# and NON-EXECUTABLE: write to RUNVERIC_WORK_DIR, and start another script through its interpreter
 # (\`python3 ./tool.py\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.py says how.
+# to RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.py says how.
 
 import json
 import os
 
-with open(os.environ["OPERA_PARAMETERS_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_PARAMETERS_FILE"], encoding="utf-8") as handle:
     parameters = json.load(handle)
-with open(os.environ["OPERA_CONTEXT_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_CONTEXT_FILE"], encoding="utf-8") as handle:
     context = json.load(handle)
 
-dry_run = os.environ.get("OPERA_DRY_RUN") == "true"
+dry_run = os.environ.get("RUNVERIC_DRY_RUN") == "true"
 note = parameters.get("note", "")
 
 print(f"Running for execution {context['executionId']}.")
 print(f"Note: {note}")
 
 if dry_run:
-    print('OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}')
+    print('RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}')
 else:
     # Do the real work here.
-    print('OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}')
+    print('RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}')
 `
     };
     var VALIDATE_SCRIPT = {
@@ -6209,7 +6889,7 @@ reason, you do not also need result.error.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
-$parameters = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
+$parameters = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
 
 $checks = @(
     [ordered]@{ status = 'passed'; message = 'The note is present.' }
@@ -6221,7 +6901,7 @@ $failed = @($checks | Where-Object { $_.status -eq 'failed' }).Count -gt 0
     status          = if ($failed) { 'failed' } else { 'succeeded' }
     message         = if ($failed) { 'Pre-flight found a blocking problem.' } else { 'Pre-flight passed.' }
     checks          = $checks
-} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8`,
+} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8`,
       bash: `The VALIDATE phase \u2014 a pre-flight that changes nothing.
 Enable it with \`validateEntrypoint: validate/\` in action.yaml, then uncomment this file.
 
@@ -6229,7 +6909,7 @@ A validate result carries CHECKS and no outputs. One entry per thing you checked
 passed / warning / failed. If any check failed, set status to "failed" \u2014 the checks ARE the
 reason, you do not also need result.error.
 
-python3 - <<'PY' > "\${OPERA_RESULT_FILE}"
+python3 - <<'PY' > "\${RUNVERIC_RESULT_FILE}"
 import json
 checks = [{"status": "passed", "message": "The note is present."}]
 failed = any(check["status"] == "failed" for check in checks)
@@ -6253,7 +6933,7 @@ import os
 checks = [{"status": "passed", "message": "The note is present."}]
 failed = any(check["status"] == "failed" for check in checks)
 
-with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_RESULT_FILE"], "w", encoding="utf-8") as handle:
     json.dump(
         {
             "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6269,28 +6949,28 @@ with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at $env:OPERA_PRIOR_RESULT_FILE. That is why a
+Rollback reads what the run phase captured, at $env:RUNVERIC_PRIOR_RESULT_FILE. That is why a
 run that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
-$prior = Get-Content -LiteralPath $env:OPERA_PRIOR_RESULT_FILE -Raw | ConvertFrom-Json
+$prior = Get-Content -LiteralPath $env:RUNVERIC_PRIOR_RESULT_FILE -Raw | ConvertFrom-Json
 
 [ordered]@{
     protocolVersion = '${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}'
     status          = 'succeeded'
     message         = 'Rolled back.'
-} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8`,
+} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8`,
       bash: `The ROLLBACK phase \u2014 undo what the run phase did.
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at $OPERA_PRIOR_RESULT_FILE. That is why a run
+Rollback reads what the run phase captured, at $RUNVERIC_PRIOR_RESULT_FILE. That is why a run
 that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
-python3 - <<'PY' > "\${OPERA_RESULT_FILE}"
+python3 - <<'PY' > "\${RUNVERIC_RESULT_FILE}"
 import json
 print(json.dumps({
     "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6302,17 +6982,17 @@ PY`,
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at OPERA_PRIOR_RESULT_FILE. That is why a run
+Rollback reads what the run phase captured, at RUNVERIC_PRIOR_RESULT_FILE. That is why a run
 that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
 import json
 import os
 
-with open(os.environ["OPERA_PRIOR_RESULT_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_PRIOR_RESULT_FILE"], encoding="utf-8") as handle:
     prior = json.load(handle)
 
-with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_RESULT_FILE"], "w", encoding="utf-8") as handle:
     json.dump(
         {
             "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6339,7 +7019,7 @@ point of it is that the loop below works before you have written anything.
 
 **\`run/${bodyFile}\` is your script. \`run/${entryFile}\` is ${contracts_1.BRAND_SHORT_NAME}'s wrapper.**
 
-${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`OPERA_RESULT_FILE\`. A package that
+${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`RUNVERIC_RESULT_FILE\`. A package that
 exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} refuses it rather than inventing a
 result \u2014 that strictness is what makes every check, output and rollback capture in the product
 worth trusting.
@@ -6347,7 +7027,7 @@ worth trusting.
 \`run/${entryFile}\` is what keeps you on the right side of it. It starts \`run/${bodyFile}\`,
 and then:
 
-- if your script wrote \`OPERA_RESULT_FILE\` itself, it leaves that result exactly alone;
+- if your script wrote \`RUNVERIC_RESULT_FILE\` itself, it leaves that result exactly alone;
 - otherwise it writes one \u2014 **succeeded** when your script exits 0, **failed** with the exit
   code and a \`result.error\` when it does not \u2014 carrying whatever your script printed as the
   message.
@@ -6410,14 +7090,14 @@ script and reports the result.
 
 ## The result contract, and why the wrapper is there
 
-${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`OPERA_RESULT_FILE\`. A package that
+${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`RUNVERIC_RESULT_FILE\`. A package that
 exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} refuses it rather than inventing a
 result \u2014 that strictness is what makes every check, output and rollback capture in the product
 worth trusting.
 
 \`run/${entryFile}\` keeps you on the right side of it. It starts \`${input.entrypoint}\`, and then:
 
-- if your script wrote \`OPERA_RESULT_FILE\` itself, it leaves that result exactly alone;
+- if your script wrote \`RUNVERIC_RESULT_FILE\` itself, it leaves that result exactly alone;
 - otherwise it writes one \u2014 **succeeded** when your script exits 0, **failed** with the exit
   code and a \`result.error\` when it does not \u2014 carrying whatever your script printed as the
   message.
@@ -6426,12 +7106,12 @@ So a script that only prints something is already a complete action.
 
 ## Where your script runs
 
-From the **package root**, which is also \`OPERA_PACKAGE_ROOT\`. That is what makes
+From the **package root**, which is also \`RUNVERIC_PACKAGE_ROOT\`. That is what makes
 \`source ./lib/util.sh\` and \`. ./lib/helpers.ps1\` resolve the way they do on your laptop.
 
 Two things about that directory are worth knowing before your first run:
 
-- it is **read-only** \u2014 write to \`OPERA_WORK_DIR\`, the only writable location;
+- it is **read-only** \u2014 write to \`RUNVERIC_WORK_DIR\`, the only writable location;
 - it is **non-executable** \u2014 start another script through its interpreter
   (\`bash ./tool.sh\`, \`pwsh ./tool.ps1\`) rather than executing it directly.
 
@@ -6486,7 +7166,7 @@ SOFTWARE.
     }
     __name(license, "license");
     var GITIGNORE = `# runveric test writes its scratch here.
-.opera/
+.runveric/
 *.log
 `;
     function yamlString(value) {
@@ -6857,67 +7537,7 @@ var require_dist2 = __commonJS({
 });
 
 // package.json
-var version = "0.1.1";
-
-// src/check.ts
-var import_action_manifest = __toESM(require_dist2());
-import { resolve } from "path";
-
-// src/package-dir.ts
-import { readdir, readFile, stat } from "fs/promises";
-import { join, relative, sep } from "path";
-var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
-  ".git",
-  ".opera",
-  "node_modules",
-  ".venv",
-  "__pycache__",
-  ".DS_Store"
-]);
-var MAX_FILES = 2e3;
-var MAX_TOTAL_BYTES = 16 * 1024 * 1024;
-var PackageDirectoryError = class extends Error {
-  static {
-    __name(this, "PackageDirectoryError");
-  }
-};
-async function readPackageDirectory(root) {
-  const properties = await stat(root).catch(() => null);
-  if (!properties?.isDirectory()) {
-    throw new PackageDirectoryError(`${root} is not a directory.`);
-  }
-  const files = /* @__PURE__ */ new Map();
-  let totalBytes = 0;
-  const walk = /* @__PURE__ */ __name(async (directory) => {
-    for (const entry of await readdir(directory, {
-      withFileTypes: true
-    })) {
-      if (IGNORED_DIRECTORIES.has(entry.name)) continue;
-      const full = join(directory, entry.name);
-      if (entry.isDirectory()) {
-        await walk(full);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      if (files.size >= MAX_FILES) {
-        throw new PackageDirectoryError(`This directory holds more than ${MAX_FILES} files. That is almost certainly not a single action package \u2014 run this from the package directory itself.`);
-      }
-      const contents = await readFile(full);
-      totalBytes += contents.byteLength;
-      if (totalBytes > MAX_TOTAL_BYTES) {
-        throw new PackageDirectoryError(`This directory holds more than ${MAX_TOTAL_BYTES / (1024 * 1024)}MB. An action package is source, not artifacts \u2014 add build output to .gitignore.`);
-      }
-      files.set(toPackagePath(root, full), contents);
-    }
-  }, "walk");
-  await walk(root);
-  return files;
-}
-__name(readPackageDirectory, "readPackageDirectory");
-function toPackagePath(root, full) {
-  return relative(root, full).split(sep).join("/");
-}
-__name(toPackagePath, "toPackagePath");
+var version = "0.2.0";
 
 // src/report.ts
 var useColour = process.stdout.isTTY === true && !process.env.NO_COLOR;
@@ -7026,13 +7646,518 @@ function printResult(result) {
 }
 __name(printResult, "printResult");
 
-// src/check.ts
+// src/catalog/publish-action.ts
+var import_contracts2 = __toESM(require_dist());
+import { readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/catalog/artifact.ts
 var import_contracts = __toESM(require_dist());
-async function runCheck(options) {
-  const directory = resolve(options.directory ?? ".");
-  let files;
-  try {
-    files = await readPackageDirectory(directory);
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+function parseRepository(ref, flag) {
+  if (!import_contracts.ARTIFACT_REPOSITORY_PATTERN.test(ref)) {
+    throw new Error(`${flag} "${ref}" is not a bare registry repository (host[:port]/path, lowercase, no scheme, no tag, no digest). A catalog artifact is addressed by digest; tags are for humans.`);
+  }
+  const cut = ref.indexOf("/");
+  return {
+    ref,
+    host: ref.slice(0, cut),
+    path: ref.slice(cut + 1),
+    namespace: ref.slice(0, ref.lastIndexOf("/"))
+  };
+}
+__name(parseRepository, "parseRepository");
+var isDigest = /* @__PURE__ */ __name((value) => import_contracts.ARTIFACT_DIGEST_PATTERN.test(value), "isDigest");
+var TAG_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+function requireTag(tag, origin2) {
+  if (!TAG_PATTERN.test(tag)) {
+    throw new Error(`${origin2} gives the tag "${tag}", which a registry cannot hold: letters, digits, "_", "." and "-", starting with a letter, digit or "_", at most 128 characters. Pass --tag.`);
+  }
+}
+__name(requireTag, "requireTag");
+var LOOPBACK = /^(localhost|127\.0\.0\.1|\[::1\])(:[0-9]+)?$/;
+var origin = /* @__PURE__ */ __name((host) => `${LOOPBACK.test(host) ? "http" : "https"}://${host}`, "origin");
+var sha256 = /* @__PURE__ */ __name((bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`, "sha256");
+var EMPTY_CONFIG = Buffer.from("{}");
+var EMPTY_CONFIG_DESCRIPTOR = {
+  mediaType: "application/vnd.oci.empty.v1+json",
+  digest: sha256(EMPTY_CONFIG),
+  size: EMPTY_CONFIG.length
+};
+var OCI_MANIFEST = "application/vnd.oci.image.manifest.v1+json";
+function provenance(flags, dir) {
+  const git = /* @__PURE__ */ __name((...args) => {
+    try {
+      return execFileSync("git", [
+        "-C",
+        dir,
+        ...args
+      ], {
+        encoding: "utf8",
+        stdio: [
+          "ignore",
+          "pipe",
+          "ignore"
+        ]
+      }).trim();
+    } catch {
+      return "";
+    }
+  }, "git");
+  const actions = process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}` : "";
+  const repository = flags.repository ?? (actions || git("remote", "get-url", "origin"));
+  const commit = flags.commit ?? (process.env.GITHUB_SHA || git("rev-parse", "HEAD"));
+  if (!repository || !commit) {
+    throw new Error("Provenance is required and could not be determined. Pass --repository <url> and --commit <sha> (in GitHub Actions, GITHUB_REPOSITORY and GITHUB_SHA supply them).");
+  }
+  return {
+    repository,
+    commit,
+    publishedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+__name(provenance, "provenance");
+function buildArtifact(document) {
+  const documentBytes = Buffer.from(`${JSON.stringify(document, null, 2)}
+`);
+  const manifest = {
+    schemaVersion: 2,
+    mediaType: OCI_MANIFEST,
+    artifactType: import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE,
+    config: EMPTY_CONFIG_DESCRIPTOR,
+    layers: [
+      {
+        mediaType: import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE,
+        digest: sha256(documentBytes),
+        size: documentBytes.length
+      }
+    ],
+    /*
+    * ★ SOURCE AND REVISION ARE FOR THE REGISTRY, NOT THE RESOLVER (docs/127 A.1). GHCR connects
+    * a package to its repository through `org.opencontainers.image.source`, and that link is what
+    * lets the repository's workflow token keep publishing to the package its first run created.
+    * The resolver reads none of these — the document's own provenance is the record — so an
+    * artifact published without them still resolves.
+    */
+    annotations: {
+      "org.opencontainers.image.created": document.provenance.publishedAt,
+      "org.opencontainers.image.source": document.provenance.repository,
+      "org.opencontainers.image.revision": document.provenance.commit
+    }
+  };
+  const manifestBytes = Buffer.from(JSON.stringify(manifest));
+  return {
+    documentBytes,
+    manifestBytes,
+    manifestDigest: sha256(manifestBytes)
+  };
+}
+__name(buildArtifact, "buildArtifact");
+function basicCredential() {
+  const pat = process.env.GHCR_TOKEN;
+  if (pat) return Buffer.from(`x:${pat}`).toString("base64");
+  const workflow = process.env.GITHUB_TOKEN;
+  if (workflow) return Buffer.from(`${process.env.GITHUB_ACTOR || "x"}:${workflow}`).toString("base64");
+  return void 0;
+}
+__name(basicCredential, "basicCredential");
+var tokens = /* @__PURE__ */ new Map();
+async function token(repository, challenge) {
+  const field = /* @__PURE__ */ __name((name) => new RegExp(`${name}="([^"]*)"`).exec(challenge ?? "")?.[1], "field");
+  const realm = field("realm");
+  if (!realm) throw new Error(`${repository.host} asked for credentials without a Bearer challenge.`);
+  const url = new URL(realm);
+  const service = field("service");
+  if (service) url.searchParams.set("service", service);
+  url.searchParams.set("scope", `repository:${repository.path}:pull,push`);
+  const credential = basicCredential();
+  const answer = await fetch(url, {
+    headers: credential ? {
+      Authorization: `Basic ${credential}`
+    } : {}
+  });
+  if (!answer.ok) {
+    throw new Error(`${repository.host} refused a push token for ${repository.path}: HTTP ${answer.status}` + (credential ? "." : " \u2014 set GHCR_TOKEN to a token with write:packages, or in a workflow GITHUB_TOKEN with packages: write."));
+  }
+  const body = await answer.json();
+  const value = body.token ?? body.access_token ?? "";
+  tokens.set(repository.path, value);
+  return value;
+}
+__name(token, "token");
+async function call(repository, method, path, { headers = {}, body } = {}) {
+  const url = path.startsWith("http") ? path : `${origin(repository.host)}/v2/${repository.path}/${path}`;
+  const send = /* @__PURE__ */ __name((bearer) => fetch(url, {
+    method,
+    body,
+    redirect: "follow",
+    headers: {
+      ...headers,
+      ...bearer ? {
+        Authorization: `Bearer ${bearer}`
+      } : {}
+    }
+  }), "send");
+  let answer = await send(tokens.get(repository.path));
+  if (answer.status === 401) answer = await send(await token(repository, answer.headers.get("www-authenticate")));
+  return answer;
+}
+__name(call, "call");
+async function pushBlob(repository, bytes) {
+  const digest = sha256(bytes);
+  if ((await call(repository, "HEAD", `blobs/${digest}`)).ok) return digest;
+  const started = await call(repository, "POST", "blobs/uploads/");
+  if (started.status !== 202) throw new Error(`${repository.host} refused an upload: HTTP ${started.status}`);
+  const location = new URL(started.headers.get("location") ?? "", `${origin(repository.host)}/`);
+  location.searchParams.set("digest", digest);
+  const put = await call(repository, "PUT", location.toString(), {
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Length": String(bytes.length)
+    },
+    body: bytes
+  });
+  if (put.status !== 201) throw new Error(`${repository.host} rejected blob ${digest}: HTTP ${put.status} ${await put.text()}`);
+  return digest;
+}
+__name(pushBlob, "pushBlob");
+async function manifestExists(repository, digest) {
+  const answer = await call(repository, "HEAD", `manifests/${digest}`, {
+    headers: {
+      Accept: OCI_MANIFEST
+    }
+  });
+  return answer.ok;
+}
+__name(manifestExists, "manifestExists");
+async function pushArtifact(repository, artifact, tag) {
+  await pushBlob(repository, EMPTY_CONFIG);
+  await pushBlob(repository, artifact.documentBytes);
+  for (const reference of [
+    artifact.manifestDigest,
+    tag
+  ]) {
+    const put = await call(repository, "PUT", `manifests/${reference}`, {
+      headers: {
+        "Content-Type": OCI_MANIFEST
+      },
+      body: artifact.manifestBytes
+    });
+    if (put.status !== 201) {
+      throw new Error(`${repository.host} rejected the manifest (${reference}): HTTP ${put.status} ${await put.text()}`);
+    }
+  }
+  const asked = await call(repository, "HEAD", `manifests/${tag}`, {
+    headers: {
+      Accept: OCI_MANIFEST
+    }
+  });
+  const reported = asked.headers.get("docker-content-digest");
+  if (!asked.ok || !reported) {
+    throw new Error(`${repository.host} could not say what :${tag} resolves to (HTTP ${asked.status}).`);
+  }
+  if (reported !== artifact.manifestDigest) {
+    throw new Error(`${repository.host} reports :${tag} as ${reported}, but the bytes sent hash to ${artifact.manifestDigest}. Something re-encoded the manifest; nothing printed here would name what is stored. Refusing to report a digest.`);
+  }
+  return reported;
+}
+__name(pushArtifact, "pushArtifact");
+var defaultTag = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").toLowerCase(), "defaultTag");
+
+// src/catalog/flags.ts
+function parseCatalogFlags(argv, known, repeated = []) {
+  const single = {};
+  const many = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    const separator = argument.indexOf("=");
+    const name = separator === -1 ? argument.slice(2) : argument.slice(2, separator);
+    if (!argument.startsWith("--") || !known.includes(name)) throw new Error(`Unknown argument: ${argument}`);
+    let value;
+    if (separator !== -1) {
+      value = argument.slice(separator + 1);
+    } else {
+      value = argv[index + 1];
+      index += 1;
+    }
+    if (value === void 0 || value === "" || value.startsWith("--")) throw new Error(`--${name} needs a value.`);
+    if (repeated.includes(name)) (many[name] ??= []).push(value);
+    else single[name] = value;
+  }
+  return {
+    single,
+    many
+  };
+}
+__name(parseCatalogFlags, "parseCatalogFlags");
+
+// src/catalog/publish-action.ts
+var PUBLISH_ACTION_USAGE = "runveric catalog publish-action --manifest <file.yaml> --to <registry>/<namespace>/<repository>\n                                [--tag <tag>] [--repository <source url>] [--commit <sha>]";
+var isMapping = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+async function runPublishAction(argv) {
+  const { single: flags } = parseCatalogFlags(argv, [
+    "manifest",
+    "to",
+    "tag",
+    "repository",
+    "commit"
+  ]);
+  if (!flags.manifest || !flags.to) throw new Error("--manifest and --to are required.");
+  const repository = parseRepository(flags.to, "--to");
+  const path = resolve(flags.manifest);
+  const manifest = readFileSync(path, "utf8");
+  let parsed;
+  try {
+    parsed = parseYaml(manifest);
+  } catch (cause) {
+    throw new Error(`${flags.manifest} is not valid YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const fields = isMapping(parsed) ? parsed : {};
+  const key = typeof fields.key === "string" && fields.key.length > 0 ? fields.key : null;
+  if (key === null) throw new Error(`${flags.manifest} declares no top-level \`key:\` \u2014 is it a catalog manifest?`);
+  const misnamed = (0, import_contracts2.actionPackageRefusal)(key, repository.ref);
+  if (misnamed !== null) throw new Error(`--to: ${misnamed}`);
+  let tag;
+  if (fields.declares === "definition+version") {
+    const version2 = typeof fields.version === "string" ? fields.version : null;
+    if (version2 === null) throw new Error(`${flags.manifest} declares "definition+version" and no version:.`);
+    if (flags.tag !== void 0 && flags.tag !== version2) {
+      throw new Error(`${flags.manifest} declares version ${version2}, and the tag is ${flags.tag}. Tag the commit ${version2}, or change version: in ${flags.manifest} first.`);
+    }
+    tag = version2;
+  } else {
+    tag = flags.tag ?? defaultTag();
+  }
+  requireTag(tag, flags.tag !== void 0 ? "--tag" : `${flags.manifest}'s version`);
+  const artifact = buildArtifact({
+    schemaVersion: import_contracts2.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+    manifest,
+    provenance: provenance(flags, dirname(path))
+  });
+  const digest = await pushArtifact(repository, artifact, tag);
+  process.stderr.write(`\u2713 ${key} published to ${repository.ref}:${tag}
+`);
+  process.stderr.write(`  the registry reports ${digest} \u2014 the digest a release must name.
+`);
+  process.stdout.write(`${key}=${repository.ref}@${digest}
+`);
+}
+__name(runPublishAction, "runPublishAction");
+
+// src/catalog/publish-release.ts
+var import_contracts3 = __toESM(require_dist());
+import { readFileSync as readFileSync2 } from "fs";
+import { parse as parseYaml2 } from "yaml";
+var PUBLISH_RELEASE_USAGE = "runveric catalog publish-release (--from <release.yaml> | --action <key>=<repository>@<digest> \u2026)\n                                 --to <registry>/<namespace>/<repository> [--version <label>]\n                                 [--tag <tag>] [--repository <source url>] [--commit <sha>]";
+function entriesFromFlags(values) {
+  return values.map((value) => {
+    const match = /^([^=]+)=([^@]+)@(.+)$/.exec(value);
+    if (!match) throw new Error(`--action "${value}" is not <key>=<repository>@<digest>.`);
+    const [, key = "", artifactRef = "", digest = ""] = match;
+    return {
+      key,
+      artifactRef,
+      digest,
+      label: `--action ${key}`
+    };
+  });
+}
+__name(entriesFromFlags, "entriesFromFlags");
+function specFromFile(path) {
+  let value;
+  try {
+    value = parseYaml2(readFileSync2(path, "utf8"));
+  } catch (cause) {
+    throw new Error(`--from ${path} could not be read as YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const spec = (0, import_contracts3.parseCatalogReleaseSpec)(value);
+  return {
+    version: spec.version,
+    entries: spec.actions.map((action) => ({
+      ...action,
+      label: `${path}'s ${action.key}`
+    }))
+  };
+}
+__name(specFromFile, "specFromFile");
+async function runPublishRelease(argv) {
+  const { single: flags, many } = parseCatalogFlags(argv, [
+    "to",
+    "version",
+    "action",
+    "from",
+    "tag",
+    "repository",
+    "commit"
+  ], [
+    "action"
+  ]);
+  const actionFlags = many.action ?? [];
+  if (flags.from !== void 0 && actionFlags.length > 0) {
+    throw new Error("--from and --action are alternatives: name the release's actions in release.yaml or as flags, not both.");
+  }
+  if (flags.from !== void 0 && flags.version !== void 0) {
+    throw new Error("--version is read from release.yaml when --from is given; pass one or the other.");
+  }
+  if (!flags.to || flags.from === void 0 && (!flags.version || actionFlags.length === 0)) {
+    throw new Error("--to and either --from, or --version and at least one --action, are required.");
+  }
+  const release = parseRepository(flags.to, "--to");
+  const { version: version2, entries } = flags.from !== void 0 ? specFromFile(flags.from) : {
+    version: flags.version,
+    entries: entriesFromFlags(actionFlags)
+  };
+  const tag = flags.tag ?? (flags.from !== void 0 ? version2 : defaultTag());
+  requireTag(tag, flags.tag !== void 0 ? "--tag" : `${flags.from}'s version`);
+  const seen = /* @__PURE__ */ new Set();
+  const actions = entries.map((entry) => {
+    if (seen.has(entry.key)) throw new Error(`${entry.label} names "${entry.key}" twice.`);
+    seen.add(entry.key);
+    const repository = parseRepository(entry.artifactRef, entry.label);
+    if (repository.namespace !== release.namespace) {
+      throw new Error(`${entry.label} lives in "${repository.namespace}", outside the release's namespace "${release.namespace}". The server refuses a release that sends it to another host or org.`);
+    }
+    if (!isDigest(entry.digest)) {
+      throw new Error(`${entry.label}: "${entry.digest}" is not a digest. A release names artifacts by digest only.`);
+    }
+    const misnamed = (0, import_contracts3.actionPackageRefusal)(entry.key, entry.artifactRef);
+    if (misnamed !== null) throw new Error(`${entry.label}: ${misnamed}`);
+    return {
+      ...entry,
+      repository
+    };
+  });
+  for (const action of actions) {
+    if (!await manifestExists(action.repository, action.digest)) {
+      throw new Error(`${action.artifactRef}@${action.digest} (${action.key}) is not in the registry.`);
+    }
+  }
+  const artifact = buildArtifact({
+    schemaVersion: import_contracts3.CATALOG_RELEASE_SCHEMA_V1,
+    version: version2,
+    provenance: provenance(flags, process.cwd()),
+    actions: actions.map(({ key, artifactRef, digest: digest2 }) => ({
+      key,
+      artifactRef,
+      digest: digest2
+    }))
+  });
+  const digest = await pushArtifact(release, artifact, tag);
+  process.stderr.write(`\u2713 catalog release ${version2} (${actions.length} action artifact(s)) published to ${release.ref}:${tag}
+`);
+  process.stderr.write(`  the registry reports ${digest} \u2014 the digest to plan and pin.
+`);
+  process.stdout.write(`${release.ref}@${digest}
+`);
+}
+__name(runPublishRelease, "runPublishRelease");
+
+// src/catalog/index.ts
+var CATALOG_USAGE = `runveric catalog \u2014 publish first-party catalog artifacts (docs/127)
+
+  ${PUBLISH_ACTION_USAGE}
+      Publish one action's manifest, verbatim, as an artifact. stdout: <key>=<repository>@<digest>
+
+  ${PUBLISH_RELEASE_USAGE}
+      Publish a release naming each action artifact by digest. stdout: <repository>@<digest>
+
+  Credentials: GHCR_TOKEN (write:packages), or in a workflow GITHUB_TOKEN with packages: write.
+  Provenance: --repository/--commit, else GITHUB_SERVER_URL/GITHUB_REPOSITORY and GITHUB_SHA, else git.`;
+var SUBCOMMANDS = {
+  "publish-action": runPublishAction,
+  "publish-release": runPublishRelease
+};
+async function runCatalog(argv) {
+  const [subcommand, ...rest] = argv;
+  if (subcommand === void 0 || subcommand === "--help" || rest.includes("--help")) {
+    process.stdout.write(`${CATALOG_USAGE}
+`);
+    return subcommand === void 0 ? 1 : 0;
+  }
+  const run3 = SUBCOMMANDS[subcommand];
+  if (run3 === void 0) {
+    printError(`\u2717 "catalog ${subcommand}" is not a command. There are two: ${Object.keys(SUBCOMMANDS).join(", ")}.`);
+    return 1;
+  }
+  try {
+    await run3(rest);
+    return 0;
+  } catch (error) {
+    printError(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+__name(runCatalog, "runCatalog");
+
+// src/check.ts
+var import_action_manifest = __toESM(require_dist2());
+import { resolve as resolve2 } from "path";
+
+// src/package-dir.ts
+import { readdir, readFile, stat } from "fs/promises";
+import { join, relative, sep } from "path";
+var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".runveric",
+  "node_modules",
+  ".venv",
+  "__pycache__",
+  ".DS_Store"
+]);
+var MAX_FILES = 2e3;
+var MAX_TOTAL_BYTES = 16 * 1024 * 1024;
+var PackageDirectoryError = class extends Error {
+  static {
+    __name(this, "PackageDirectoryError");
+  }
+};
+async function readPackageDirectory(root) {
+  const properties = await stat(root).catch(() => null);
+  if (!properties?.isDirectory()) {
+    throw new PackageDirectoryError(`${root} is not a directory.`);
+  }
+  const files = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  const walk = /* @__PURE__ */ __name(async (directory) => {
+    for (const entry of await readdir(directory, {
+      withFileTypes: true
+    })) {
+      if (IGNORED_DIRECTORIES.has(entry.name)) continue;
+      const full = join(directory, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (files.size >= MAX_FILES) {
+        throw new PackageDirectoryError(`This directory holds more than ${MAX_FILES} files. That is almost certainly not a single action package \u2014 run this from the package directory itself.`);
+      }
+      const contents = await readFile(full);
+      totalBytes += contents.byteLength;
+      if (totalBytes > MAX_TOTAL_BYTES) {
+        throw new PackageDirectoryError(`This directory holds more than ${MAX_TOTAL_BYTES / (1024 * 1024)}MB. An action package is source, not artifacts \u2014 add build output to .gitignore.`);
+      }
+      files.set(toPackagePath(root, full), contents);
+    }
+  }, "walk");
+  await walk(root);
+  return files;
+}
+__name(readPackageDirectory, "readPackageDirectory");
+function toPackagePath(root, full) {
+  return relative(root, full).split(sep).join("/");
+}
+__name(toPackagePath, "toPackagePath");
+
+// src/check.ts
+var import_contracts4 = __toESM(require_dist());
+async function runCheck(options) {
+  const directory = resolve2(options.directory ?? ".");
+  let files;
+  try {
+    files = await readPackageDirectory(directory);
   } catch (error) {
     printError(style.red(error instanceof Error ? error.message : String(error)));
     return 1;
@@ -7051,7 +8176,7 @@ async function runCheck(options) {
     print(style.red("This package would be REFUSED at import."));
   } else if (report.lintBlocked) {
     print();
-    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
+    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts4.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
   }
   if (report.advisoryCount > 0) {
     print();
@@ -7071,11 +8196,11 @@ async function runCheck(options) {
 __name(runCheck, "runCheck");
 
 // src/init.ts
-var import_contracts2 = __toESM(require_dist());
+var import_contracts5 = __toESM(require_dist());
 var import_action_manifest2 = __toESM(require_dist2());
 import { mkdir, writeFile } from "fs/promises";
 import { createInterface } from "readline/promises";
-import { dirname, join as join2, resolve as resolve2 } from "path";
+import { dirname as dirname2, join as join2, resolve as resolve3 } from "path";
 async function runInit(options) {
   const interactive = process.stdin.isTTY === true && options.yes !== true;
   const ask = interactive ? prompter() : null;
@@ -7087,7 +8212,7 @@ async function runInit(options) {
     const interpreter = await resolveInterpreter(options.interpreter, ask);
     if (!interpreter) return 1;
     const author = options.author?.trim() || await ask?.("Author", id.split("/")[0]) || id.split("/")[0];
-    const directory = resolve2(options.directory ?? id.split("/")[1] ?? "action");
+    const directory = resolve3(options.directory ?? id.split("/")[1] ?? "action");
     const files = (0, import_action_manifest2.scaffoldActionPackage)({
       id,
       name,
@@ -7097,7 +8222,7 @@ async function runInit(options) {
     });
     for (const [path, contents] of files) {
       const target = join2(directory, path);
-      await mkdir(dirname(target), {
+      await mkdir(dirname2(target), {
         recursive: true
       });
       await writeFile(target, contents, {
@@ -7140,9 +8265,9 @@ async function resolveId(supplied, ask) {
 }
 __name(resolveId, "resolveId");
 async function resolveInterpreter(supplied, ask) {
-  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts2.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
+  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts5.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
   if (!isInterpreter(value)) {
-    printError(style.red(`"${value}" is not an interpreter ${import_contracts2.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts2.PACKAGE_INTERPRETERS.join(", ")}.`);
+    printError(style.red(`"${value}" is not an interpreter ${import_contracts5.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts5.PACKAGE_INTERPRETERS.join(", ")}.`);
     return null;
   }
   return value;
@@ -7163,7 +8288,7 @@ function prompter() {
 }
 __name(prompter, "prompter");
 function isInterpreter(value) {
-  return import_contracts2.PACKAGE_INTERPRETERS.includes(value);
+  return import_contracts5.PACKAGE_INTERPRETERS.includes(value);
 }
 __name(isInterpreter, "isInterpreter");
 function titleCase(value) {
@@ -7173,20 +8298,38 @@ __name(titleCase, "titleCase");
 
 // src/publish.ts
 var import_action_manifest3 = __toESM(require_dist2());
-var import_contracts3 = __toESM(require_dist());
-import { resolve as resolve3 } from "path";
-var TOKEN_ENV = "OPERA_TOKEN";
-var URL_ENV = "OPERA_URL";
+var import_contracts6 = __toESM(require_dist());
+import { resolve as resolve4 } from "path";
+
+// src/renamed-variable.ts
+function renamedVariableRefusal(current, retired, env = process.env) {
+  if (env[current]?.trim()) return null;
+  if (!env[retired]?.trim()) return null;
+  return `${retired} is set, but this CLI reads ${current} \u2014 the variable was renamed in 0.1.2. Rename the export in your shell or CI; ${retired} is no longer read.`;
+}
+__name(renamedVariableRefusal, "renamedVariableRefusal");
+
+// src/publish.ts
+var TOKEN_ENV = import_contracts6.AUTHORING_CLI_ENV.token;
+var URL_ENV = import_contracts6.AUTHORING_CLI_ENV.url;
 async function runPublish(options) {
-  const directory = resolve3(options.directory ?? ".");
+  const directory = resolve4(options.directory ?? ".");
   const baseUrl = (options.to ?? process.env[URL_ENV] ?? "").trim().replace(/\/+$/, "");
-  const token = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
+  const token2 = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
+  const stale = [
+    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts6.RETIRED_AUTHORING_CLI_ENV.url) : null,
+    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts6.RETIRED_AUTHORING_CLI_ENV.token) : null
+  ].filter((sentence) => sentence !== null);
+  if (stale.length > 0) {
+    for (const sentence of stale) printError(style.red(sentence));
+    return 1;
+  }
   if (!baseUrl) {
-    printError(style.red("Where to?") + ` Pass --to https://your-opera.example.com, or set ${URL_ENV}.`);
+    printError(style.red("Where to?") + ` Pass --to https://your-runveric.example.com, or set ${URL_ENV}.`);
     return 1;
   }
-  if (!token) {
-    printError(style.red(`Publishing needs ${import_contracts3.BRAND_ARTICLE} ${import_contracts3.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
+  if (!token2) {
+    printError(style.red(`Publishing needs ${import_contracts6.BRAND_ARTICLE} ${import_contracts6.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
     return 1;
   }
   let files;
@@ -7206,7 +8349,7 @@ async function runPublish(options) {
       errors: report.errorCount,
       warnings: report.warningCount
     });
-    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts3.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
+    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts6.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
     return 1;
   }
   if (report.advisoryCount > 0) {
@@ -7233,7 +8376,7 @@ async function runPublish(options) {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${token}`
+        authorization: `Bearer ${token2}`
       },
       body
     });
@@ -7253,7 +8396,7 @@ Publish refused (${response.status}).`));
   try {
     version2 = JSON.parse(text);
   } catch {
-    printError(style.red(`${import_contracts3.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
+    printError(style.red(`${import_contracts6.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
     return 1;
   }
   print();
@@ -7262,7 +8405,7 @@ Publish refused (${response.status}).`));
   print(`  content digest ${version2.contentDigest}`);
   print(`  tier           ${version2.tier} ${style.grey(`(${version2.provenance})`)}`);
   print();
-  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts3.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
+  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts6.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
   print();
   return 0;
 }
@@ -7274,29 +8417,102 @@ function formatProblem(text) {
   } catch {
     return `  ${text}`;
   }
-  const problem = (0, import_contracts3.parseProblemDocument)(parsed);
+  const problem = (0, import_contracts6.parseProblemDocument)(parsed);
   if (!problem) return `  ${text}`;
   const lines = [];
   if (problem.detail) lines.push(`  ${problem.detail}`);
-  for (const error of (0, import_contracts3.problemFieldErrors)(problem)) {
+  for (const error of (0, import_contracts6.problemFieldErrors)(problem)) {
     lines.push(error.field ? `  ${style.bold(error.field)}: ${error.message}` : `  ${error.message}`);
   }
   return lines.length > 0 ? lines.join("\n") : `  ${text}`;
 }
 __name(formatProblem, "formatProblem");
 
+// src/runner-image.ts
+var import_contracts7 = __toESM(require_dist());
+import { execFile } from "child_process";
+import { promisify } from "util";
+var run = promisify(execFile);
+var LOCAL_RUNNER_IMAGE = "runveric-package-runner:local";
+var RUNNER_IMAGE_ENV = import_contracts7.AUTHORING_CLI_ENV.runnerImage;
+var RenamedVariableError = class extends Error {
+  static {
+    __name(this, "RenamedVariableError");
+  }
+};
+function resolveRunnerImage(flag) {
+  const explicit = flag?.trim();
+  if (explicit) return {
+    reference: explicit,
+    origin: "flag"
+  };
+  const configured = process.env[RUNNER_IMAGE_ENV]?.trim();
+  if (configured) return {
+    reference: configured,
+    origin: "environment"
+  };
+  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts7.RETIRED_AUTHORING_CLI_ENV.runnerImage);
+  if (stale) throw new RenamedVariableError(stale);
+  return {
+    reference: LOCAL_RUNNER_IMAGE,
+    origin: "local-build"
+  };
+}
+__name(resolveRunnerImage, "resolveRunnerImage");
+function runnerImageNote(image) {
+  switch (image.origin) {
+    case "flag":
+      return "from --image";
+    case "environment":
+      return `from ${RUNNER_IMAGE_ENV}`;
+    case "local-build":
+      return `locally built \u2014 NOT the image your ${import_contracts7.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
+  }
+}
+__name(runnerImageNote, "runnerImageNote");
+var DockerMissingError = class extends Error {
+  static {
+    __name(this, "DockerMissingError");
+  }
+};
+async function assertDockerAvailable() {
+  try {
+    await run("docker", [
+      "version",
+      "--format",
+      "{{.Server.Version}}"
+    ]);
+  } catch {
+    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts7.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
+  }
+}
+__name(assertDockerAvailable, "assertDockerAvailable");
+async function imageIsPresent(reference) {
+  try {
+    await run("docker", [
+      "image",
+      "inspect",
+      reference
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(imageIsPresent, "imageIsPresent");
+
 // src/test.ts
 var import_action_manifest4 = __toESM(require_dist2());
 import { spawn } from "child_process";
 import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join3, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve5 } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/azure-credential.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var run = promisify(execFile);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var run2 = promisify2(execFile2);
 var AzureCredentialError = class extends Error {
   static {
     __name(this, "AzureCredentialError");
@@ -7313,7 +8529,7 @@ async function acquireAzureCredential() {
   if (!account.id || !account.tenantId) {
     throw new AzureCredentialError("`az account show` returned no subscription. Run `az login` and `az account set --subscription <id>` first.");
   }
-  const token = await azJson([
+  const token2 = await azJson([
     "account",
     "get-access-token",
     "--resource",
@@ -7321,11 +8537,11 @@ async function acquireAzureCredential() {
     "--output",
     "json"
   ]);
-  if (!token.accessToken) {
+  if (!token2.accessToken) {
     throw new AzureCredentialError("`az account get-access-token` returned no access token.");
   }
   return {
-    token: token.accessToken,
+    token: token2.accessToken,
     // The identical names the credential adapter puts in a lease, so a package reads the same
     // environment here and in production.
     env: {
@@ -7343,7 +8559,7 @@ __name(acquireAzureCredential, "acquireAzureCredential");
 async function azJson(args) {
   let stdout;
   try {
-    ({ stdout } = await run("az", args, {
+    ({ stdout } = await run2("az", args, {
       maxBuffer: 8 * 1024 * 1024
     }));
   } catch (error) {
@@ -7359,91 +8575,25 @@ ${message.trim()}`);
 }
 __name(azJson, "azJson");
 
-// src/runner-image.ts
-var import_contracts4 = __toESM(require_dist());
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var run2 = promisify2(execFile2);
-var LOCAL_RUNNER_IMAGE = "opera-package-runner:local";
-var RUNNER_IMAGE_ENV = "OPERA_RUNNER_IMAGE";
-function resolveRunnerImage(flag) {
-  const explicit = flag?.trim();
-  if (explicit) return {
-    reference: explicit,
-    origin: "flag"
-  };
-  const configured = process.env[RUNNER_IMAGE_ENV]?.trim();
-  if (configured) return {
-    reference: configured,
-    origin: "environment"
-  };
-  return {
-    reference: LOCAL_RUNNER_IMAGE,
-    origin: "local-build"
-  };
-}
-__name(resolveRunnerImage, "resolveRunnerImage");
-function runnerImageNote(image) {
-  switch (image.origin) {
-    case "flag":
-      return "from --image";
-    case "environment":
-      return `from ${RUNNER_IMAGE_ENV}`;
-    case "local-build":
-      return `locally built \u2014 NOT the image your ${import_contracts4.BRAND_SHORT_NAME} runs; set OPERA_RUNNER_IMAGE to match it`;
-  }
-}
-__name(runnerImageNote, "runnerImageNote");
-var DockerMissingError = class extends Error {
-  static {
-    __name(this, "DockerMissingError");
-  }
-};
-async function assertDockerAvailable() {
-  try {
-    await run2("docker", [
-      "version",
-      "--format",
-      "{{.Server.Version}}"
-    ]);
-  } catch {
-    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts4.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
-  }
-}
-__name(assertDockerAvailable, "assertDockerAvailable");
-async function imageIsPresent(reference) {
-  try {
-    await run2("docker", [
-      "image",
-      "inspect",
-      reference
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-__name(imageIsPresent, "imageIsPresent");
-
 // src/test.ts
-var import_contracts5 = __toESM(require_dist());
+var import_contracts8 = __toESM(require_dist());
 var PHASES = [
   "validate",
   "run",
   "rollback"
 ];
 var CONTAINER = {
-  packageRoot: "/opera/package",
-  input: "/opera/input",
-  output: "/opera/output",
-  scratch: "/opera/scratch",
-  creds: "/opera/creds"
+  packageRoot: "/runveric/package",
+  input: "/runveric/input",
+  output: "/runveric/output",
+  scratch: "/runveric/scratch",
+  creds: "/runveric/creds"
 };
 async function runTest(options) {
-  const directory = resolve4(options.directory ?? ".");
+  const directory = resolve5(options.directory ?? ".");
   const phase = options.phase ?? "run";
   if (!PHASES.includes(phase)) {
-    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts5.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
+    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts8.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
     return 1;
   }
   let files;
@@ -7476,7 +8626,13 @@ async function runTest(options) {
     printError(style.red(error instanceof Error ? error.message : String(error)));
     return 1;
   }
-  const image = resolveRunnerImage(options.image);
+  let image;
+  try {
+    image = resolveRunnerImage(options.image);
+  } catch (error) {
+    printError(style.red(error instanceof Error ? error.message : String(error)));
+    return 1;
+  }
   try {
     await assertDockerAvailable();
   } catch (error) {
@@ -7509,13 +8665,13 @@ async function runTest(options) {
     print(`  runner image   ${image.reference} ${style.grey(`(${runnerImageNote(image)})`)}`);
     print(`  interpreter    ${interpreter}@${manifest.runtime.version}`);
     print(`  entrypoint     ${entrypoint}${import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[interpreter].entryFile}`);
-    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts5.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
+    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts8.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
     if (manifest.requiresNetwork) {
-      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts5.BRAND_SHORT_NAME} enforces it`)}`);
+      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts8.BRAND_SHORT_NAME} enforces it`)}`);
     } else {
       print(`  network        ${style.grey("none \u2014 this package declares requiresNetwork: false")}`);
     }
-    if (options.dryRun) print(`  ${style.bold("dry run")}       OPERA_DRY_RUN=true`);
+    if (options.dryRun) print(`  ${style.bold("dry run")}       RUNVERIC_DRY_RUN=true`);
     if (!await imageIsPresent(image.reference)) {
       print(`  ${style.grey("pulling the image (first run only)\u2026")}`);
     }
@@ -7613,13 +8769,13 @@ async function materialize(workspace, input) {
   })));
   for (const [path, contents] of input.files) {
     const target = join3(layout.packageRoot, path);
-    await mkdir2(dirname2(target), {
+    await mkdir2(dirname3(target), {
       recursive: true
     });
     await writeFile2(target, contents);
   }
   const context = {
-    protocolVersion: import_contracts5.PACKAGE_EXECUTION_PROTOCOL_VERSION,
+    protocolVersion: import_contracts8.PACKAGE_EXECUTION_PROTOCOL_VERSION,
     // A recognisable id rather than a random uuid: it appears in the package's own log lines,
     // and "local-test" tells the reader instantly that this was not a real run.
     executionId: "local-test",
@@ -7645,27 +8801,27 @@ async function runContainer(options) {
   const launch = import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[options.interpreter];
   const script = `${CONTAINER.packageRoot}/${options.entrypoint}${launch.entryFile}`;
   const environment = {
-    OPERA_PROTOCOL_VERSION: import_contracts5.PACKAGE_RESULT_PROTOCOL_VERSION,
-    OPERA_PHASE: options.phase,
-    OPERA_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
-    OPERA_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
-    OPERA_RESULT_FILE: `${CONTAINER.output}/result.json`,
-    OPERA_WORK_DIR: CONTAINER.scratch,
-    OPERA_CANCEL_FILE: `${CONTAINER.input}/cancel.requested`,
-    OPERA_DRY_RUN: options.dryRun ? "true" : "false",
+    RUNVERIC_PROTOCOL_VERSION: import_contracts8.PACKAGE_RESULT_PROTOCOL_VERSION,
+    RUNVERIC_PHASE: options.phase,
+    RUNVERIC_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
+    RUNVERIC_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
+    RUNVERIC_RESULT_FILE: `${CONTAINER.output}/result.json`,
+    RUNVERIC_WORK_DIR: CONTAINER.scratch,
+    RUNVERIC_CANCEL_FILE: `${CONTAINER.input}/cancel.requested`,
+    RUNVERIC_DRY_RUN: options.dryRun ? "true" : "false",
     // HONEST, and matching the ACA runner's own reasoning: this flag means "there is no route
     // out at all". A container with `--network none` genuinely has none; one with a network
     // does not, whether or not an allowlist would have applied.
-    OPERA_NETWORK_ISOLATED: options.requiresNetwork ? "false" : "true",
+    RUNVERIC_NETWORK_ISOLATED: options.requiresNetwork ? "false" : "true",
     LANG: "C.UTF-8",
     LC_ALL: "C.UTF-8",
     POWERSHELL_TELEMETRY_OPTOUT: "1",
     DOTNET_CLI_TELEMETRY_OPTOUT: "1",
     ...options.layout.hasPriorResult ? {
-      OPERA_PRIOR_RESULT_FILE: `${CONTAINER.input}/prior-result.json`
+      RUNVERIC_PRIOR_RESULT_FILE: `${CONTAINER.input}/prior-result.json`
     } : {},
     ...options.layout.hasCredential ? {
-      OPERA_AZURE_TOKEN_FILE: `${CONTAINER.creds}/azure-token`
+      RUNVERIC_AZURE_TOKEN_FILE: `${CONTAINER.creds}/azure-token`
     } : {},
     ...options.credentialEnv ?? {}
   };
@@ -7748,7 +8904,7 @@ async function runContainer(options) {
 __name(runContainer, "runContainer");
 function emitLine(line, stderr, onEvent) {
   if (line.length === 0) return;
-  const prefix = "OPERA_EVENT ";
+  const prefix = "RUNVERIC_EVENT ";
   if (!stderr && line.startsWith(prefix)) {
     try {
       const parsed = JSON.parse(line.slice(prefix.length));
@@ -7760,7 +8916,7 @@ function emitLine(line, stderr, onEvent) {
     }
     onEvent({
       level: "warn",
-      message: "Package emitted malformed OPERA_EVENT JSON."
+      message: "Package emitted malformed RUNVERIC_EVENT JSON."
     });
     return;
   }
@@ -7772,13 +8928,13 @@ function emitLine(line, stderr, onEvent) {
 __name(emitLine, "emitLine");
 async function reportOutcome(options) {
   if (options.exit.timedOut) {
-    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts5.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
+    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts8.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
     return 1;
   }
   const exists = await stat2(options.resultPath).catch(() => null);
   if (!exists?.isFile() || exists.size === 0) {
     printError(style.red("\nThe package wrote no result.") + `
-  result.json is the only channel ${import_contracts5.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $OPERA_RESULT_FILE is a FAILED run, whatever the script printed.
+  result.json is the only channel ${import_contracts8.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
   Write it as the last thing your script does, on every path \u2014 including the ones that fail.`);
     return 1;
   }
@@ -7786,7 +8942,7 @@ async function reportOutcome(options) {
   try {
     parsed = JSON.parse(await readFile2(options.resultPath, "utf8"));
   } catch {
-    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts5.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
+    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts8.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
     return 1;
   }
   let result;
@@ -7794,14 +8950,14 @@ async function reportOutcome(options) {
     result = (0, import_action_manifest4.validatePackageResult)(parsed, options.phase);
   } catch (error) {
     printError(style.red(`
-${import_contracts5.BRAND_SHORT_NAME} would REFUSE this result.`) + `
+${import_contracts8.BRAND_SHORT_NAME} would REFUSE this result.`) + `
   ${error instanceof Error ? error.message : String(error)}
   This is the same check the control plane runs, so fixing it here fixes it there.`);
     return 1;
   }
   printResult(result);
   if (options.exit.code !== 0) {
-    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts5.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
+    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts8.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
     print();
   }
   return result.status === "succeeded" ? 0 : 1;
@@ -7810,7 +8966,7 @@ __name(reportOutcome, "reportOutcome");
 async function readJsonFile(path) {
   let source;
   try {
-    source = await readFile2(resolve4(path), "utf8");
+    source = await readFile2(resolve5(path), "utf8");
   } catch {
     throw new Error(`Could not read ${path}.`);
   }
@@ -7828,9 +8984,9 @@ async function readJsonFile(path) {
 __name(readJsonFile, "readJsonFile");
 
 // src/main.ts
-var import_contracts6 = __toESM(require_dist());
+var import_contracts9 = __toESM(require_dist());
 var USAGE = `
-${style.bold("runveric")} \u2014 author ${import_contracts6.BRAND_ARTICLE} ${import_contracts6.BRAND_SHORT_NAME} action, without pushing anything.
+${style.bold("runveric")} \u2014 author ${import_contracts9.BRAND_ARTICLE} ${import_contracts9.BRAND_SHORT_NAME} action, without pushing anything.
 
 ${style.bold("USAGE")}
   runveric <command> [options]
@@ -7838,8 +8994,9 @@ ${style.bold("USAGE")}
 ${style.bold("COMMANDS")}
   init [directory]        Scaffold a working action. It passes check and test immediately.
   check                   Validate the package. Offline \u2014 no account, no cloud, no network.
-  test                    Run one phase in the real ${import_contracts6.BRAND_SHORT_NAME} runner image.
-  publish                 Upload it to ${import_contracts6.BRAND_SHORT_NAME} as an authored version. Needs an account.
+  test                    Run one phase in the real ${import_contracts9.BRAND_SHORT_NAME} runner image.
+  publish                 Upload it to ${import_contracts9.BRAND_SHORT_NAME} as an authored version. Needs an account.
+  catalog <command>       Publish first-party catalog artifacts. Not for authoring: see \`runveric catalog --help\`.
 
 ${style.bold("init")}
   --id <publisher/name>   The action id. Required.
@@ -7853,18 +9010,18 @@ ${style.bold("check")}
 
 ${style.bold("test")}
   --phase <name>          validate | run | rollback. Defaults to run.
-  --dry-run               Sets OPERA_DRY_RUN=true, as an operator's rehearsal does.
+  --dry-run               Sets RUNVERIC_DRY_RUN=true, as an operator's rehearsal does.
   --param <name=value>    A parameter value. Repeatable. Defaults come from your schema.
   --params-file <path>    A JSON object of parameters. --param overrides it.
   --prior-result <path>   The run's result.json. Required shape for --phase rollback.
-  --image <ref>           The runner image. Defaults to $OPERA_RUNNER_IMAGE.
+  --image <ref>           The runner image. Defaults to $${RUNNER_IMAGE_ENV}.
   --no-credential         Skip \`az account get-access-token\`.
-  --keep                  Keep the materialized /opera tree for inspection.
+  --keep                  Keep the materialized /runveric tree for inspection.
 
 ${style.bold("publish")}
-  --to <url>              Your ${import_contracts6.BRAND_SHORT_NAME} URL. Defaults to $OPERA_URL.
-  --token <token>         Access token. Defaults to $OPERA_TOKEN.
-  --force                 Publish despite lint errors. Never bypasses ${import_contracts6.BRAND_SHORT_NAME}'s validation.
+  --to <url>              Your ${import_contracts9.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
+  --token <token>         Access token. Defaults to $${TOKEN_ENV}.
+  --force                 Publish despite lint errors. Never bypasses ${import_contracts9.BRAND_SHORT_NAME}'s validation.
 
 ${style.bold("EVERYWHERE")}
   --dir <path>            The package directory. Defaults to the current directory.
@@ -7907,7 +9064,9 @@ __name(parseArgv, "parseArgv");
 var first = /* @__PURE__ */ __name((parsed, name) => parsed.flags.get(name)?.[0], "first");
 var bool = /* @__PURE__ */ __name((parsed, name) => parsed.flags.get(name)?.[0] === "true", "bool");
 async function main() {
-  const parsed = parseArgv(process.argv.slice(2));
+  const argv = process.argv.slice(2);
+  if (argv[0] === "catalog") return runCatalog(argv.slice(1));
+  const parsed = parseArgv(argv);
   if (parsed.flags.has("version")) {
     print(version);
     return 0;
@@ -7975,7 +9134,7 @@ async function main() {
         force: bool(parsed, "force")
       });
     default:
-      printError(style.red(`"${parsed.command}" is not a command.`) + " There are four: init, check, test, publish.");
+      printError(style.red(`"${parsed.command}" is not a command.`) + " There are four: init, check, test, publish \u2014 and catalog, which publishes first-party catalog artifacts.");
       return 1;
   }
 }