@runveric/cli 0.1.2 → 0.3.0

package/dist/runveric.mjs

@@ -212,13 +212,19 @@ var require_wire_identity = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PROBLEM_TYPE_BASE = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
+    exports.PROBLEM_TYPE_BASE = exports.CATALOG_ARTIFACT_MEDIA_TYPE = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V2 = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = exports.CATALOG_RELEASE_SCHEMA_V1 = exports.EVIDENCE_PACK_SCHEMA_VERSION = exports.ACTION_PROTOCOL_V1 = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
     exports.problemType = problemType;
     exports.PACKAGE_RESULT_PROTOCOL_VERSION = "runveric.dev/package-result/v1";
     exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "runveric.dev/package-execution/v1";
     exports.ACTION_MANIFEST_API_VERSION = "runveric.dev/action/v1";
     exports.PACKAGE_WORK_ITEM_VERSION = "runveric.dev/package-work-item/v1";
     exports.RUNNER_PROTOCOL_VERSION = "runveric.dev/runner-channel/v2";
+    exports.ACTION_PROTOCOL_V1 = "runveric.dev/action-protocol/v1";
+    exports.EVIDENCE_PACK_SCHEMA_VERSION = "runveric.dev/evidence-pack/v1";
+    exports.CATALOG_RELEASE_SCHEMA_V1 = "runveric.dev/catalog-release/v1";
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = "runveric.dev/catalog-action/v1";
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V2 = "runveric.dev/catalog-action/v2";
+    exports.CATALOG_ARTIFACT_MEDIA_TYPE = "application/vnd.runveric.catalog-artifact+json";
     exports.PROBLEM_TYPE_BASE = "https://runveric.dev/errors";
     function problemType(slug) {
       return `${exports.PROBLEM_TYPE_BASE}/${slug}`;
@@ -301,6 +307,13 @@ var require_permissions = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
+    exports.PLATFORM_PERMISSIONS = void 0;
+    exports.PLATFORM_PERMISSIONS = [
+      // Which catalog release is live for every workspace (docs/121). Pinning one changes what EVERY
+      // workspace can run, so it is neither `policy:manage` (one workspace's own governance) nor
+      // `catalog:read` (the right to browse).
+      "catalog:release"
+    ];
   }
 });
 
@@ -443,6 +456,41 @@ var require_groups = __commonJS({
   }
 });
 
+// ../contracts/dist/catalog-policy.js
+var require_catalog_policy = __commonJS({
+  "../contracts/dist/catalog-policy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CATALOG_RULE_EFFECTS = exports.CATALOG_DEFAULT_MODE_WHEN_UNSET = exports.CATALOG_DEFAULT_MODES = void 0;
+    exports.effectiveCatalogAccess = effectiveCatalogAccess;
+    var CATALOG_DEFAULT_MODE_SET = {
+      allow_all: true,
+      deny_all: true
+    };
+    exports.CATALOG_DEFAULT_MODES = Object.keys(CATALOG_DEFAULT_MODE_SET);
+    exports.CATALOG_DEFAULT_MODE_WHEN_UNSET = "allow_all";
+    var CATALOG_RULE_EFFECT_SET = {
+      allow: true,
+      deny: true
+    };
+    exports.CATALOG_RULE_EFFECTS = Object.keys(CATALOG_RULE_EFFECT_SET);
+    var RULE_ACCESS = {
+      allow: "allowed",
+      deny: "blocked"
+    };
+    var UNRULED_ACCESS = {
+      allow_all: "allowed",
+      deny_all: "blocked"
+    };
+    function effectiveCatalogAccess(defaultMode, rule) {
+      return rule !== null ? RULE_ACCESS[rule] : UNRULED_ACCESS[defaultMode];
+    }
+    __name(effectiveCatalogAccess, "effectiveCatalogAccess");
+  }
+});
+
 // ../contracts/dist/catalog.js
 var require_catalog = __commonJS({
   "../contracts/dist/catalog.js"(exports) {
@@ -558,6 +606,456 @@ var require_catalog = __commonJS({
   }
 });
 
+// ../contracts/dist/catalog-release.js
+var require_catalog_release = __commonJS({
+  "../contracts/dist/catalog-release.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CatalogReleaseStateError = exports.CATALOG_SYNC_STALE_AFTER_MINUTES = exports.CATALOG_SYNC_INTERVAL_MINUTES = exports.CATALOG_SYNC_SOURCES = exports.CATALOG_SYNC_RUN_OUTCOMES = exports.ARTIFACT_DIGEST_PATTERN = exports.ARTIFACT_REPOSITORY_PATTERN = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = exports.CATALOG_RELEASE_SCHEMA_VERSIONS = void 0;
+    exports.parseCatalogReleaseState = parseCatalogReleaseState;
+    var wire_identity_1 = require_wire_identity();
+    exports.CATALOG_RELEASE_SCHEMA_VERSIONS = [
+      wire_identity_1.CATALOG_RELEASE_SCHEMA_V1
+    ];
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = [
+      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V2
+    ];
+    exports.ARTIFACT_REPOSITORY_PATTERN = /^[a-z0-9][a-z0-9.-]*(:[0-9]+)?(\/[a-z0-9][a-z0-9._-]*)+$/;
+    exports.ARTIFACT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+    exports.CATALOG_SYNC_RUN_OUTCOMES = [
+      "applied",
+      "refused",
+      "superseded"
+    ];
+    exports.CATALOG_SYNC_SOURCES = [
+      "directory",
+      "release"
+    ];
+    exports.CATALOG_SYNC_INTERVAL_MINUTES = 15;
+    exports.CATALOG_SYNC_STALE_AFTER_MINUTES = exports.CATALOG_SYNC_INTERVAL_MINUTES * 2;
+    var CatalogReleaseStateError = class CatalogReleaseStateError extends Error {
+      static {
+        __name(this, "CatalogReleaseStateError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogReleaseStateError";
+      }
+    };
+    exports.CatalogReleaseStateError = CatalogReleaseStateError;
+    function stateObject(path, value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new CatalogReleaseStateError(`${path} is not an object.`);
+      }
+      return value;
+    }
+    __name(stateObject, "stateObject");
+    function stateString(path, value, pattern, expected = "a non-empty string") {
+      if (typeof value !== "string" || value === "" || pattern !== void 0 && !pattern.test(value)) {
+        throw new CatalogReleaseStateError(`${path} is ${JSON.stringify(value)}, not ${expected}.`);
+      }
+      return value;
+    }
+    __name(stateString, "stateString");
+    function stateInstant(path, value) {
+      const text = stateString(path, value);
+      if (Number.isNaN(Date.parse(text))) {
+        throw new CatalogReleaseStateError(`${path} is "${text}", which is not a timestamp.`);
+      }
+      return text;
+    }
+    __name(stateInstant, "stateInstant");
+    var orNull = /* @__PURE__ */ __name((value, read) => value === null ? null : read(value), "orNull");
+    function stateMember(path, value, members) {
+      if (typeof value === "string" && members.includes(value)) return value;
+      throw new CatalogReleaseStateError(`${path} is ${JSON.stringify(value)}; this build reads ${members.join(", ")}.`);
+    }
+    __name(stateMember, "stateMember");
+    function parseSyncRun(value) {
+      const run3 = stateObject("lastSync", value);
+      const source = stateMember("lastSync.source", run3.source, exports.CATALOG_SYNC_SOURCES);
+      const release = orNull(run3.release, (raw) => {
+        const fields = stateObject("lastSync.release", raw);
+        return {
+          artifactRef: stateString("lastSync.release.artifactRef", fields.artifactRef, exports.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+          digest: stateString("lastSync.release.digest", fields.digest, exports.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          version: orNull(fields.version, (label) => stateString("lastSync.release.version", label))
+        };
+      });
+      if (source === "release" !== (release !== null)) {
+        throw new CatalogReleaseStateError(`lastSync.source is "${source}" and lastSync.release is ${release === null ? "null" : "set"}; a run names a release exactly when a release declared it.`);
+      }
+      return {
+        startedAt: stateInstant("lastSync.startedAt", run3.startedAt),
+        finishedAt: stateInstant("lastSync.finishedAt", run3.finishedAt),
+        imageTag: orNull(run3.imageTag, (tag) => stateString("lastSync.imageTag", tag)),
+        source,
+        release,
+        outcome: stateMember("lastSync.outcome", run3.outcome, exports.CATALOG_SYNC_RUN_OUTCOMES),
+        detail: stateString("lastSync.detail", run3.detail)
+      };
+    }
+    __name(parseSyncRun, "parseSyncRun");
+    function parsePinned(value) {
+      const pin = stateObject("release", value);
+      return {
+        artifactRef: stateString("release.artifactRef", pin.artifactRef, exports.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+        digest: stateString("release.digest", pin.digest, exports.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+        version: stateString("release.version", pin.version),
+        provenance: orNull(pin.provenance, (raw) => {
+          const fields = stateObject("release.provenance", raw);
+          return {
+            repository: stateString("release.provenance.repository", fields.repository),
+            commit: stateString("release.provenance.commit", fields.commit)
+          };
+        }),
+        pinnedBy: stateString("release.pinnedBy", pin.pinnedBy),
+        pinnedByName: orNull(pin.pinnedByName, (name) => stateString("release.pinnedByName", name)),
+        pinnedAt: stateInstant("release.pinnedAt", pin.pinnedAt)
+      };
+    }
+    __name(parsePinned, "parsePinned");
+    function parseCatalogReleaseState(value) {
+      const state = stateObject("the catalog release state", value);
+      for (const field of [
+        "release",
+        "imageTag",
+        "lastSync",
+        "liveSince"
+      ]) {
+        if (!(field in state)) throw new CatalogReleaseStateError(`${field} is missing.`);
+      }
+      const release = orNull(state.release, parsePinned);
+      const liveSince = orNull(state.liveSince, (instant) => stateInstant("liveSince", instant));
+      if (release === null && liveSince !== null) {
+        throw new CatalogReleaseStateError("liveSince is set with nothing pinned; only a pin goes live.");
+      }
+      return {
+        release,
+        imageTag: orNull(state.imageTag, (tag) => stateString("imageTag", tag)),
+        lastSync: orNull(state.lastSync, parseSyncRun),
+        liveSince
+      };
+    }
+    __name(parseCatalogReleaseState, "parseCatalogReleaseState");
+  }
+});
+
+// ../contracts/dist/action-repository.js
+var require_action_repository = __commonJS({
+  "../contracts/dist/action-repository.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ACTION_SOURCE_REPOSITORY_PREFIX = exports.ACTION_REPOSITORY_PREFIX = void 0;
+    exports.actionKeyRefusal = actionKeyRefusal;
+    exports.isActionKey = isActionKey;
+    exports.actionRepositoryName = actionRepositoryName;
+    exports.actionSourceRepository = actionSourceRepository2;
+    exports.actionKeyOf = actionKeyOf;
+    exports.actionPackageRefusal = actionPackageRefusal4;
+    exports.ACTION_REPOSITORY_PREFIX = "action-";
+    var WORD = /^[a-z][a-z0-9]*$/;
+    var VERB = /^[a-z][a-z0-9]*(?:[A-Z][a-z0-9]+)*$/;
+    function actionKeyRefusal(key) {
+      const shape = "an action key is <provider>.<resource>.<verb>: provider and resource are one lowercase word (a-z, then a-z or 0-9), the verb is camelCase with no two capitals in a row \u2014 so the key maps to exactly one repository name and back.";
+      const segments = key.split(".");
+      if (segments.length !== 3) {
+        return `"${key}" is not an action key: it has ${segments.length} dot-separated segment(s), not 3; ${shape}`;
+      }
+      const [provider, resource, verb] = segments;
+      const not = /* @__PURE__ */ __name((what) => `"${key}" is not an action key: ${what}; ${shape}`, "not");
+      if (!WORD.test(provider)) return not(`its provider "${provider}" is not one lowercase word`);
+      if (!WORD.test(resource)) return not(`its resource "${resource}" is not one lowercase word`);
+      if (!VERB.test(verb)) return not(`its verb "${verb}" is not camelCase without two capitals in a row`);
+      return null;
+    }
+    __name(actionKeyRefusal, "actionKeyRefusal");
+    function isActionKey(key) {
+      return actionKeyRefusal(key) === null;
+    }
+    __name(isActionKey, "isActionKey");
+    var kebab = /* @__PURE__ */ __name((verb) => verb.replace(/[A-Z]/g, (capital) => `-${capital.toLowerCase()}`), "kebab");
+    function actionRepositoryName(key) {
+      const refusal = actionKeyRefusal(key);
+      if (refusal !== null) throw new Error(refusal);
+      const [provider, resource, verb] = key.split(".");
+      return `${exports.ACTION_REPOSITORY_PREFIX}${provider}-${resource}-${kebab(verb)}`;
+    }
+    __name(actionRepositoryName, "actionRepositoryName");
+    exports.ACTION_SOURCE_REPOSITORY_PREFIX = "https://github.com/runveric/";
+    function actionSourceRepository2(key) {
+      return `${exports.ACTION_SOURCE_REPOSITORY_PREFIX}${actionRepositoryName(key)}`;
+    }
+    __name(actionSourceRepository2, "actionSourceRepository");
+    function actionKeyOf(name) {
+      if (!name.startsWith(exports.ACTION_REPOSITORY_PREFIX)) return null;
+      const [provider, resource, first2, ...rest] = name.slice(exports.ACTION_REPOSITORY_PREFIX.length).split("-");
+      if (provider === void 0 || resource === void 0 || first2 === void 0) return null;
+      const verb = first2 + rest.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+      const key = `${provider}.${resource}.${verb}`;
+      return isActionKey(key) && actionRepositoryName(key) === name ? key : null;
+    }
+    __name(actionKeyOf, "actionKeyOf");
+    function actionPackageRefusal4(key, artifactRef) {
+      const keyRefusal = actionKeyRefusal(key);
+      if (keyRefusal !== null) return `${keyRefusal} No package can carry it.`;
+      const cut = artifactRef.lastIndexOf("/");
+      const named = artifactRef.slice(cut + 1);
+      const expected = actionRepositoryName(key);
+      if (named === expected) return null;
+      return `action "${key}" is published only from a package named "${expected}" (${artifactRef.slice(0, cut + 1)}${expected}), not "${named}". An action's package carries its key's name, so an artifact cannot claim an identity its package does not carry.`;
+    }
+    __name(actionPackageRefusal4, "actionPackageRefusal");
+  }
+});
+
+// ../contracts/dist/catalog-release-spec.js
+var require_catalog_release_spec = __commonJS({
+  "../contracts/dist/catalog-release-spec.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.CatalogReleaseSpecError = void 0;
+    exports.splitArtifactReference = splitArtifactReference;
+    exports.parseCatalogReleaseSpec = parseCatalogReleaseSpec3;
+    var CatalogReleaseSpecError = class CatalogReleaseSpecError extends Error {
+      static {
+        __name(this, "CatalogReleaseSpecError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogReleaseSpecError";
+      }
+    };
+    exports.CatalogReleaseSpecError = CatalogReleaseSpecError;
+    function splitArtifactReference(reference) {
+      const at = reference.indexOf("@");
+      if (at <= 0 || at === reference.length - 1) return null;
+      return {
+        artifactRef: reference.slice(0, at),
+        digest: reference.slice(at + 1)
+      };
+    }
+    __name(splitArtifactReference, "splitArtifactReference");
+    var isMapping3 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+    function parseCatalogReleaseSpec3(value) {
+      if (!isMapping3(value)) {
+        throw new CatalogReleaseSpecError("release.yaml is not a mapping of `version` and `actions`.");
+      }
+      const unknown = Object.keys(value).filter((key) => key !== "version" && key !== "actions");
+      if (unknown.length > 0) {
+        throw new CatalogReleaseSpecError(`release.yaml carries ${unknown.map((key) => `"${key}"`).join(", ")}; it has exactly two fields, \`version\` and \`actions\`.`);
+      }
+      const { version: version2, actions } = value;
+      if (typeof version2 !== "string" || version2.trim().length === 0) {
+        throw new CatalogReleaseSpecError(`release.yaml's version is ${JSON.stringify(version2 ?? null)}, not a label. Write it as a quoted string \u2014 version: "2026.10.1" \u2014 because YAML reads an unquoted 2026.10 as a number.`);
+      }
+      if (actions === null || actions === void 0 || isMapping3(actions) && Object.keys(actions).length === 0) {
+        throw new CatalogReleaseSpecError("release.yaml declares no action. An empty release is refused: pinned, it would declare a catalog with nothing in it.");
+      }
+      if (!isMapping3(actions)) {
+        throw new CatalogReleaseSpecError("release.yaml's actions is not a mapping of action key to <repository>@<digest>.");
+      }
+      return {
+        version: version2,
+        actions: Object.entries(actions).map(([key, reference]) => {
+          const split = typeof reference === "string" ? splitArtifactReference(reference) : null;
+          if (split === null) {
+            throw new CatalogReleaseSpecError(`release.yaml's ${key} is ${JSON.stringify(reference)}, not <repository>@<digest>.`);
+          }
+          return {
+            key,
+            ...split
+          };
+        })
+      };
+    }
+    __name(parseCatalogReleaseSpec3, "parseCatalogReleaseSpec");
+  }
+});
+
+// ../contracts/dist/catalog-lock.js
+var require_catalog_lock = __commonJS({
+  "../contracts/dist/catalog-lock.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.MANIFEST_SHA256_PATTERN = exports.CatalogLockError = exports.CATALOG_LOCK_ENGINE_EXECUTION = exports.CATALOG_LOCK_FILE = exports.CATALOG_LOCK_SCHEMA_V1 = void 0;
+    exports.parseCatalogLock = parseCatalogLock;
+    exports.catalogLockText = catalogLockText;
+    exports.authoredElsewhere = authoredElsewhere;
+    var action_repository_1 = require_action_repository();
+    var catalog_release_1 = require_catalog_release();
+    exports.CATALOG_LOCK_SCHEMA_V1 = "runveric.catalog-lock/v1";
+    exports.CATALOG_LOCK_FILE = "release.lock.json";
+    exports.CATALOG_LOCK_ENGINE_EXECUTION = "engine";
+    var CatalogLockError = class CatalogLockError extends Error {
+      static {
+        __name(this, "CatalogLockError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogLockError";
+      }
+    };
+    exports.CatalogLockError = CatalogLockError;
+    exports.MANIFEST_SHA256_PATTERN = /^[0-9a-f]{64}$/;
+    function objectAt(path, value, keys) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new CatalogLockError(`${path} is not an object.`);
+      }
+      const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+      if (unknown.length > 0) {
+        throw new CatalogLockError(`${path} carries ${unknown.map((key) => `"${key}"`).join(", ")}, which a lock does not have. A lock is written by catalog:vendor and never edited; re-vendor instead.`);
+      }
+      return value;
+    }
+    __name(objectAt, "objectAt");
+    function stringAt(path, value, pattern, expected) {
+      if (typeof value !== "string" || value.length === 0) {
+        throw new CatalogLockError(`${path} is not a non-empty string.`);
+      }
+      if (pattern !== void 0 && !pattern.test(value)) {
+        throw new CatalogLockError(`${path} is "${value}", which is not ${expected}.`);
+      }
+      return value;
+    }
+    __name(stringAt, "stringAt");
+    function parseCatalogLock(value) {
+      const root = objectAt("the lock", value, [
+        "schemaVersion",
+        "release",
+        "actions"
+      ]);
+      if (root.schemaVersion !== exports.CATALOG_LOCK_SCHEMA_V1) {
+        throw new CatalogLockError(`the lock declares schemaVersion ${JSON.stringify(root.schemaVersion)}; this build reads ${exports.CATALOG_LOCK_SCHEMA_V1} only.`);
+      }
+      const release = objectAt("release", root.release, [
+        "artifactRef",
+        "digest",
+        "version"
+      ]);
+      const lock = {
+        schemaVersion: exports.CATALOG_LOCK_SCHEMA_V1,
+        release: {
+          artifactRef: stringAt("release.artifactRef", release.artifactRef, catalog_release_1.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+          digest: stringAt("release.digest", release.digest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          version: stringAt("release.version", release.version)
+        },
+        actions: []
+      };
+      if (!Array.isArray(root.actions) || root.actions.length === 0) {
+        throw new CatalogLockError("actions is not a non-empty array. A release names at least one action.");
+      }
+      root.actions.forEach((entry, index) => {
+        const path = `actions[${index}]`;
+        const action = objectAt(path, entry, [
+          "key",
+          "artifactRef",
+          "digest",
+          "manifestSha256",
+          "provenance",
+          "executes",
+          "imageDigest"
+        ]);
+        const key = stringAt(`${path}.key`, action.key);
+        const artifactRef = stringAt(`${path}.artifactRef`, action.artifactRef, catalog_release_1.ARTIFACT_REPOSITORY_PATTERN, "a registry repository");
+        const misnamed = (0, action_repository_1.actionPackageRefusal)(key, artifactRef);
+        if (misnamed !== null) throw new CatalogLockError(`${path}: ${misnamed}`);
+        const previous = lock.actions[lock.actions.length - 1];
+        if (previous !== void 0 && !(previous.key < key)) {
+          throw new CatalogLockError(`${path}.key "${key}" follows "${previous.key}": a lock names each action once, sorted by key.`);
+        }
+        const provenance2 = objectAt(`${path}.provenance`, action.provenance, [
+          "repository",
+          "commit"
+        ]);
+        if (action.executes === void 0 !== (action.imageDigest === void 0)) {
+          throw new CatalogLockError(`${path} carries ${action.executes === void 0 ? "imageDigest without executes" : "executes without imageDigest"}; an engine action records both, a built-in neither.`);
+        }
+        if (action.executes !== void 0 && action.executes !== exports.CATALOG_LOCK_ENGINE_EXECUTION) {
+          throw new CatalogLockError(`${path}.executes is ${JSON.stringify(action.executes)}; the one value it takes is "${exports.CATALOG_LOCK_ENGINE_EXECUTION}".`);
+        }
+        lock.actions.push({
+          key,
+          artifactRef,
+          digest: stringAt(`${path}.digest`, action.digest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          manifestSha256: stringAt(`${path}.manifestSha256`, action.manifestSha256, exports.MANIFEST_SHA256_PATTERN, "64 lowercase hex characters"),
+          provenance: {
+            repository: stringAt(`${path}.provenance.repository`, provenance2.repository),
+            commit: stringAt(`${path}.provenance.commit`, provenance2.commit)
+          },
+          ...action.executes === void 0 ? {} : {
+            executes: exports.CATALOG_LOCK_ENGINE_EXECUTION,
+            imageDigest: stringAt(`${path}.imageDigest`, action.imageDigest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest")
+          }
+        });
+      });
+      return lock;
+    }
+    __name(parseCatalogLock, "parseCatalogLock");
+    function catalogLockText(lock) {
+      const ordered = {
+        schemaVersion: lock.schemaVersion,
+        release: {
+          artifactRef: lock.release.artifactRef,
+          digest: lock.release.digest,
+          version: lock.release.version
+        },
+        actions: [
+          ...lock.actions
+        ].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map((action) => ({
+          key: action.key,
+          artifactRef: action.artifactRef,
+          digest: action.digest,
+          manifestSha256: action.manifestSha256,
+          provenance: {
+            repository: action.provenance.repository,
+            commit: action.provenance.commit
+          },
+          ...action.executes === void 0 || action.imageDigest === void 0 ? {} : {
+            executes: action.executes,
+            imageDigest: action.imageDigest
+          }
+        }))
+      };
+      return `${JSON.stringify(ordered, null, 2)}
+`;
+    }
+    __name(catalogLockText, "catalogLockText");
+    function authoredElsewhere(lock, key) {
+      const namespace = lock.release.artifactRef.slice(0, lock.release.artifactRef.lastIndexOf("/"));
+      const organisation = namespace.slice(namespace.lastIndexOf("/") + 1);
+      return `${key} is authored in ${organisation}/${(0, action_repository_1.actionRepositoryName)(key)} \u2014 change it there, publish, assemble, vendor`;
+    }
+    __name(authoredElsewhere, "authoredElsewhere");
+  }
+});
+
+// ../contracts/dist/catalog-manifest-placeholders.js
+var require_catalog_manifest_placeholders = __commonJS({
+  "../contracts/dist/catalog-manifest-placeholders.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.MANIFEST_PLACEHOLDER_PATTERN = exports.MANIFEST_PLACEHOLDERS = void 0;
+    var brand_1 = require_brand();
+    exports.MANIFEST_PLACEHOLDERS = {
+      BRAND_SHORT_NAME: brand_1.BRAND_SHORT_NAME,
+      BRAND_NAME: brand_1.BRAND_NAME
+    };
+    exports.MANIFEST_PLACEHOLDER_PATTERN = /\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+  }
+});
+
 // ../contracts/dist/change-control.js
 var require_change_control = __commonJS({
   "../contracts/dist/change-control.js"(exports) {
@@ -857,8 +1355,8 @@ var require_package_provenance = __commonJS({
       pair.accepted,
       pair.revoked
     ]);
-    function poolProvenanceAuditAction(provenance, accepted) {
-      const pair = exports.POOL_PROVENANCE_AUDIT_ACTIONS[provenance];
+    function poolProvenanceAuditAction(provenance2, accepted) {
+      const pair = exports.POOL_PROVENANCE_AUDIT_ACTIONS[provenance2];
       return accepted ? pair.accepted : pair.revoked;
     }
     __name(poolProvenanceAuditAction, "poolProvenanceAuditAction");
@@ -1286,7 +1784,7 @@ var require_validation = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.TARGET_COMPARISON_KINDS = exports.TARGETS_NO_SCOPE = exports.TARGETS_NOT_COUNTED = exports.TARGET_COUNT_ABSENCES = void 0;
+    exports.TARGET_COMPARISON_KINDS = exports.DECISION_CODES = exports.REFUSAL_CODES = exports.CHECK_LEVELS = exports.TARGETS_NO_SCOPE = exports.TARGETS_NOT_COUNTED = exports.TARGET_COUNT_ABSENCES = void 0;
     exports.isTargetCountAbsence = isTargetCountAbsence;
     exports.singleTarget = singleTarget;
     exports.noTargetsResolved = noTargetsResolved;
@@ -1296,6 +1794,10 @@ var require_validation = __commonJS({
     exports.eligibleTargetCount = eligibleTargetCount;
     exports.targetsValidationCheck = targetsValidationCheck;
     exports.targetSummaryOf = targetSummaryOf;
+    exports.isCheckLevel = isCheckLevel;
+    exports.isRefusalCode = isRefusalCode;
+    exports.isDecisionCode = isDecisionCode;
+    exports.validationCheckOf = validationCheckOf;
     exports.scopeFailureDetail = scopeFailureDetail;
     exports.targetsUnavailableFrom = targetsUnavailableFrom;
     exports.compareTargets = compareTargets;
@@ -1412,6 +1914,95 @@ var require_validation = __commonJS({
       return exports.TARGETS_NOT_COUNTED;
     }
     __name(targetSummaryOf, "targetSummaryOf");
+    exports.CHECK_LEVELS = [
+      "info",
+      "warn",
+      "error"
+    ];
+    function isCheckLevel(value) {
+      return typeof value === "string" && exports.CHECK_LEVELS.includes(value);
+    }
+    __name(isCheckLevel, "isCheckLevel");
+    exports.REFUSAL_CODES = [
+      "disk.notUnattached",
+      "disk.locked",
+      "disk.shared",
+      "disk.inRecoveryPlan",
+      "disk.keyUnusable",
+      "disk.unverifiable"
+    ];
+    function isRefusalCode(value) {
+      return typeof value === "string" && exports.REFUSAL_CODES.includes(value);
+    }
+    __name(isRefusalCode, "isRefusalCode");
+    exports.DECISION_CODES = [
+      "disk.recentlyDetached",
+      "disk.customerKey",
+      "disk.customerKeyUnverified",
+      "disk.guestEncrypted",
+      "disk.noSnapshot",
+      // A confidential VM's disk: its snapshot keeps the VM's guest state, region-bound, and restoring
+      // one is unverified (docs/126 §6.6.1) — the operator's call, never a refusal.
+      "disk.confidential"
+    ];
+    function isDecisionCode(value) {
+      return typeof value === "string" && exports.DECISION_CODES.includes(value);
+    }
+    __name(isDecisionCode, "isDecisionCode");
+    function validationCheckOf(value) {
+      const raw = typeof value === "object" && value !== null ? value : {};
+      const level = raw.level;
+      if (!isCheckLevel(level)) {
+        return {
+          refusal: `A check level of "${String(level)}" is not in the vocabulary.`
+        };
+      }
+      if (typeof raw.title !== "string" || raw.title.length === 0) {
+        return {
+          refusal: "Every check must carry a title."
+        };
+      }
+      if (raw.decision !== void 0 && raw.refusal !== void 0) {
+        return {
+          refusal: `A check carrying both a decision ("${String(raw.decision)}") and a refusal ("${String(raw.refusal)}") is not a check any producer of ours can build.`
+        };
+      }
+      if (raw.decision !== void 0) {
+        if (!isDecisionCode(raw.decision) || level === "info") {
+          return {
+            refusal: `A check's decision of "${String(raw.decision)}" at level "${level}" is not one this channel accepts.`
+          };
+        }
+        return {
+          check: {
+            level,
+            title: raw.title,
+            decision: raw.decision
+          }
+        };
+      }
+      if (raw.refusal !== void 0) {
+        if (!isRefusalCode(raw.refusal) || level !== "error") {
+          return {
+            refusal: `A check's refusal of "${String(raw.refusal)}" at level "${level}" is not one this channel accepts.`
+          };
+        }
+        return {
+          check: {
+            level,
+            title: raw.title,
+            refusal: raw.refusal
+          }
+        };
+      }
+      return {
+        check: {
+          level,
+          title: raw.title
+        }
+      };
+    }
+    __name(validationCheckOf, "validationCheckOf");
     function scopeFailureDetail(error) {
       const raw = error instanceof Error ? error.message : String(error);
       const oneLine = raw.replace(/\s+/g, " ").trim().replace(/[.!]+$/, "");
@@ -1482,7 +2073,7 @@ var require_execution = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
+    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.validationCheckOf = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.REFUSAL_CODES = exports.isRefusalCode = exports.isDecisionCode = exports.isCheckLevel = exports.DECISION_CODES = exports.CHECK_LEVELS = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
     exports.executionLogStreamSentence = executionLogStreamSentence;
     exports.actionRunnabilityCopy = actionRunnabilityCopy;
     exports.actionRunnabilityHeadline = actionRunnabilityHeadline;
@@ -1493,6 +2084,42 @@ var require_execution = __commonJS({
     var brand_1 = require_brand();
     exports.SUBSCRIPTION_ID_FIELD_RENAMED = "`subscriptionId` is not accepted on this route. It named an `azure_subscription.id` while this route has always resolved a `connection_scope.id`. The two were the same value while one shim gave a scope the registry row's id; a scope discovered since has an id of its own, and the registry id is either nobody's scope or another connector's. Send `connectionScopeId` \u2014 the value `ExecutionDto.connectionScopeId` reports for a run.";
     var validation_1 = require_validation();
+    Object.defineProperty(exports, "CHECK_LEVELS", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.CHECK_LEVELS;
+      }, "get")
+    });
+    Object.defineProperty(exports, "DECISION_CODES", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.DECISION_CODES;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isCheckLevel", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isCheckLevel;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isDecisionCode", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isDecisionCode;
+      }, "get")
+    });
+    Object.defineProperty(exports, "isRefusalCode", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.isRefusalCode;
+      }, "get")
+    });
+    Object.defineProperty(exports, "REFUSAL_CODES", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.REFUSAL_CODES;
+      }, "get")
+    });
     Object.defineProperty(exports, "compareTargets", {
       enumerable: true,
       get: /* @__PURE__ */ __name(function() {
@@ -1607,6 +2234,12 @@ var require_execution = __commonJS({
         return validation_1.targetsValidationCheck;
       }, "get")
     });
+    Object.defineProperty(exports, "validationCheckOf", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.validationCheckOf;
+      }, "get")
+    });
     exports.EXECUTION_LOG_ACTIVITIES = [
       "executing",
       "queued",
@@ -1634,6 +2267,7 @@ var require_execution = __commonJS({
     }
     __name(executionLogStreamSentence, "executionLogStreamSentence");
     var ACTION_RUNNABILITY_CAUSE_KIND_SET = {
+      catalog_blocked: true,
       connector_unregistered: true,
       package: true,
       runner_pool: true,
@@ -1643,8 +2277,12 @@ var require_execution = __commonJS({
     };
     exports.ACTION_RUNNABILITY_CAUSE_KINDS = Object.keys(ACTION_RUNNABILITY_CAUSE_KIND_SET);
     exports.CONNECTOR_UNAVAILABLE_MESSAGE = "This action is not yet available to run.";
+    var CATALOG_BLOCKED_CAUSE = "This workspace does not permit this action.";
+    var CATALOG_BLOCKED_REMEDY = "An administrator of this workspace decides which catalog actions may run here, and can allow it.";
     function actionRunnabilityCopy(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return `${CATALOG_BLOCKED_CAUSE} ${CATALOG_BLOCKED_REMEDY}`;
         case "package":
           return (0, packages_2.actionUnrunnableCopy)(cause.detail);
         case "runner_pool": {
@@ -1676,7 +2314,7 @@ var require_execution = __commonJS({
     }
     __name(describeRoutingPlaces, "describeRoutingPlaces");
     function runnerPoolClauses(cause) {
-      const provenance = cause.provenance ? `is ${packages_1.PACKAGE_PROVENANCE_CLAUSES[cause.provenance]}` : (
+      const provenance2 = cause.provenance ? `is ${packages_1.PACKAGE_PROVENANCE_CLAUSES[cause.provenance]}` : (
         // every other value this sentence could take is a claim about where bytes came from.
         "has no recorded provenance"
       );
@@ -1694,7 +2332,7 @@ var require_execution = __commonJS({
          * credential it acts with. A refusal that dropped those would be telling an admin the
          * decision no longer matters.
          */
-        cause: `${provenance}, and would run on the private runner pool "${cause.poolName}", because that is where runs using this connection execute \u2014 on a machine you own, in a container that shares its host's kernel and acts with this connection's credential.`,
+        cause: `${provenance2}, and would run on the private runner pool "${cause.poolName}", because that is where runs using this connection execute \u2014 on a machine you own, in a container that shares its host's kernel and acts with this connection's credential.`,
         remedy: `${acceptedClause(cause.accepts)} ${POOL_CONSENT_REMEDY}`
       };
     }
@@ -1733,6 +2371,8 @@ var require_execution = __commonJS({
     var POOL_CONSENT_REMEDY = `${brand_1.BRAND_SHORT_NAME} does not vouch for what runs on your machines \u2014 the owner of this pool does. An administrator can accept this provenance under Settings \u2192 Runners, and until they do, nothing of this provenance will be sent there. Built-in actions still run in that pool.`;
     function actionRunnabilityHeadline(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return "this workspace does not permit its action \u2014 an administrator of this workspace can allow it";
         case "package":
           return (0, packages_2.actionUnrunnableHeadline)(cause.detail);
         case "runner_pool":
@@ -1750,6 +2390,8 @@ var require_execution = __commonJS({
     __name(actionRunnabilityHeadline, "actionRunnabilityHeadline");
     function actionRunnabilityRefusal(cause) {
       switch (cause.kind) {
+        case "catalog_blocked":
+          return `${CATALOG_BLOCKED_CAUSE} ${CATALOG_BLOCKED_REMEDY} Nothing was started.`;
         case "package":
           return (0, packages_2.actionUnrunnableRefusal)(cause.detail, cause);
         case "runner_pool": {
@@ -1774,6 +2416,130 @@ var require_execution = __commonJS({
   }
 });
 
+// ../contracts/dist/decisions.js
+var require_decisions = __commonJS({
+  "../contracts/dist/decisions.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.DECISION_ACKNOWLEDGEMENT = exports.TARGET_DISPOSITIONS = exports.UNDECIDED_AT_RUN = void 0;
+    exports.recordedDecisionsOf = recordedDecisionsOf;
+    exports.settleDecisionChecks = settleDecisionChecks;
+    exports.raisedDecisionCodes = raisedDecisionCodes;
+    exports.decisionMismatch = decisionMismatch;
+    exports.decisionMismatchSentence = decisionMismatchSentence;
+    exports.targetDecisionsMismatchSentence = targetDecisionsMismatchSentence;
+    exports.decisionsMadeAtSubmit = decisionsMadeAtSubmit;
+    exports.isTargetDisposition = isTargetDisposition;
+    var validation_1 = require_validation();
+    function recordedDecisionsOf(stored) {
+      if (!Array.isArray(stored)) return [];
+      const read = [];
+      for (const entry of stored) {
+        if (typeof entry !== "object" || entry === null) continue;
+        const { code, acknowledgedBy, acknowledgedAt } = entry;
+        if (!(0, validation_1.isDecisionCode)(code)) continue;
+        if (typeof acknowledgedBy !== "string" || acknowledgedBy.length === 0) continue;
+        if (typeof acknowledgedAt !== "string" || Number.isNaN(Date.parse(acknowledgedAt))) continue;
+        if (read.some((decision) => decision.code === code)) continue;
+        read.push({
+          code,
+          acknowledgedBy,
+          acknowledgedAt
+        });
+      }
+      return read;
+    }
+    __name(recordedDecisionsOf, "recordedDecisionsOf");
+    exports.UNDECIDED_AT_RUN = "Nobody acknowledged this before the run, so it was not acted on.";
+    function settleDecisionChecks(checks, inHand) {
+      if (inHand.phase === "plan") return [
+        ...checks
+      ];
+      return checks.map((check) => {
+        if (!check.decision || check.level === "error") return check;
+        if (inHand.recorded.some((decision) => decision.code === check.decision)) return check;
+        return {
+          ...check,
+          level: "error",
+          title: `${check.title} ${exports.UNDECIDED_AT_RUN}`
+        };
+      });
+    }
+    __name(settleDecisionChecks, "settleDecisionChecks");
+    function raisedDecisionCodes(checks) {
+      const raised = [];
+      for (const check of checks) {
+        if (check.decision && !raised.includes(check.decision)) raised.push(check.decision);
+      }
+      return raised;
+    }
+    __name(raisedDecisionCodes, "raisedDecisionCodes");
+    function decisionMismatch(raised, acknowledged) {
+      const unacknowledged = raised.filter((code) => !acknowledged.includes(code));
+      const notRaised = acknowledged.filter((code) => !raised.includes(code));
+      return unacknowledged.length === 0 && notRaised.length === 0 ? null : {
+        unacknowledged,
+        notRaised
+      };
+    }
+    __name(decisionMismatch, "decisionMismatch");
+    function decisionMismatchSentence(mismatch, checks = []) {
+      return `This run was not submitted: the checks were run again at submit, and they no longer match what was acknowledged. ${mismatchParts(mismatch, checks).join(" ")} Review the plan and submit again.`;
+    }
+    __name(decisionMismatchSentence, "decisionMismatchSentence");
+    function targetDecisionsMismatchSentence(mismatches) {
+      const parts = mismatches.map((target) => target.unknown ? `${target.label}: no longer one of this step's targets.` : `${target.label}: ${mismatchParts(target, target.checks).join(" ")}`);
+      const count = mismatches.length;
+      return `This run was not started: the checks were run again, and for ${count} ${count === 1 ? "target" : "targets"} they no longer match what was decided. ${parts.join(" ")} Review the plan and start the run again.`;
+    }
+    __name(targetDecisionsMismatchSentence, "targetDecisionsMismatchSentence");
+    function mismatchParts(mismatch, checks) {
+      const parts = [];
+      for (const code of mismatch.unacknowledged) {
+        const sentence = checks.find((check) => check.decision === code)?.title ?? exports.DECISION_ACKNOWLEDGEMENT[code];
+        parts.push(`Not acknowledged: ${withStop(sentence)}`);
+      }
+      for (const code of mismatch.notRaised) {
+        parts.push(`Acknowledged, but no longer raised: \u201C${exports.DECISION_ACKNOWLEDGEMENT[code]}\u201D.`);
+      }
+      return parts;
+    }
+    __name(mismatchParts, "mismatchParts");
+    function decisionsMadeAtSubmit(codes, by, at) {
+      return codes.map((code) => ({
+        code,
+        acknowledgedBy: by,
+        acknowledgedAt: at.toISOString()
+      }));
+    }
+    __name(decisionsMadeAtSubmit, "decisionsMadeAtSubmit");
+    exports.TARGET_DISPOSITIONS = [
+      "ready",
+      "left_out",
+      "refused"
+    ];
+    function isTargetDisposition(value) {
+      return typeof value === "string" && exports.TARGET_DISPOSITIONS.includes(value);
+    }
+    __name(isTargetDisposition, "isTargetDisposition");
+    function withStop(sentence) {
+      const trimmed = sentence.trim();
+      return /[.!?]$/.test(trimmed) ? trimmed : `${trimmed}.`;
+    }
+    __name(withStop, "withStop");
+    exports.DECISION_ACKNOWLEDGEMENT = {
+      "disk.recentlyDetached": "Delete it even though it was detached recently",
+      "disk.customerKey": "Delete it \u2014 restoring later depends on this key staying enabled",
+      "disk.customerKeyUnverified": "Delete it without confirmation that the key is enabled",
+      "disk.guestEncrypted": "Delete it \u2014 restoring later depends on the guest's encryption secrets",
+      "disk.noSnapshot": "Delete it with no snapshot \u2014 this cannot be undone",
+      "disk.confidential": "Delete it, accepting that restoring a confidential VM disk is not verified"
+    };
+  }
+});
+
 // ../contracts/dist/execution-site.js
 var require_execution_site = __commonJS({
   "../contracts/dist/execution-site.js"(exports) {
@@ -1858,7 +2624,13 @@ var require_resources = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.DISCOVERY_TYPE_PATTERN = exports.DISCOVERABLE_RESOURCE_TYPES = exports.DISCOVERY_VOCABULARY = void 0;
+    exports.DISCOVERY_TYPE_PATTERN = exports.LEGACY_DISCOVERY_PROVIDER = exports.DISCOVERY_VOCABULARY = void 0;
+    exports.discoveryTypesOf = discoveryTypesOf;
+    exports.declaredDiscoveryTypes = declaredDiscoveryTypes;
+    exports.liveDiscoveryTypes = liveDiscoveryTypes;
+    exports.canonicalDiscoveryId = canonicalDiscoveryId;
+    exports.resolveDiscoveryType = resolveDiscoveryType;
+    exports.isSecretReference = isSecretReference;
     exports.parseDiscoveryType = parseDiscoveryType;
     exports.formatDiscoveryType = formatDiscoveryType;
     exports.discoveryTypeSpec = discoveryTypeSpec;
@@ -1874,16 +2646,20 @@ var require_resources = __commonJS({
       resourceGroup: {
         requires: [],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       // ROUTABLE BUT NOT NAMABLE, and the two are different questions. A rule matches a vault by
       // its NAME and its tags, which discovery supplies; an ARM vault id needs the resource group
       // this vocabulary never asks for (`requires` is empty so vaults list subscription-wide). See
       // `identity` on the spec above — null is the honest answer, not an omission.
+      // NOT a secret reference: a vault CONTAINS secrets, and naming one reveals nothing a run
+      // could read. The secret inside it is the reference (`keyVaultSecret` below).
       keyVault: {
         requires: [],
         routable: true,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       // ★ A DATA-PLANE URI, NOT AN ARM PATH, AND IT IS WHAT DISCOVERY ALREADY RETURNS. The Key
       // Vault SDK reports `SecretProperties.id` as `https://<vault>.vault.azure.net/secrets/<name>`
@@ -1895,27 +2671,33 @@ var require_resources = __commonJS({
           "vault"
         ],
         routable: true,
-        identity: "https://{vault}.vault.azure.net/secrets/{name}"
+        identity: "https://{vault}.vault.azure.net/secrets/{name}",
+        // ★ THE ONE TYPE TODAY WHOSE VALUE POINTS AT A SECRET (docs/122 §3.5). The parameter holds
+        // the secret's NAME within its vault; nothing in the platform ever reads the value behind it.
+        secretRef: true
       },
       // A catalogue value. Nothing is reached by naming a region.
       location: {
         requires: [],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       },
       managedDisk: {
         requires: [
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/disks/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/disks/{name}",
+        secretRef: false
       },
       sqlServer: {
         requires: [
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{name}",
+        secretRef: false
       },
       sqlDatabase: {
         requires: [
@@ -1923,7 +2705,8 @@ var require_resources = __commonJS({
           "server"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{server}/databases/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{server}/databases/{name}",
+        secretRef: false
       },
       // The one type where LISTING and IDENTIFYING are different questions. It lists
       // SUBSCRIPTION-WIDE when no resource group is given (`virtualMachines.listAll()`,
@@ -1943,7 +2726,8 @@ var require_resources = __commonJS({
           "resourceGroup"
         ],
         routable: true,
-        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/{name}"
+        identity: "/subscriptions/{subscription}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/{name}",
+        secretRef: false
       },
       // The sizes ONE machine can actually be resized to right now — not the region's SKU
       // catalogue. `requires` is genuinely both fields' answer here: the safe set cannot be
@@ -1957,16 +2741,53 @@ var require_resources = __commonJS({
           "vm"
         ],
         routable: false,
-        identity: null
+        identity: null,
+        secretRef: false
       }
     };
-    exports.DISCOVERY_VOCABULARY = {
+    var DECLARED_DISCOVERY = {
       azure: AZURE_DISCOVERY_TYPES,
       aws: {},
       gcp: {},
       terraform: {}
     };
-    exports.DISCOVERABLE_RESOURCE_TYPES = Object.keys(AZURE_DISCOVERY_TYPES);
+    exports.DISCOVERY_VOCABULARY = DECLARED_DISCOVERY;
+    exports.LEGACY_DISCOVERY_PROVIDER = "azure";
+    function discoveryTypesOf(provider) {
+      return Object.keys(exports.DISCOVERY_VOCABULARY[provider]).map((type) => formatDiscoveryType(provider, type));
+    }
+    __name(discoveryTypesOf, "discoveryTypesOf");
+    function declaredDiscoveryTypes() {
+      return enums_1.PROVIDERS.flatMap(discoveryTypesOf);
+    }
+    __name(declaredDiscoveryTypes, "declaredDiscoveryTypes");
+    function liveDiscoveryTypes(registered) {
+      const providers = new Set(registered);
+      return enums_1.PROVIDERS.filter((provider) => providers.has(provider)).flatMap(discoveryTypesOf);
+    }
+    __name(liveDiscoveryTypes, "liveDiscoveryTypes");
+    function canonicalDiscoveryId(value) {
+      const parsed = parseDiscoveryType(value.trim(), exports.LEGACY_DISCOVERY_PROVIDER);
+      return parsed ? formatDiscoveryType(parsed.provider, parsed.type) : null;
+    }
+    __name(canonicalDiscoveryId, "canonicalDiscoveryId");
+    function resolveDiscoveryType(value) {
+      const parsed = parseDiscoveryType(value.trim(), exports.LEGACY_DISCOVERY_PROVIDER);
+      if (!parsed) return null;
+      const spec = discoveryTypeSpec(parsed.provider, parsed.type);
+      if (!spec) return null;
+      return {
+        id: formatDiscoveryType(parsed.provider, parsed.type),
+        provider: parsed.provider,
+        type: parsed.type,
+        spec
+      };
+    }
+    __name(resolveDiscoveryType, "resolveDiscoveryType");
+    function isSecretReference(discover) {
+      return discover ? resolveDiscoveryType(discover)?.spec.secretRef === true : false;
+    }
+    __name(isSecretReference, "isSecretReference");
     exports.DISCOVERY_TYPE_PATTERN = /^(?:([a-z][a-z0-9]*)\/)?([a-z][a-zA-Z0-9]{0,63})$/;
     function parseDiscoveryType(value, fallbackProvider) {
       const match = exports.DISCOVERY_TYPE_PATTERN.exec(value);
@@ -1990,7 +2811,9 @@ var require_resources = __commonJS({
     }
     __name(formatDiscoveryType, "formatDiscoveryType");
     function discoveryTypeSpec(provider, type) {
-      return exports.DISCOVERY_VOCABULARY[provider]?.[type];
+      if (!Object.prototype.hasOwnProperty.call(exports.DISCOVERY_VOCABULARY, provider)) return void 0;
+      const vocabulary = exports.DISCOVERY_VOCABULARY[provider];
+      return Object.prototype.hasOwnProperty.call(vocabulary, type) ? vocabulary[type] : void 0;
     }
     __name(discoveryTypeSpec, "discoveryTypeSpec");
     function dependsOnLookup(keys, dependsOn) {
@@ -2076,8 +2899,59 @@ var require_governance = __commonJS({
       value: true
     });
     exports.ANY_POLICY_MATCH = void 0;
+    exports.approvalAssessmentOf = approvalAssessmentOf;
+    exports.planAssessmentOf = planAssessmentOf;
     exports.approvalOutcome = approvalOutcome;
     exports.policyScopeSentence = policyScopeSentence;
+    var decisions_1 = require_decisions();
+    function approvalAssessmentOf(checks, decided) {
+      const assessment = {
+        facts: [],
+        warnings: [],
+        decisions: []
+      };
+      for (const check of checks) {
+        if (check.decision) {
+          const answer = decided.find((decision) => decision.code === check.decision);
+          if (answer) assessment.decisions.push({
+            ...answer,
+            title: check.title
+          });
+        } else if (check.level === "warn") {
+          assessment.warnings.push(check.title);
+        } else if (check.level === "info") {
+          assessment.facts.push(check.title);
+        }
+      }
+      return assessment;
+    }
+    __name(approvalAssessmentOf, "approvalAssessmentOf");
+    function planAssessmentOf(value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+      const a = value;
+      if (!Array.isArray(a.facts) || !Array.isArray(a.warnings) || !Array.isArray(a.decisions)) {
+        return null;
+      }
+      const decisions = [];
+      for (const entry of a.decisions) {
+        const [decision] = (0, decisions_1.recordedDecisionsOf)([
+          entry
+        ]);
+        const title = typeof entry === "object" && entry !== null ? entry.title : null;
+        if (!decision || typeof title !== "string") return null;
+        decisions.push({
+          ...decision,
+          title
+        });
+      }
+      const strings = /* @__PURE__ */ __name((list) => list.filter((item) => typeof item === "string"), "strings");
+      return {
+        facts: strings(a.facts),
+        warnings: strings(a.warnings),
+        decisions
+      };
+    }
+    __name(planAssessmentOf, "planAssessmentOf");
     exports.ANY_POLICY_MATCH = {
       environments: [],
       riskLevels: [],
@@ -2188,7 +3062,10 @@ var require_operations = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.OPERATION_RUN_TARGET_STATUSES = exports.OPERATION_RUN_STEP_STATUSES = exports.OPERATION_RUN_STATUSES = exports.STEP_FAILURE_POLICIES = exports.OPERATION_STEP_KINDS = exports.DRY_RUN_OUTCOMES = exports.OPERATION_VERIFICATION_LIFECYCLES = exports.OPERATION_HEALTH_STATES = exports.OPERATION_LIFECYCLES = void 0;
+    exports.PREVIEW_UNCHECKED_SENTENCE = exports.PREVIEW_UNCHECKED_REASONS = exports.OPERATION_RUN_TARGET_STATUSES = exports.OPERATION_RUN_STEP_STATUSES = exports.OPERATION_RUN_STATUSES = exports.STEP_FAILURE_POLICIES = exports.OPERATION_STEP_KINDS = exports.DRY_RUN_OUTCOMES = exports.OPERATION_VERIFICATION_LIFECYCLES = exports.OPERATION_HEALTH_STATES = exports.OPERATION_LIFECYCLES = void 0;
+    exports.targetPlanOf = targetPlanOf;
+    var governance_1 = require_governance();
+    var decisions_1 = require_decisions();
     exports.OPERATION_LIFECYCLES = [
       "draft",
       "published",
@@ -2255,9 +3132,38 @@ var require_operations = __commonJS({
       "rolled_back",
       "rollback_failed"
     ];
-  }
-});
-
+    function targetPlanOf(stored) {
+      if (!Array.isArray(stored)) return null;
+      const plan = [];
+      for (const entry of stored) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+        const { ref, label, disposition, decisions, assessment, refusal } = entry;
+        if (typeof ref !== "string" || ref.length === 0) continue;
+        if (typeof label !== "string" || !(0, decisions_1.isTargetDisposition)(disposition)) continue;
+        if (refusal !== null && typeof refusal !== "string") continue;
+        plan.push({
+          ref,
+          label,
+          disposition,
+          decisions: (0, decisions_1.recordedDecisionsOf)(decisions),
+          assessment: (0, governance_1.planAssessmentOf)(assessment),
+          refusal: refusal ?? null
+        });
+      }
+      return plan;
+    }
+    __name(targetPlanOf, "targetPlanOf");
+    exports.PREVIEW_UNCHECKED_REASONS = [
+      "depends_on_earlier_output",
+      "connector_plans_no_checks"
+    ];
+    exports.PREVIEW_UNCHECKED_SENTENCE = {
+      depends_on_earlier_output: "Not checked before the run: this step's parameters come from an earlier step's outputs, which exist only once that step has run. Each target is checked when its execution is submitted, and a target that would need a decision is not acted on.",
+      connector_plans_no_checks: "This action runs no checks of its own before the run."
+    };
+  }
+});
+
 // ../contracts/dist/runs.js
 var require_runs = __commonJS({
   "../contracts/dist/runs.js"(exports) {
@@ -2291,6 +3197,28 @@ var require_runs = __commonJS({
   }
 });
 
+// ../contracts/dist/evidence-pack.js
+var require_evidence_pack = __commonJS({
+  "../contracts/dist/evidence-pack.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.EVIDENCE_EXPORTED_AUDIT_ACTION = exports.EVIDENCE_DIGEST_HEADER = void 0;
+    exports.evidencePackFilename = evidencePackFilename;
+    exports.EVIDENCE_DIGEST_HEADER = "X-Evidence-Digest";
+    exports.EVIDENCE_EXPORTED_AUDIT_ACTION = "operation.evidence_exported";
+    function evidencePackFilename(operationKey, from, to) {
+      return `${operationKey}-evidence-${compactInstant(from)}-${compactInstant(to)}.json`;
+    }
+    __name(evidencePackFilename, "evidencePackFilename");
+    function compactInstant(iso) {
+      return iso.replace(/\.\d+(?=Z|[+-]\d{2}:?\d{2}$)/, "").replace(/[-:]/g, "");
+    }
+    __name(compactInstant, "compactInstant");
+  }
+});
+
 // ../contracts/dist/package-egress.js
 var require_package_egress = __commonJS({
   "../contracts/dist/package-egress.js"(exports) {
@@ -2355,7 +3283,7 @@ var require_package_execution = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PACKAGE_CONTAINER_ENV = exports.PACKAGE_PHASES = void 0;
+    exports.RUN_TOKEN_REJECTED = exports.RUN_TOKEN_HEADER = exports.PACKAGE_RUNNER_ENTRYPOINT = exports.PACKAGE_CONTAINER_ENV = exports.PACKAGE_PHASES = void 0;
     exports.PACKAGE_PHASES = [
       "validate",
       "run",
@@ -2377,6 +3305,11 @@ var require_package_execution = __commonJS({
       egressControlUrl: "RUNVERIC_EGRESS_CONTROL_URL",
       egressControlToken: "RUNVERIC_EGRESS_CONTROL_TOKEN"
     };
+    exports.PACKAGE_RUNNER_ENTRYPOINT = [
+      "/opt/runveric/runner/launch.sh"
+    ];
+    exports.RUN_TOKEN_HEADER = "x-runveric-run-token";
+    exports.RUN_TOKEN_REJECTED = "This run token is not valid for this execution.";
   }
 });
 
@@ -2555,9 +3488,9 @@ var require_runners = __commonJS({
       authored: false
     };
     exports.RUNNER_POOL_DEFAULT_ACCEPTS_PROVENANCE = package_provenance_1.PACKAGE_PROVENANCE_KINDS.filter((kind) => exports.RUNNER_POOL_ACCEPTS_PROVENANCE_BY_DEFAULT[kind]);
-    function poolAcceptsProvenance(accepts, provenance) {
-      if (provenance === null) return false;
-      return accepts.includes(provenance);
+    function poolAcceptsProvenance(accepts, provenance2) {
+      if (provenance2 === null) return false;
+      return accepts.includes(provenance2);
     }
     __name(poolAcceptsProvenance, "poolAcceptsProvenance");
     function containerNameFor(runnerName) {
@@ -2627,6 +3560,803 @@ var require_runners = __commonJS({
   }
 });
 
+// ../contracts/dist/scoped-credential.js
+var require_scoped_credential = __commonJS({
+  "../contracts/dist/scoped-credential.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.RunnerStepCredentialExpiredError = exports.RunnerStepCredentialError = exports.STEP_CREDENTIAL_FAILURE = exports.ENGINE_ACTION_TOKEN_HOLDER = exports.RUNNER_STEP_TOKEN_HOLDER = exports.StaticScopedCredential = void 0;
+    var StaticScopedCredential = class StaticScopedCredential {
+      static {
+        __name(this, "StaticScopedCredential");
+      }
+      now;
+      holder;
+      byScope;
+      constructor(tokens2, now = Date.now, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        this.now = now;
+        this.holder = holder;
+        this.byScope = new Map(tokens2.map((token2) => [
+          token2.scope,
+          token2
+        ]));
+      }
+      async getToken(scopes) {
+        const requested = typeof scopes === "string" ? [
+          scopes
+        ] : scopes;
+        for (const scope of requested) {
+          const token2 = this.byScope.get(scope);
+          if (token2) {
+            if (token2.expiresOnTimestamp <= this.now()) {
+              throw new RunnerStepCredentialExpiredError(scope, token2.expiresOnTimestamp, this.now(), this.holder);
+            }
+            return {
+              token: token2.token,
+              expiresOnTimestamp: token2.expiresOnTimestamp
+            };
+          }
+        }
+        throw new RunnerStepCredentialError(requested, [
+          ...this.byScope.keys()
+        ], this.holder);
+      }
+    };
+    exports.StaticScopedCredential = StaticScopedCredential;
+    exports.RUNNER_STEP_TOKEN_HOLDER = {
+      noun: "step",
+      whereDeclared: "The channel mints exactly what a connector's azureAudiences declares, so this connector reaches an Azure resource it does not say it reaches.",
+      whyNoMore: "A step container is handed minted bytes and nothing it can use to get another, so the step ran longer than its own credential and cannot continue."
+    };
+    exports.ENGINE_ACTION_TOKEN_HOLDER = {
+      noun: "action",
+      whereDeclared: "The engine mints exactly the audiences an action's manifest declares in execution.audiences, so this action reaches an Azure resource it does not say it reaches.",
+      whyNoMore: "An action is handed minted bytes and nothing it can use to get another, so it ran longer than its own credential and cannot continue."
+    };
+    exports.STEP_CREDENTIAL_FAILURE = "runvericStepCredentialFailure";
+    var RunnerStepCredentialError = class RunnerStepCredentialError extends Error {
+      static {
+        __name(this, "RunnerStepCredentialError");
+      }
+      constructor(requested, available, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        super(`This ${holder.noun} was authorized for ${available.length > 0 ? available.map(quote).join(", ") : "no scopes"} and asked for ${requested.map(quote).join(", ")}. ${holder.whereDeclared}`);
+        this.name = "RunnerStepCredentialError";
+      }
+      /** Not a fact about the resource — see {@link STEP_CREDENTIAL_FAILURE}. */
+      [exports.STEP_CREDENTIAL_FAILURE] = true;
+    };
+    exports.RunnerStepCredentialError = RunnerStepCredentialError;
+    var RunnerStepCredentialExpiredError = class RunnerStepCredentialExpiredError extends Error {
+      static {
+        __name(this, "RunnerStepCredentialExpiredError");
+      }
+      constructor(scope, expiresOnTimestamp, now, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        super(`This ${holder.noun}'s token for ${quote(scope)} expired ${Math.round((now - expiresOnTimestamp) / 1e3)}s ago, at ${new Date(expiresOnTimestamp).toISOString()}. ${holder.whyNoMore}`);
+        this.name = "RunnerStepCredentialExpiredError";
+      }
+      /** Not a fact about the resource — see {@link STEP_CREDENTIAL_FAILURE}. */
+      [exports.STEP_CREDENTIAL_FAILURE] = true;
+    };
+    exports.RunnerStepCredentialExpiredError = RunnerStepCredentialExpiredError;
+    function quote(scope) {
+      return `"${scope}"`;
+    }
+    __name(quote, "quote");
+  }
+});
+
+// ../contracts/dist/action-protocol.js
+var require_action_protocol = __commonJS({
+  "../contracts/dist/action-protocol.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ActionProtocolError = exports.JWT_SHAPE = exports.REDACTED_SECRET = exports.ENGINE_RUN_ROUTES = exports.ACTION_PROBE_ENV = exports.ACTION_RUNTIME_PROBE_FLAG = exports.ACTION_CONTAINER_ENV = exports.MAX_PLAN_VALIDATE_TARGETS = exports.ACTION_PROTOCOL_LIMITS = exports.ACTION_EXECUTION_KINDS = exports.ENGINE_CONNECTOR_KEY = exports.ACTION_CONTRACTS = void 0;
+    exports.isActionContract = isActionContract;
+    exports.engineRunUrl = engineRunUrl;
+    exports.actionAudienceRefusal = actionAudienceRefusal;
+    exports.actionTokenScope = actionTokenScope;
+    exports.redactSecrets = redactSecrets;
+    exports.redactJwtShaped = redactJwtShaped;
+    exports.carriesJwtShaped = carriesJwtShaped;
+    exports.jsonByteLength = jsonByteLength;
+    exports.parseActionInvocation = parseActionInvocation;
+    exports.parseActionEvent = parseActionEvent;
+    exports.tooManyEvents = tooManyEvents;
+    exports.parseActionCheckpoint = parseActionCheckpoint;
+    exports.parseCheckpointAck = parseCheckpointAck;
+    exports.parseActionReport = parseActionReport;
+    var wire_identity_1 = require_wire_identity();
+    var package_execution_1 = require_package_execution();
+    var validation_1 = require_validation();
+    exports.ACTION_CONTRACTS = [
+      wire_identity_1.ACTION_PROTOCOL_V1
+    ];
+    function isActionContract(value) {
+      return typeof value === "string" && exports.ACTION_CONTRACTS.includes(value);
+    }
+    __name(isActionContract, "isActionContract");
+    exports.ENGINE_CONNECTOR_KEY = "runveric.engine";
+    exports.ACTION_EXECUTION_KINDS = [
+      "engine"
+    ];
+    exports.ACTION_PROTOCOL_LIMITS = {
+      maxEvents: 500,
+      maxEventBytes: 2048,
+      maxReportBytes: 262144,
+      maxRestorePointBytes: 65536
+    };
+    exports.MAX_PLAN_VALIDATE_TARGETS = 200;
+    exports.ACTION_CONTAINER_ENV = {
+      runToken: "RUNVERIC_ACTION_RUN_TOKEN",
+      callbackBaseUrl: "RUNVERIC_ACTION_CALLBACK_BASE_URL",
+      runId: "RUNVERIC_ACTION_RUN_ID",
+      imageDigest: "RUNVERIC_ACTION_IMAGE_DIGEST"
+    };
+    exports.ACTION_RUNTIME_PROBE_FLAG = "--probe";
+    exports.ACTION_PROBE_ENV = {
+      identities: "RUNVERIC_PROBE_IDENTITIES"
+    };
+    exports.ENGINE_RUN_ROUTES = {
+      base: "internal/engine-runs",
+      invocation: "invocation",
+      events: "events",
+      checkpoint: "checkpoint",
+      report: "report"
+    };
+    function engineRunUrl(callbackBaseUrl, runId, message) {
+      const origin2 = callbackBaseUrl.replace(/\/+$/, "");
+      return `${origin2}/${exports.ENGINE_RUN_ROUTES.base}/${encodeURIComponent(runId)}/${exports.ENGINE_RUN_ROUTES[message]}`;
+    }
+    __name(engineRunUrl, "engineRunUrl");
+    function actionAudienceRefusal(value) {
+      if (typeof value === "string" && AUDIENCE_ORIGIN.test(value)) return null;
+      return `"${String(value)}" is not an audience. An audience is the https origin of the resource a token is for \u2014 lowercase, with no port, path or trailing slash, e.g. "https://management.azure.com".`;
+    }
+    __name(actionAudienceRefusal, "actionAudienceRefusal");
+    var AUDIENCE_ORIGIN = /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+    function actionTokenScope(audience) {
+      return `${audience}/.default`;
+    }
+    __name(actionTokenScope, "actionTokenScope");
+    exports.REDACTED_SECRET = "[redacted]";
+    function redactSecrets(value, secrets) {
+      const present = secrets.filter((secret) => secret.length > 0);
+      if (present.length === 0) return value;
+      return mapStrings(value, (text) => present.reduce((out, secret) => out.split(secret).join(exports.REDACTED_SECRET), text));
+    }
+    __name(redactSecrets, "redactSecrets");
+    exports.JWT_SHAPE = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/;
+    function redactJwtShaped(value) {
+      const everyMatch = new RegExp(exports.JWT_SHAPE.source, "g");
+      return mapStrings(value, (text) => text.replace(everyMatch, exports.REDACTED_SECRET));
+    }
+    __name(redactJwtShaped, "redactJwtShaped");
+    function carriesJwtShaped(value) {
+      let found = false;
+      mapStrings(value, (text) => {
+        found ||= exports.JWT_SHAPE.test(text);
+        return text;
+      });
+      return found;
+    }
+    __name(carriesJwtShaped, "carriesJwtShaped");
+    function mapStrings(value, scrub) {
+      const walk = /* @__PURE__ */ __name((node) => {
+        if (typeof node === "string") return scrub(node);
+        if (Array.isArray(node)) return node.map(walk);
+        if (node !== null && typeof node === "object") {
+          return Object.fromEntries(Object.entries(node).map(([key, item]) => [
+            scrub(key),
+            walk(item)
+          ]));
+        }
+        return node;
+      }, "walk");
+      return walk(value);
+    }
+    __name(mapStrings, "mapStrings");
+    function jsonByteLength(value) {
+      const text = JSON.stringify(value) ?? "";
+      let bytes = 0;
+      for (const char of text) {
+        const point = char.codePointAt(0) ?? 0;
+        bytes += point < 128 ? 1 : point < 2048 ? 2 : point < 65536 ? 3 : 4;
+      }
+      return bytes;
+    }
+    __name(jsonByteLength, "jsonByteLength");
+    var ActionProtocolError = class ActionProtocolError extends Error {
+      static {
+        __name(this, "ActionProtocolError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "ActionProtocolError";
+      }
+    };
+    exports.ActionProtocolError = ActionProtocolError;
+    function parseActionInvocation(body) {
+      const raw = objectOf(body, "The invocation");
+      onlyKeys(raw, INVOCATION_KEYS, "The invocation");
+      if (!isActionContract(raw.protocol)) {
+        throw new ActionProtocolError(`The invocation speaks ${String(raw.protocol)}, and this runtime speaks ${exports.ACTION_CONTRACTS.join(", ")}.`);
+      }
+      const phase = raw.phase;
+      if (typeof phase !== "string" || !package_execution_1.PACKAGE_PHASES.includes(phase)) {
+        throw new ActionProtocolError(`An invocation phase of "${String(phase)}" is not in the vocabulary.`);
+      }
+      const actionRaw = objectOf(raw.action, "The invocation's action");
+      onlyKeys(actionRaw, [
+        "key",
+        "version",
+        "image"
+      ], "The invocation's action");
+      const action = {
+        key: nonEmpty(actionRaw.key, "The action's key"),
+        version: nonEmpty(actionRaw.version, "The action's version"),
+        image: digestPinned(actionRaw.image)
+      };
+      const executionRaw = objectOf(raw.execution, "The invocation's execution");
+      onlyKeys(executionRaw, [
+        "id",
+        "tenantId",
+        "correlationId",
+        "dryRun"
+      ], "The invocation's execution");
+      if (typeof executionRaw.dryRun !== "boolean") {
+        throw new ActionProtocolError("The invocation's execution must say whether it is a dry run.");
+      }
+      const execution = {
+        id: nonEmpty(executionRaw.id, "The execution's id"),
+        tenantId: nonEmpty(executionRaw.tenantId, "The execution's tenant"),
+        correlationId: nonEmpty(executionRaw.correlationId, "The execution's correlation id"),
+        dryRun: executionRaw.dryRun
+      };
+      const limits = parseLimits(raw.limits);
+      const decisions = parseDecisions(raw.decisions);
+      const targets = parseTargets(raw.targets);
+      const credentials = {
+        tokens: parseTokens(objectOf(raw.credentials, "The invocation's credentials"))
+      };
+      const restorePoint = nullableObject(raw.restorePoint, "The invocation's restore point");
+      const priorResult = nullableObject(raw.priorResult, "The invocation's prior result");
+      if (restorePoint !== null && jsonByteLength(restorePoint) > limits.maxRestorePointBytes) {
+        throw new ActionProtocolError(`The invocation's restore point is larger than ${limits.maxRestorePointBytes} bytes.`);
+      }
+      const base = {
+        protocol: raw.protocol,
+        action,
+        execution,
+        targets,
+        credentials,
+        limits
+      };
+      if (phase === "validate") {
+        if (raw.mode !== "plan" && raw.mode !== "run") {
+          throw new ActionProtocolError(`A validate invocation's mode of "${String(raw.mode)}" is not "plan" or "run".`);
+        }
+        if (raw.mode !== decisions.phase) {
+          throw new ActionProtocolError(`A validate invocation in ${raw.mode} mode carries ${decisions.phase}-phase decisions; the two are the same fact.`);
+        }
+        assertTargetCount(targets.length, raw.mode === "plan" ? exports.MAX_PLAN_VALIDATE_TARGETS : 1, `A ${raw.mode}-mode validate`);
+        if (restorePoint !== null || priorResult !== null) {
+          throw new ActionProtocolError("A validate invocation carries no restore point and no prior result.");
+        }
+        return {
+          ...base,
+          phase,
+          mode: raw.mode,
+          decisions,
+          restorePoint: null,
+          priorResult: null
+        };
+      }
+      if (raw.mode !== void 0) {
+        throw new ActionProtocolError(`A ${phase} invocation has no mode \u2014 only a validate is asked in a mode.`);
+      }
+      if (decisions.phase !== "run") {
+        throw new ActionProtocolError(`A ${phase} invocation carries a run's decisions, never a plan's.`);
+      }
+      assertTargetCount(targets.length, 1, `A ${phase}`);
+      if (phase === "run") {
+        if (priorResult !== null) {
+          throw new ActionProtocolError("A run invocation carries no prior result \u2014 only a rollback reads one.");
+        }
+        return {
+          ...base,
+          phase,
+          decisions,
+          restorePoint,
+          priorResult: null
+        };
+      }
+      return {
+        ...base,
+        phase: "rollback",
+        decisions,
+        restorePoint,
+        priorResult
+      };
+    }
+    __name(parseActionInvocation, "parseActionInvocation");
+    function parseActionEvent(body, limits, alreadyReceived) {
+      if (alreadyReceived >= limits.maxEvents) throw tooManyEvents(limits);
+      const raw = objectOf(body, "An event");
+      onlyKeys(raw, [
+        "level",
+        "message",
+        "data"
+      ], "An event");
+      if (jsonByteLength(raw) > limits.maxEventBytes) {
+        throw new ActionProtocolError(`An event is larger than ${limits.maxEventBytes} bytes.`);
+      }
+      if (typeof raw.level !== "string" || !Object.hasOwn(EVENT_LEVELS, raw.level)) {
+        throw new ActionProtocolError(`An event level of "${String(raw.level)}" is not in the vocabulary.`);
+      }
+      const message = nonEmpty(raw.message, "An event's message");
+      if (raw.data === void 0) return {
+        level: raw.level,
+        message
+      };
+      return {
+        level: raw.level,
+        message,
+        data: jsonObject(raw.data, "An event's data")
+      };
+    }
+    __name(parseActionEvent, "parseActionEvent");
+    function tooManyEvents(limits) {
+      return new ActionProtocolError(`The action sent more than ${limits.maxEvents} events.`);
+    }
+    __name(tooManyEvents, "tooManyEvents");
+    function parseActionCheckpoint(body, limits) {
+      const raw = objectOf(body, "A checkpoint");
+      onlyKeys(raw, [
+        "kind",
+        "record"
+      ], "A checkpoint");
+      if (raw.kind !== "restore_point") {
+        throw new ActionProtocolError(`A checkpoint of kind "${String(raw.kind)}" is not one this contract knows.`);
+      }
+      const record = jsonObject(raw.record, "A checkpoint's record");
+      if (jsonByteLength(record) > limits.maxRestorePointBytes) {
+        throw new ActionProtocolError(`A restore point is larger than ${limits.maxRestorePointBytes} bytes.`);
+      }
+      return {
+        kind: "restore_point",
+        record
+      };
+    }
+    __name(parseActionCheckpoint, "parseActionCheckpoint");
+    function parseCheckpointAck(body) {
+      const raw = objectOf(body, "A checkpoint acknowledgement");
+      onlyKeys(raw, [
+        "acknowledged"
+      ], "A checkpoint acknowledgement");
+      if (raw.acknowledged !== true) {
+        throw new ActionProtocolError("The checkpoint was not acknowledged.");
+      }
+      return {
+        acknowledged: true
+      };
+    }
+    __name(parseCheckpointAck, "parseCheckpointAck");
+    function parseActionReport(body, sent) {
+      const raw = objectOf(body, "The report");
+      onlyKeys(raw, [
+        "phase",
+        "checks",
+        "outcome"
+      ], "The report");
+      if (jsonByteLength(raw) > sent.limits.maxReportBytes) {
+        throw new ActionProtocolError(`The report is larger than ${sent.limits.maxReportBytes} bytes.`);
+      }
+      if (raw.phase !== sent.phase) {
+        throw new ActionProtocolError(`The report is for phase "${String(raw.phase)}", but this invocation is for "${sent.phase}".`);
+      }
+      if (sent.phase === "validate") {
+        if (raw.checks === void 0 === (raw.outcome === void 0)) {
+          throw new ActionProtocolError("A validate report carries checks, or \u2014 when they could not run \u2014 a failed outcome; exactly one of the two.");
+        }
+        if (raw.outcome !== void 0) {
+          const outcome = parseOutcome(raw.outcome);
+          if (outcome.status !== "failed") {
+            throw new ActionProtocolError(`A validate report's outcome can only say the checks failed to run, never "${outcome.status}" \u2014 the engine decides what checks mean.`);
+          }
+          return {
+            phase: "validate",
+            outcome
+          };
+        }
+        const byRef = objectOf(raw.checks, "A validate report's checks");
+        const expected = new Set(sent.targets.map((target) => target.ref));
+        for (const ref of Object.keys(byRef)) {
+          if (!expected.has(ref)) {
+            throw new ActionProtocolError(`The report answers for "${ref}", which is not one of the targets it was given.`);
+          }
+        }
+        const checks = sent.targets.map(({ ref }) => {
+          if (!Object.hasOwn(byRef, ref)) {
+            throw new ActionProtocolError(`The report says nothing about "${ref}", one of the targets it was given.`);
+          }
+          const list = byRef[ref];
+          if (!Array.isArray(list)) {
+            throw new ActionProtocolError(`The checks for "${ref}" must be an array.`);
+          }
+          return {
+            ref,
+            checks: list.map((entry) => {
+              const parsed = (0, validation_1.validationCheckOf)(entry);
+              if ("refusal" in parsed) throw new ActionProtocolError(`The checks for "${ref}": ${parsed.refusal}`);
+              return parsed.check;
+            })
+          };
+        });
+        return {
+          phase: "validate",
+          checks
+        };
+      }
+      if (raw.checks !== void 0) {
+        throw new ActionProtocolError(`A ${sent.phase} report carries an outcome, never checks \u2014 those are the validate phase's answer.`);
+      }
+      return {
+        phase: sent.phase,
+        outcome: parseOutcome(raw.outcome)
+      };
+    }
+    __name(parseActionReport, "parseActionReport");
+    var INVOCATION_KEYS = [
+      "protocol",
+      "action",
+      "phase",
+      "mode",
+      "execution",
+      "targets",
+      "decisions",
+      "restorePoint",
+      "priorResult",
+      "credentials",
+      "limits"
+    ];
+    var EVENT_LEVELS = {
+      info: true,
+      warn: true,
+      error: true,
+      success: true
+    };
+    var OUTCOME_STATUSES = {
+      succeeded: true,
+      failed: true,
+      cancelled: true
+    };
+    function parseOutcome(value) {
+      if (value === void 0) {
+        throw new ActionProtocolError("A run or rollback report must carry an outcome.");
+      }
+      const raw = objectOf(value, "An outcome");
+      onlyKeys(raw, [
+        "status",
+        "message",
+        "data"
+      ], "An outcome");
+      if (typeof raw.status !== "string" || !Object.hasOwn(OUTCOME_STATUSES, raw.status)) {
+        throw new ActionProtocolError(`An outcome status of "${String(raw.status)}" is not in the vocabulary.`);
+      }
+      const status = raw.status;
+      const message = nonEmpty(raw.message, "An outcome's message");
+      if (raw.data === void 0) return {
+        status,
+        message
+      };
+      return {
+        status,
+        message,
+        data: jsonObject(raw.data, "An outcome's data")
+      };
+    }
+    __name(parseOutcome, "parseOutcome");
+    function parseLimits(value) {
+      const raw = objectOf(value, "The invocation's limits");
+      onlyKeys(raw, [
+        "deadline",
+        "maxEvents",
+        "maxEventBytes",
+        "maxReportBytes",
+        "maxRestorePointBytes"
+      ], "The invocation's limits");
+      return {
+        deadline: isoInstant(raw.deadline, "The deadline"),
+        maxEvents: positiveInteger(raw.maxEvents, "maxEvents"),
+        maxEventBytes: positiveInteger(raw.maxEventBytes, "maxEventBytes"),
+        maxReportBytes: positiveInteger(raw.maxReportBytes, "maxReportBytes"),
+        maxRestorePointBytes: positiveInteger(raw.maxRestorePointBytes, "maxRestorePointBytes")
+      };
+    }
+    __name(parseLimits, "parseLimits");
+    function parseDecisions(value) {
+      const raw = objectOf(value, "The invocation's decisions");
+      if (raw.phase === "plan") {
+        onlyKeys(raw, [
+          "phase"
+        ], "A plan's decisions");
+        return {
+          phase: "plan"
+        };
+      }
+      if (raw.phase !== "run") {
+        throw new ActionProtocolError(`A decisions phase of "${String(raw.phase)}" is not "plan" or "run".`);
+      }
+      onlyKeys(raw, [
+        "phase",
+        "recorded"
+      ], "A run's decisions");
+      if (!Array.isArray(raw.recorded)) {
+        throw new ActionProtocolError("A run's decisions must carry the recorded list, even when it is empty.");
+      }
+      const recorded = raw.recorded.map((entry) => {
+        const decision = objectOf(entry, "A recorded decision");
+        onlyKeys(decision, [
+          "code",
+          "acknowledgedBy",
+          "acknowledgedAt"
+        ], "A recorded decision");
+        if (!(0, validation_1.isDecisionCode)(decision.code)) {
+          throw new ActionProtocolError(`A recorded decision of "${String(decision.code)}" is not in the vocabulary.`);
+        }
+        return {
+          code: decision.code,
+          acknowledgedBy: nonEmpty(decision.acknowledgedBy, "Who acknowledged a decision"),
+          acknowledgedAt: isoInstant(decision.acknowledgedAt, "When a decision was acknowledged")
+        };
+      });
+      if (new Set(recorded.map((decision) => decision.code)).size !== recorded.length) {
+        throw new ActionProtocolError("A run's decisions record one code twice.");
+      }
+      return {
+        phase: "run",
+        recorded
+      };
+    }
+    __name(parseDecisions, "parseDecisions");
+    function parseTargets(value) {
+      if (!Array.isArray(value)) {
+        throw new ActionProtocolError("The invocation's targets must be an array.");
+      }
+      const targets = value.map((entry) => {
+        const raw = objectOf(entry, "A target");
+        onlyKeys(raw, [
+          "ref",
+          "parameters"
+        ], "A target");
+        return {
+          ref: nonEmpty(raw.ref, "A target's ref"),
+          parameters: jsonObject(raw.parameters, "A target's parameters")
+        };
+      });
+      if (new Set(targets.map((target) => target.ref)).size !== targets.length) {
+        throw new ActionProtocolError("The invocation names one target twice.");
+      }
+      return targets;
+    }
+    __name(parseTargets, "parseTargets");
+    function assertTargetCount(count, max, what) {
+      if (count < 1 || count > max) {
+        throw new ActionProtocolError(max === 1 ? `${what} acts on exactly one target; this invocation names ${count}.` : `${what} checks between 1 and ${max} targets; this invocation names ${count}.`);
+      }
+    }
+    __name(assertTargetCount, "assertTargetCount");
+    function parseTokens(credentials) {
+      onlyKeys(credentials, [
+        "tokens"
+      ], "The invocation's credentials");
+      if (!Array.isArray(credentials.tokens)) {
+        throw new ActionProtocolError("The invocation's credentials must carry a tokens array, even when it is empty.");
+      }
+      const tokens2 = credentials.tokens.map((entry) => {
+        const raw = objectOf(entry, "A token");
+        onlyKeys(raw, [
+          "audience",
+          "token",
+          "expiresOn"
+        ], "A token");
+        const refusal = actionAudienceRefusal(raw.audience);
+        if (refusal !== null) throw new ActionProtocolError(refusal);
+        return {
+          audience: raw.audience,
+          token: nonEmpty(raw.token, "A token's value"),
+          expiresOn: isoInstant(raw.expiresOn, "A token's expiry")
+        };
+      });
+      if (new Set(tokens2.map((token2) => token2.audience)).size !== tokens2.length) {
+        throw new ActionProtocolError("The invocation carries two tokens for one audience.");
+      }
+      return tokens2;
+    }
+    __name(parseTokens, "parseTokens");
+    var DIGEST_PINNED_IMAGE = /^[a-z0-9][a-z0-9._\-/:]*@sha256:[0-9a-f]{64}$/;
+    function digestPinned(value) {
+      if (typeof value !== "string" || !DIGEST_PINNED_IMAGE.test(value)) {
+        throw new ActionProtocolError(`The action's image "${String(value)}" is not addressed by digest. Nothing on the execution path resolves a tag (docs/128 \xA713.2).`);
+      }
+      return value;
+    }
+    __name(digestPinned, "digestPinned");
+    function objectOf(value, what) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new ActionProtocolError(`${what} must be an object.`);
+      }
+      return value;
+    }
+    __name(objectOf, "objectOf");
+    function onlyKeys(raw, allowed, what) {
+      for (const key of Object.keys(raw)) {
+        if (!allowed.includes(key)) {
+          throw new ActionProtocolError(`${what} carries "${key}", which this contract does not have.`);
+        }
+      }
+    }
+    __name(onlyKeys, "onlyKeys");
+    function nonEmpty(value, what) {
+      if (typeof value !== "string" || value.length === 0) {
+        throw new ActionProtocolError(`${what} must be a non-empty string.`);
+      }
+      return value;
+    }
+    __name(nonEmpty, "nonEmpty");
+    function positiveInteger(value, what) {
+      if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+        throw new ActionProtocolError(`The limit "${what}" must be a positive integer.`);
+      }
+      return value;
+    }
+    __name(positiveInteger, "positiveInteger");
+    function isoInstant(value, what) {
+      if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+        throw new ActionProtocolError(`${what} must be an ISO-8601 instant.`);
+      }
+      return value;
+    }
+    __name(isoInstant, "isoInstant");
+    function nullableObject(value, what) {
+      return value === null ? null : jsonObject(value, what);
+    }
+    __name(nullableObject, "nullableObject");
+    function jsonObject(value, what) {
+      if (!isJsonObject(value)) {
+        throw new ActionProtocolError(`${what} must be a JSON object.`);
+      }
+      return value;
+    }
+    __name(jsonObject, "jsonObject");
+    function isJsonObject(value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+      const prototype = Object.getPrototypeOf(value);
+      if (prototype !== Object.prototype && prototype !== null) return false;
+      return Object.values(value).every(isJsonValue);
+    }
+    __name(isJsonObject, "isJsonObject");
+    function isJsonValue(value) {
+      if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+      if (typeof value === "number") return Number.isFinite(value);
+      if (Array.isArray(value)) return value.every(isJsonValue);
+      return isJsonObject(value);
+    }
+    __name(isJsonValue, "isJsonValue");
+  }
+});
+
+// ../contracts/dist/action-signing.js
+var require_action_signing = __commonJS({
+  "../contracts/dist/action-signing.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ACTION_SIGNATURE_REPOSITORY = exports.IMAGE_REVISION_LABEL = exports.IMAGE_SOURCE_LABEL = exports.COSIGN_SIGN_PREDICATE_TYPE = exports.IN_TOTO_STATEMENT_TYPE = exports.DSSE_IN_TOTO_PAYLOAD_TYPE = exports.SIGSTORE_BUNDLE_MEDIA_TYPE = void 0;
+    exports.SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
+    exports.DSSE_IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+    exports.IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+    exports.COSIGN_SIGN_PREDICATE_TYPE = "https://sigstore.dev/cosign/sign/v1";
+    exports.IMAGE_SOURCE_LABEL = "org.opencontainers.image.source";
+    exports.IMAGE_REVISION_LABEL = "org.opencontainers.image.revision";
+    exports.ACTION_SIGNATURE_REPOSITORY = "ghcr.io/runveric/action-signatures";
+  }
+});
+
+// ../contracts/dist/oci-media-types.js
+var require_oci_media_types = __commonJS({
+  "../contracts/dist/oci-media-types.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.IMAGE_MANIFEST_MEDIA_TYPES = exports.MANIFEST_MEDIA_TYPES = exports.DOCKER_MANIFEST_LIST = exports.OCI_IMAGE_INDEX = exports.DOCKER_IMAGE_MANIFEST = exports.OCI_IMAGE_MANIFEST = void 0;
+    exports.OCI_IMAGE_MANIFEST = "application/vnd.oci.image.manifest.v1+json";
+    exports.DOCKER_IMAGE_MANIFEST = "application/vnd.docker.distribution.manifest.v2+json";
+    exports.OCI_IMAGE_INDEX = "application/vnd.oci.image.index.v1+json";
+    exports.DOCKER_MANIFEST_LIST = "application/vnd.docker.distribution.manifest.list.v2+json";
+    exports.MANIFEST_MEDIA_TYPES = [
+      exports.OCI_IMAGE_MANIFEST,
+      exports.DOCKER_IMAGE_MANIFEST,
+      exports.OCI_IMAGE_INDEX,
+      exports.DOCKER_MANIFEST_LIST
+    ];
+    exports.IMAGE_MANIFEST_MEDIA_TYPES = [
+      exports.OCI_IMAGE_MANIFEST,
+      exports.DOCKER_IMAGE_MANIFEST
+    ];
+  }
+});
+
+// ../contracts/dist/action-image.js
+var require_action_image = __commonJS({
+  "../contracts/dist/action-image.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.MAX_IMAGE_MANIFEST_BYTES = exports.ACTION_RUNTIME_IMAGE = exports.ACTION_RUNTIME_REPOSITORY = void 0;
+    exports.imageConfigDescriptor = imageConfigDescriptor2;
+    exports.actionImageRefusal = actionImageRefusal2;
+    var action_repository_1 = require_action_repository();
+    var action_signing_1 = require_action_signing();
+    var oci_media_types_1 = require_oci_media_types();
+    exports.ACTION_RUNTIME_REPOSITORY = "ghcr.io/runveric/action-runtime";
+    exports.ACTION_RUNTIME_IMAGE = `${exports.ACTION_RUNTIME_REPOSITORY}@sha256:0774c0768c6d1b11e7224ce5bca925549e369fed75eeb412531c1dce10bc8a8a`;
+    exports.MAX_IMAGE_MANIFEST_BYTES = 64 * 1024;
+    var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+    function imageConfigDescriptor2(manifest) {
+      if (!isRecord(manifest) || typeof manifest.mediaType !== "string") return null;
+      if (!oci_media_types_1.IMAGE_MANIFEST_MEDIA_TYPES.includes(manifest.mediaType) || manifest.schemaVersion !== 2) return null;
+      const config = manifest.config;
+      if (!isRecord(config) || typeof config.digest !== "string") return null;
+      if (typeof config.size !== "number" || !Number.isInteger(config.size) || config.size < 0) return null;
+      return {
+        digest: config.digest,
+        size: config.size
+      };
+    }
+    __name(imageConfigDescriptor2, "imageConfigDescriptor");
+    function actionImageRefusal2(input) {
+      const { key, image, manifest, config, provenance: provenance2 } = input;
+      const mediaType = isRecord(manifest) ? manifest.mediaType : void 0;
+      if (typeof mediaType !== "string" || !oci_media_types_1.IMAGE_MANIFEST_MEDIA_TYPES.includes(mediaType)) {
+        return `${image} is ${typeof mediaType === "string" ? `a ${mediaType}` : "a manifest of no declared type"}, not one image. An engine action's digest names exactly one linux/amd64 image manifest \u2014 never an index of several.`;
+      }
+      if (imageConfigDescriptor2(manifest) === null) {
+        return `${image} is not an image manifest \u2014 it names no config descriptor (schemaVersion 2, a digest and a size).`;
+      }
+      if (!isRecord(config)) {
+        return `${image}'s config is not a JSON object, so it cannot say what it was built for.`;
+      }
+      const platform = `${String(config.os)}/${String(config.architecture)}`;
+      if (platform !== "linux/amd64") {
+        return `${image} is built for ${platform}; an engine action runs on linux/amd64, which is what Container Apps Jobs run.`;
+      }
+      const labels = isRecord(config.config) && isRecord(config.config.Labels) ? config.config.Labels : {};
+      const expected = (0, action_repository_1.actionSourceRepository)(key);
+      const source = labels[action_signing_1.IMAGE_SOURCE_LABEL];
+      if (source !== expected) {
+        return `the image of action "${key}" says it was built in ${source === void 0 ? "no repository (it carries no " + action_signing_1.IMAGE_SOURCE_LABEL + " label)" : JSON.stringify(source)}, not ${expected}. A signature binds a digest and never a name, so an image built for another action cannot run under this one's manifest.`;
+      }
+      if (provenance2.repository !== expected) {
+        return `the artifact of action "${key}" says it was authored in ${JSON.stringify(provenance2.repository)}, not ${expected}, which its image names.`;
+      }
+      const revision = labels[action_signing_1.IMAGE_REVISION_LABEL];
+      if (revision !== provenance2.commit) {
+        return `the image of action "${key}" says it was built at ${revision === void 0 ? "no commit (it carries no " + action_signing_1.IMAGE_REVISION_LABEL + " label)" : JSON.stringify(revision)}, not ${provenance2.commit}, the commit its artifact was published from. An image and the manifest it runs under come from one commit, so neither can be swapped for another's.`;
+      }
+      return null;
+    }
+    __name(actionImageRefusal2, "actionImageRefusal");
+  }
+});
+
 // ../contracts/dist/runner-pool-presence.js
 var require_runner_pool_presence = __commonJS({
   "../contracts/dist/runner-pool-presence.js"(exports) {
@@ -3385,11 +5115,11 @@ var require_workspace_domain = __commonJS({
       "held_elsewhere"
     ];
     exports.DOMAIN_VERIFICATION_RECORD_PREFIX = "runveric-domain-verification=";
-    function domainVerificationRecord(domain, token) {
+    function domainVerificationRecord(domain, token2) {
       return {
         name: domain,
         type: "TXT",
-        value: `${exports.DOMAIN_VERIFICATION_RECORD_PREFIX}${token}`
+        value: `${exports.DOMAIN_VERIFICATION_RECORD_PREFIX}${token2}`
       };
     }
     __name(domainVerificationRecord, "domainVerificationRecord");
@@ -3572,9 +5302,16 @@ var require_dist = __commonJS({
     __exportStar(require_tenant_users(), exports);
     __exportStar(require_invitations(), exports);
     __exportStar(require_groups(), exports);
+    __exportStar(require_catalog_policy(), exports);
     __exportStar(require_catalog(), exports);
+    __exportStar(require_catalog_release(), exports);
+    __exportStar(require_action_repository(), exports);
+    __exportStar(require_catalog_release_spec(), exports);
+    __exportStar(require_catalog_lock(), exports);
+    __exportStar(require_catalog_manifest_placeholders(), exports);
     __exportStar(require_change_control(), exports);
     __exportStar(require_execution(), exports);
+    __exportStar(require_decisions(), exports);
     __exportStar(require_execution_site(), exports);
     __exportStar(require_run_placement(), exports);
     __exportStar(require_connections(), exports);
@@ -3585,6 +5322,7 @@ var require_dist = __commonJS({
     __exportStar(require_scheduling(), exports);
     __exportStar(require_operations(), exports);
     __exportStar(require_runs(), exports);
+    __exportStar(require_evidence_pack(), exports);
     __exportStar(require_package_tier(), exports);
     __exportStar(require_package_provenance(), exports);
     __exportStar(require_packages(), exports);
@@ -3594,6 +5332,11 @@ var require_dist = __commonJS({
     __exportStar(require_runner_install(), exports);
     __exportStar(require_authoring_cli(), exports);
     __exportStar(require_runners(), exports);
+    __exportStar(require_scoped_credential(), exports);
+    __exportStar(require_action_protocol(), exports);
+    __exportStar(require_action_signing(), exports);
+    __exportStar(require_oci_media_types(), exports);
+    __exportStar(require_action_image(), exports);
     __exportStar(require_runner_pool_presence(), exports);
     __exportStar(require_routable_target(), exports);
     __exportStar(require_runner_pool_routing(), exports);
@@ -3831,6 +5574,7 @@ var require_manifest_validator = __commonJS({
     exports.canonicalJson = canonicalJson;
     exports.sha256Hex = sha256Hex;
     exports.isSafeRelativePath = isSafeRelativePath;
+    exports.isEgressDestination = isEgressDestination;
     var node_crypto_1 = __require("crypto");
     var node_net_1 = __require("net");
     var contracts_1 = require_dist();
@@ -5095,7 +6839,7 @@ var require_authoring_lint = __commonJS({
         if (!isRecord(permission) || !Array.isArray(permission.actions)) return;
         permission.actions.forEach((action, actionIndex) => {
           if (typeof action !== "string" || action.includes("*")) return;
-          if (permissionTokens(action).some((token) => haystack.includes(token))) return;
+          if (permissionTokens(action).some((token2) => haystack.includes(token2))) return;
           findings.push({
             severity: "warning",
             rule: "package/permission-possibly-unused",
@@ -5242,7 +6986,7 @@ var require_parameters_location = __commonJS({
     });
     exports.resolveParametersFile = resolveParametersFile;
     exports.resolveParametersFileOf = resolveParametersFileOf;
-    exports.readManifest = readManifest;
+    exports.readManifest = readManifest2;
     var yaml_1 = __require("yaml");
     var manifest_validator_1 = require_manifest_validator();
     var package_validation_1 = require_package_validation();
@@ -5253,7 +6997,7 @@ var require_parameters_location = __commonJS({
           reason: "manifest_missing"
         };
       }
-      const manifest = readManifest(manifestSource);
+      const manifest = readManifest2(manifestSource);
       if (!manifest) return {
         resolved: false,
         reason: "manifest_unparseable"
@@ -5281,7 +7025,7 @@ var require_parameters_location = __commonJS({
       return resolveParametersFile(files.get(package_validation_1.MANIFEST_FILE));
     }
     __name(resolveParametersFileOf, "resolveParametersFileOf");
-    function readManifest(source) {
+    function readManifest2(source) {
       try {
         const document = (0, yaml_1.parseDocument)(source);
         if (document.errors.length > 0) return void 0;
@@ -5291,7 +7035,7 @@ var require_parameters_location = __commonJS({
         return void 0;
       }
     }
-    __name(readManifest, "readManifest");
+    __name(readManifest2, "readManifest");
   }
 });
 
@@ -6623,7 +8367,8 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.scaffoldActionPackage = exports.reservedImportPaths = exports.generateImportedPackage = exports.authoredEntrypointOf = exports.authoredBodyPath = exports.powerShellDetection = exports.parseProbeOutput = exports.mapDeclaredParameters = exports.POWERSHELL_PARAM_PROBE = exports.pathSegments = exports.offsetToLocation = exports.locate = exports.interpreterForPath = exports.interpreterEntryFileList = exports.PACKAGE_INTERPRETER_EXTENSIONS = exports.PACKAGE_INTERPRETER_LAUNCH = exports.lintActionPackage = exports.sortFindings = exports.mergeFindings = exports.findingFromValidation = exports.resolveParametersFileOf = exports.resolveParametersFile = exports.readManifest = exports.checkActionPackage = exports.validateActionPackage = exports.REQUIRED_PACKAGE_FILES = exports.MANIFEST_FILE = exports.validatePackageResult = exports.PackageProtocolError = exports.normalizePackageRuntime = exports.checkOciImageReference = exports.PackageRuntimeDeclarationError = exports.PARAMETER_CONTROLS = exports.PARAMETER_PROPERTY_FIELDS = exports.PARAMETER_SCHEMA_FIELDS = exports.CREDENTIAL_SCOPE_PATTERN = exports.SPDX_ID_PATTERN = exports.DURATION_PATTERN = exports.SEMVER_PATTERN = exports.PACKAGE_ID_PATTERN = exports.MANIFEST_FIELDS = exports.RISK_LEVELS = exports.PROVIDERS = exports.ACTION_CATEGORIES = exports.isSafeRelativePath = exports.sha256Hex = exports.canonicalJson = exports.validateParameterSchema = exports.validateManifest = exports.parseAndValidateManifest = void 0;
+    exports.reservedImportPaths = exports.generateImportedPackage = exports.authoredEntrypointOf = exports.authoredBodyPath = exports.powerShellDetection = exports.parseProbeOutput = exports.mapDeclaredParameters = exports.POWERSHELL_PARAM_PROBE = exports.pathSegments = exports.offsetToLocation = exports.locate = exports.interpreterForPath = exports.interpreterEntryFileList = exports.PACKAGE_INTERPRETER_EXTENSIONS = exports.PACKAGE_INTERPRETER_LAUNCH = exports.lintActionPackage = exports.sortFindings = exports.mergeFindings = exports.findingFromValidation = exports.resolveParametersFileOf = exports.resolveParametersFile = exports.readManifest = exports.checkActionPackage = exports.validateActionPackage = exports.REQUIRED_PACKAGE_FILES = exports.MANIFEST_FILE = exports.validatePackageResult = exports.PackageProtocolError = exports.normalizePackageRuntime = exports.checkOciImageReference = exports.PackageRuntimeDeclarationError = exports.PARAMETER_CONTROLS = exports.PARAMETER_PROPERTY_FIELDS = exports.PARAMETER_SCHEMA_FIELDS = exports.CREDENTIAL_SCOPE_PATTERN = exports.SPDX_ID_PATTERN = exports.DURATION_PATTERN = exports.SEMVER_PATTERN = exports.PACKAGE_ID_PATTERN = exports.MANIFEST_FIELDS = exports.RISK_LEVELS = exports.PROVIDERS = exports.ACTION_CATEGORIES = exports.isEgressDestination = exports.isSafeRelativePath = exports.sha256Hex = exports.canonicalJson = exports.validateParameterSchema = exports.validateManifest = exports.parseAndValidateManifest = void 0;
+    exports.scaffoldActionPackage = void 0;
     var manifest_validator_1 = require_manifest_validator();
     Object.defineProperty(exports, "parseAndValidateManifest", {
       enumerable: true,
@@ -6661,6 +8406,12 @@ var require_dist2 = __commonJS({
         return manifest_validator_1.isSafeRelativePath;
       }, "get")
     });
+    Object.defineProperty(exports, "isEgressDestination", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return manifest_validator_1.isEgressDestination;
+      }, "get")
+    });
     var manifest_schema_1 = require_manifest_schema();
     Object.defineProperty(exports, "ACTION_CATEGORIES", {
       enumerable: true,
@@ -6941,67 +8692,7 @@ var require_dist2 = __commonJS({
 });
 
 // package.json
-var version = "0.1.2";
-
-// src/check.ts
-var import_action_manifest = __toESM(require_dist2());
-import { resolve } from "path";
-
-// src/package-dir.ts
-import { readdir, readFile, stat } from "fs/promises";
-import { join, relative, sep } from "path";
-var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
-  ".git",
-  ".runveric",
-  "node_modules",
-  ".venv",
-  "__pycache__",
-  ".DS_Store"
-]);
-var MAX_FILES = 2e3;
-var MAX_TOTAL_BYTES = 16 * 1024 * 1024;
-var PackageDirectoryError = class extends Error {
-  static {
-    __name(this, "PackageDirectoryError");
-  }
-};
-async function readPackageDirectory(root) {
-  const properties = await stat(root).catch(() => null);
-  if (!properties?.isDirectory()) {
-    throw new PackageDirectoryError(`${root} is not a directory.`);
-  }
-  const files = /* @__PURE__ */ new Map();
-  let totalBytes = 0;
-  const walk = /* @__PURE__ */ __name(async (directory) => {
-    for (const entry of await readdir(directory, {
-      withFileTypes: true
-    })) {
-      if (IGNORED_DIRECTORIES.has(entry.name)) continue;
-      const full = join(directory, entry.name);
-      if (entry.isDirectory()) {
-        await walk(full);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      if (files.size >= MAX_FILES) {
-        throw new PackageDirectoryError(`This directory holds more than ${MAX_FILES} files. That is almost certainly not a single action package \u2014 run this from the package directory itself.`);
-      }
-      const contents = await readFile(full);
-      totalBytes += contents.byteLength;
-      if (totalBytes > MAX_TOTAL_BYTES) {
-        throw new PackageDirectoryError(`This directory holds more than ${MAX_TOTAL_BYTES / (1024 * 1024)}MB. An action package is source, not artifacts \u2014 add build output to .gitignore.`);
-      }
-      files.set(toPackagePath(root, full), contents);
-    }
-  }, "walk");
-  await walk(root);
-  return files;
-}
-__name(readPackageDirectory, "readPackageDirectory");
-function toPackagePath(root, full) {
-  return relative(root, full).split(sep).join("/");
-}
-__name(toPackagePath, "toPackagePath");
+var version = "0.3.0";
 
 // src/report.ts
 var useColour = process.stdout.isTTY === true && !process.env.NO_COLOR;
@@ -7110,10 +8801,719 @@ function printResult(result) {
 }
 __name(printResult, "printResult");
 
-// src/check.ts
+// src/catalog/publish-action.ts
+var import_contracts3 = __toESM(require_dist());
+import { readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/catalog/artifact.ts
 var import_contracts = __toESM(require_dist());
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+function parseRepository(ref, flag) {
+  if (!import_contracts.ARTIFACT_REPOSITORY_PATTERN.test(ref)) {
+    throw new Error(`${flag} "${ref}" is not a bare registry repository (host[:port]/path, lowercase, no scheme, no tag, no digest). A catalog artifact is addressed by digest; tags are for humans.`);
+  }
+  const cut = ref.indexOf("/");
+  return {
+    ref,
+    host: ref.slice(0, cut),
+    path: ref.slice(cut + 1),
+    namespace: ref.slice(0, ref.lastIndexOf("/"))
+  };
+}
+__name(parseRepository, "parseRepository");
+var isDigest = /* @__PURE__ */ __name((value) => import_contracts.ARTIFACT_DIGEST_PATTERN.test(value), "isDigest");
+var TAG_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+function requireTag(tag, origin2) {
+  if (!TAG_PATTERN.test(tag)) {
+    throw new Error(`${origin2} gives the tag "${tag}", which a registry cannot hold: letters, digits, "_", "." and "-", starting with a letter, digit or "_", at most 128 characters. Pass --tag.`);
+  }
+}
+__name(requireTag, "requireTag");
+var LOOPBACK = /^(localhost|127\.0\.0\.1|\[::1\])(:[0-9]+)?$/;
+var origin = /* @__PURE__ */ __name((host) => `${LOOPBACK.test(host) ? "http" : "https"}://${host}`, "origin");
+var sha256 = /* @__PURE__ */ __name((bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`, "sha256");
+var EMPTY_CONFIG = Buffer.from("{}");
+var EMPTY_CONFIG_DESCRIPTOR = {
+  mediaType: "application/vnd.oci.empty.v1+json",
+  digest: sha256(EMPTY_CONFIG),
+  size: EMPTY_CONFIG.length
+};
+var MANIFEST_ACCEPT = import_contracts.MANIFEST_MEDIA_TYPES.join(", ");
+function provenance(flags, dir) {
+  const git = /* @__PURE__ */ __name((...args) => {
+    try {
+      return execFileSync("git", [
+        "-C",
+        dir,
+        ...args
+      ], {
+        encoding: "utf8",
+        stdio: [
+          "ignore",
+          "pipe",
+          "ignore"
+        ]
+      }).trim();
+    } catch {
+      return "";
+    }
+  }, "git");
+  const actions = process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY ? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}` : "";
+  const repository = flags.repository ?? (actions || git("remote", "get-url", "origin"));
+  const commit = flags.commit ?? (process.env.GITHUB_SHA || git("rev-parse", "HEAD"));
+  if (!repository || !commit) {
+    throw new Error("Provenance is required and could not be determined. Pass --repository <url> and --commit <sha> (in GitHub Actions, GITHUB_REPOSITORY and GITHUB_SHA supply them).");
+  }
+  return {
+    repository,
+    commit,
+    publishedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+__name(provenance, "provenance");
+function buildArtifact(document) {
+  const documentBytes = Buffer.from(`${JSON.stringify(document, null, 2)}
+`);
+  const manifest = {
+    schemaVersion: 2,
+    mediaType: import_contracts.OCI_IMAGE_MANIFEST,
+    artifactType: import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE,
+    config: EMPTY_CONFIG_DESCRIPTOR,
+    layers: [
+      {
+        mediaType: import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE,
+        digest: sha256(documentBytes),
+        size: documentBytes.length
+      }
+    ],
+    /*
+    * ★ SOURCE AND REVISION ARE FOR THE REGISTRY, NOT THE RESOLVER (docs/127 A.1). GHCR connects
+    * a package to its repository through `org.opencontainers.image.source`, and that link is what
+    * lets the repository's workflow token keep publishing to the package its first run created.
+    * The resolver reads none of these — the document's own provenance is the record — so an
+    * artifact published without them still resolves.
+    */
+    annotations: {
+      "org.opencontainers.image.created": document.provenance.publishedAt,
+      "org.opencontainers.image.source": document.provenance.repository,
+      "org.opencontainers.image.revision": document.provenance.commit
+    }
+  };
+  const manifestBytes = Buffer.from(JSON.stringify(manifest));
+  return {
+    documentBytes,
+    manifestBytes,
+    manifestDigest: sha256(manifestBytes)
+  };
+}
+__name(buildArtifact, "buildArtifact");
+function basicCredential() {
+  const pat = process.env.GHCR_TOKEN;
+  if (pat) return Buffer.from(`x:${pat}`).toString("base64");
+  const workflow = process.env.GITHUB_TOKEN;
+  if (workflow) return Buffer.from(`${process.env.GITHUB_ACTOR || "x"}:${workflow}`).toString("base64");
+  return void 0;
+}
+__name(basicCredential, "basicCredential");
+var tokens = /* @__PURE__ */ new Map();
+async function token(repository, challenge, access) {
+  const field = /* @__PURE__ */ __name((name) => new RegExp(`${name}="([^"]*)"`).exec(challenge ?? "")?.[1], "field");
+  const realm = field("realm");
+  if (!realm) throw new Error(`${repository.host} asked for credentials without a Bearer challenge.`);
+  const url = new URL(realm);
+  const service = field("service");
+  if (service) url.searchParams.set("service", service);
+  url.searchParams.set("scope", `repository:${repository.path}:${access}`);
+  const credential = basicCredential();
+  const answer = await fetch(url, {
+    headers: credential ? {
+      Authorization: `Basic ${credential}`
+    } : {}
+  });
+  if (!answer.ok) {
+    throw new Error(`${repository.host} refused a ${access === "pull" ? "pull" : "push"} token for ${repository.path}: HTTP ${answer.status}` + (credential || access === "pull" ? "." : " \u2014 set GHCR_TOKEN to a token with write:packages, or in a workflow GITHUB_TOKEN with packages: write."));
+  }
+  const body = await answer.json();
+  const value = body.token ?? body.access_token ?? "";
+  tokens.set(`${repository.path} ${access}`, value);
+  return value;
+}
+__name(token, "token");
+async function call(repository, method, path, { headers = {}, body, access = "pull,push" } = {}) {
+  const url = path.startsWith("http") ? path : `${origin(repository.host)}/v2/${repository.path}/${path}`;
+  const send = /* @__PURE__ */ __name((bearer) => fetch(url, {
+    method,
+    body,
+    redirect: "follow",
+    headers: {
+      ...headers,
+      ...bearer ? {
+        Authorization: `Bearer ${bearer}`
+      } : {}
+    }
+  }), "send");
+  let answer = await send(tokens.get(`${repository.path} ${access}`));
+  if (answer.status === 401) answer = await send(await token(repository, answer.headers.get("www-authenticate"), access));
+  return answer;
+}
+__name(call, "call");
+async function pushBlob(repository, bytes) {
+  const digest = sha256(bytes);
+  if ((await call(repository, "HEAD", `blobs/${digest}`)).ok) return digest;
+  const started = await call(repository, "POST", "blobs/uploads/");
+  if (started.status !== 202) throw new Error(`${repository.host} refused an upload: HTTP ${started.status}`);
+  const location = new URL(started.headers.get("location") ?? "", `${origin(repository.host)}/`);
+  location.searchParams.set("digest", digest);
+  const put = await call(repository, "PUT", location.toString(), {
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Length": String(bytes.length)
+    },
+    body: bytes
+  });
+  if (put.status !== 201) throw new Error(`${repository.host} rejected blob ${digest}: HTTP ${put.status} ${await put.text()}`);
+  return digest;
+}
+__name(pushBlob, "pushBlob");
+async function manifestExists(repository, digest) {
+  const answer = await call(repository, "HEAD", `manifests/${digest}`, {
+    headers: {
+      Accept: import_contracts.OCI_IMAGE_MANIFEST
+    }
+  });
+  return answer.ok;
+}
+__name(manifestExists, "manifestExists");
+async function readVerified(repository, kind, digest, size = null) {
+  if (!isDigest(digest)) throw new Error(`"${digest}" is not a digest, so ${repository.ref} cannot be asked for it.`);
+  const answer = await call(repository, "GET", `${kind}/${digest}`, {
+    access: "pull",
+    headers: kind === "manifests" ? {
+      Accept: MANIFEST_ACCEPT
+    } : {}
+  });
+  if (!answer.ok) {
+    throw new Error(`${repository.ref}@${digest} could not be read: HTTP ${answer.status}${answer.status === 404 ? " \u2014 it is not in the registry" : ""}.`);
+  }
+  const bytes = Buffer.from(await answer.arrayBuffer());
+  const served = sha256(bytes);
+  if (served !== digest || size !== null && bytes.length !== size) {
+    throw new Error(`${repository.host} served ${bytes.length} bytes hashing to ${served} for ${repository.ref}@${digest}${size === null ? "" : ` (${size} bytes named)`}. Refused: a digest this command did not compute is not a pin.`);
+  }
+  return bytes;
+}
+__name(readVerified, "readVerified");
+var readManifest = /* @__PURE__ */ __name((repository, digest) => readVerified(repository, "manifests", digest), "readManifest");
+var readBlob = /* @__PURE__ */ __name((repository, digest, size) => readVerified(repository, "blobs", digest, size), "readBlob");
+function parseJsonBytes(bytes, what) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", {
+      fatal: true
+    }).decode(bytes));
+  } catch (cause) {
+    throw new Error(`${what} is not UTF-8 JSON. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+}
+__name(parseJsonBytes, "parseJsonBytes");
+async function readArtifactDocument(repository, digest) {
+  const what = `${repository.ref}@${digest}`;
+  const manifest = parseJsonBytes(await readManifest(repository, digest), `the manifest of ${what}`);
+  const layers = Array.isArray(manifest?.layers) ? manifest.layers : [];
+  const layer = layers[0];
+  if (manifest?.mediaType !== import_contracts.OCI_IMAGE_MANIFEST || layers.length !== 1 || layer?.mediaType !== import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE || typeof layer.digest !== "string" || typeof layer.size !== "number") {
+    throw new Error(`${what} is not a catalog artifact: expected one OCI manifest with exactly one ${import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE} layer.`);
+  }
+  return parseJsonBytes(await readBlob(repository, layer.digest, layer.size), `the document of ${what}`);
+}
+__name(readArtifactDocument, "readArtifactDocument");
+async function pushArtifact(repository, artifact, tag) {
+  await pushBlob(repository, EMPTY_CONFIG);
+  await pushBlob(repository, artifact.documentBytes);
+  for (const reference of [
+    artifact.manifestDigest,
+    tag
+  ]) {
+    const put = await call(repository, "PUT", `manifests/${reference}`, {
+      headers: {
+        "Content-Type": import_contracts.OCI_IMAGE_MANIFEST
+      },
+      body: artifact.manifestBytes
+    });
+    if (put.status !== 201) {
+      throw new Error(`${repository.host} rejected the manifest (${reference}): HTTP ${put.status} ${await put.text()}`);
+    }
+  }
+  const asked = await call(repository, "HEAD", `manifests/${tag}`, {
+    headers: {
+      Accept: import_contracts.OCI_IMAGE_MANIFEST
+    }
+  });
+  const reported = asked.headers.get("docker-content-digest");
+  if (!asked.ok || !reported) {
+    throw new Error(`${repository.host} could not say what :${tag} resolves to (HTTP ${asked.status}).`);
+  }
+  if (reported !== artifact.manifestDigest) {
+    throw new Error(`${repository.host} reports :${tag} as ${reported}, but the bytes sent hash to ${artifact.manifestDigest}. Something re-encoded the manifest; nothing printed here would name what is stored. Refusing to report a digest.`);
+  }
+  return reported;
+}
+__name(pushArtifact, "pushArtifact");
+var defaultTag = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").toLowerCase(), "defaultTag");
+
+// src/catalog/flags.ts
+function parseCatalogFlags(argv, known, repeated = []) {
+  const single2 = {};
+  const many = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    const separator = argument.indexOf("=");
+    const name = separator === -1 ? argument.slice(2) : argument.slice(2, separator);
+    if (!argument.startsWith("--") || !known.includes(name)) throw new Error(`Unknown argument: ${argument}`);
+    let value;
+    if (separator !== -1) {
+      value = argument.slice(separator + 1);
+    } else {
+      value = argv[index + 1];
+      index += 1;
+    }
+    if (value === void 0 || value === "" || value.startsWith("--")) throw new Error(`--${name} needs a value.`);
+    if (repeated.includes(name)) (many[name] ??= []).push(value);
+    else single2[name] = value;
+  }
+  return {
+    single: single2,
+    many
+  };
+}
+__name(parseCatalogFlags, "parseCatalogFlags");
+
+// src/catalog/image.ts
+var import_contracts2 = __toESM(require_dist());
+function parseImageReference(value, origin2) {
+  const at = value.lastIndexOf("@");
+  const digest = at === -1 ? "" : value.slice(at + 1);
+  if (at === -1 || !isDigest(digest)) {
+    throw new Error(`${origin2} "${value}" is not <repository>@<digest>. An engine action's image is named by its digest \u2014 sha256: and 64 lowercase hex \u2014 never by a tag, which a registry can repoint.`);
+  }
+  const repository = parseRepository(value.slice(0, at), origin2);
+  return {
+    repository,
+    digest,
+    ref: `${repository.ref}@${digest}`
+  };
+}
+__name(parseImageReference, "parseImageReference");
+async function imageRefusal(image, key, provenance2) {
+  const manifestBytes = await readManifest(image.repository, image.digest);
+  if (manifestBytes.length > import_contracts2.MAX_IMAGE_MANIFEST_BYTES) {
+    return `the image manifest of ${image.ref} is ${manifestBytes.length} bytes; the limit is ${import_contracts2.MAX_IMAGE_MANIFEST_BYTES}.`;
+  }
+  const manifest = parseJsonBytes(manifestBytes, `the image manifest of ${image.ref}`);
+  const descriptor = (0, import_contracts2.imageConfigDescriptor)(manifest);
+  const config = descriptor === null ? null : parseJsonBytes(await readBlob(image.repository, descriptor.digest, descriptor.size), `the image config of ${image.ref}`);
+  return (0, import_contracts2.actionImageRefusal)({
+    key,
+    image: image.ref,
+    manifest,
+    config,
+    provenance: provenance2
+  });
+}
+__name(imageRefusal, "imageRefusal");
+
+// src/catalog/publish-action.ts
+var PUBLISH_ACTION_USAGE = "runveric catalog publish-action --manifest <file.yaml> --to <registry>/<namespace>/<repository>\n                                [--image <repository>@<digest>] [--tag <tag>]\n                                [--repository <source url>] [--commit <sha>]";
+var isMapping = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+async function runPublishAction(argv) {
+  const { single: flags } = parseCatalogFlags(argv, [
+    "manifest",
+    "to",
+    "image",
+    "tag",
+    "repository",
+    "commit"
+  ]);
+  if (!flags.manifest || !flags.to) throw new Error("--manifest and --to are required.");
+  const repository = parseRepository(flags.to, "--to");
+  const image = flags.image === void 0 ? null : parseImageReference(flags.image, "--image");
+  if (image !== null && image.repository.ref !== repository.ref) {
+    throw new Error(`--image ${image.ref} is outside the artifact's repository ${repository.ref}. An engine action's image lives in its own package, so its artifact names it by digest alone (docs/128 \xA717.2 D2) \u2014 push the image to ${repository.ref}.`);
+  }
+  const path = resolve(flags.manifest);
+  const manifest = readFileSync(path, "utf8");
+  let parsed;
+  try {
+    parsed = parseYaml(manifest);
+  } catch (cause) {
+    throw new Error(`${flags.manifest} is not valid YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const fields = isMapping(parsed) ? parsed : {};
+  const key = typeof fields.key === "string" && fields.key.length > 0 ? fields.key : null;
+  if (key === null) throw new Error(`${flags.manifest} declares no top-level \`key:\` \u2014 is it a catalog manifest?`);
+  const misnamed = (0, import_contracts3.actionPackageRefusal)(key, repository.ref);
+  if (misnamed !== null) throw new Error(`--to: ${misnamed}`);
+  const executes = isMapping(fields.execution);
+  if (executes && image === null) {
+    throw new Error(`${flags.manifest} declares execution, so it is an engine action: publish it with --image <repository>@<digest>, the image its workflow built. Without one the server refuses it at plan.`);
+  }
+  if (!executes && image !== null) {
+    throw new Error(`${flags.manifest} declares no execution, so nothing would ever run --image ${image.ref}. A built-in action is published without one.`);
+  }
+  let tag;
+  if (fields.declares === "definition+version") {
+    const version2 = typeof fields.version === "string" ? fields.version : null;
+    if (version2 === null) throw new Error(`${flags.manifest} declares "definition+version" and no version:.`);
+    if (flags.tag !== void 0 && flags.tag !== version2) {
+      throw new Error(`${flags.manifest} declares version ${version2}, and the tag is ${flags.tag}. Tag the commit ${version2}, or change version: in ${flags.manifest} first.`);
+    }
+    tag = version2;
+  } else {
+    tag = flags.tag ?? defaultTag();
+  }
+  requireTag(tag, flags.tag !== void 0 ? "--tag" : `${flags.manifest}'s version`);
+  const recorded = provenance(flags, dirname(path));
+  if (image !== null) {
+    const refusal = await imageRefusal(image, key, recorded);
+    if (refusal !== null) throw new Error(`--image: ${refusal}`);
+  }
+  const artifact = buildArtifact(image === null ? {
+    schemaVersion: import_contracts3.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+    manifest,
+    provenance: recorded
+  } : {
+    schemaVersion: import_contracts3.CATALOG_ACTION_ARTIFACT_SCHEMA_V2,
+    manifest,
+    provenance: recorded,
+    image: {
+      digest: image.digest
+    }
+  });
+  const digest = await pushArtifact(repository, artifact, tag);
+  process.stderr.write(`\u2713 ${key} published to ${repository.ref}:${tag}${image === null ? "" : `, naming the image ${image.digest}`}
+`);
+  process.stderr.write(`  the registry reports ${digest} \u2014 the digest a release must name.
+`);
+  process.stdout.write(`${key}=${repository.ref}@${digest}
+`);
+}
+__name(runPublishAction, "runPublishAction");
+
+// src/catalog/publish-release.ts
+var import_contracts4 = __toESM(require_dist());
+import { readFileSync as readFileSync2 } from "fs";
+import { parse as parseYaml2 } from "yaml";
+var PUBLISH_RELEASE_USAGE = "runveric catalog publish-release (--from <release.yaml> | --action <key>=<repository>@<digest> \u2026)\n                                 --to <registry>/<namespace>/<repository> [--version <label>]\n                                 [--tag <tag>] [--repository <source url>] [--commit <sha>]";
+function entriesFromFlags(values) {
+  return values.map((value) => {
+    const match = /^([^=]+)=([^@]+)@(.+)$/.exec(value);
+    if (!match) throw new Error(`--action "${value}" is not <key>=<repository>@<digest>.`);
+    const [, key = "", artifactRef = "", digest = ""] = match;
+    return {
+      key,
+      artifactRef,
+      digest,
+      label: `--action ${key}`
+    };
+  });
+}
+__name(entriesFromFlags, "entriesFromFlags");
+function specFromFile(path) {
+  let value;
+  try {
+    value = parseYaml2(readFileSync2(path, "utf8"));
+  } catch (cause) {
+    throw new Error(`--from ${path} could not be read as YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const spec = (0, import_contracts4.parseCatalogReleaseSpec)(value);
+  return {
+    version: spec.version,
+    entries: spec.actions.map((action) => ({
+      ...action,
+      label: `${path}'s ${action.key}`
+    }))
+  };
+}
+__name(specFromFile, "specFromFile");
+async function runPublishRelease(argv) {
+  const { single: flags, many } = parseCatalogFlags(argv, [
+    "to",
+    "version",
+    "action",
+    "from",
+    "tag",
+    "repository",
+    "commit"
+  ], [
+    "action"
+  ]);
+  const actionFlags = many.action ?? [];
+  if (flags.from !== void 0 && actionFlags.length > 0) {
+    throw new Error("--from and --action are alternatives: name the release's actions in release.yaml or as flags, not both.");
+  }
+  if (flags.from !== void 0 && flags.version !== void 0) {
+    throw new Error("--version is read from release.yaml when --from is given; pass one or the other.");
+  }
+  if (!flags.to || flags.from === void 0 && (!flags.version || actionFlags.length === 0)) {
+    throw new Error("--to and either --from, or --version and at least one --action, are required.");
+  }
+  const release = parseRepository(flags.to, "--to");
+  const { version: version2, entries } = flags.from !== void 0 ? specFromFile(flags.from) : {
+    version: flags.version,
+    entries: entriesFromFlags(actionFlags)
+  };
+  const tag = flags.tag ?? (flags.from !== void 0 ? version2 : defaultTag());
+  requireTag(tag, flags.tag !== void 0 ? "--tag" : `${flags.from}'s version`);
+  const seen = /* @__PURE__ */ new Set();
+  const actions = entries.map((entry) => {
+    if (seen.has(entry.key)) throw new Error(`${entry.label} names "${entry.key}" twice.`);
+    seen.add(entry.key);
+    const repository = parseRepository(entry.artifactRef, entry.label);
+    if (repository.namespace !== release.namespace) {
+      throw new Error(`${entry.label} lives in "${repository.namespace}", outside the release's namespace "${release.namespace}". The server refuses a release that sends it to another host or org.`);
+    }
+    if (!isDigest(entry.digest)) {
+      throw new Error(`${entry.label}: "${entry.digest}" is not a digest. A release names artifacts by digest only.`);
+    }
+    const misnamed = (0, import_contracts4.actionPackageRefusal)(entry.key, entry.artifactRef);
+    if (misnamed !== null) throw new Error(`${entry.label}: ${misnamed}`);
+    return {
+      ...entry,
+      repository
+    };
+  });
+  for (const action of actions) {
+    if (!await manifestExists(action.repository, action.digest)) {
+      throw new Error(`${action.artifactRef}@${action.digest} (${action.key}) is not in the registry.`);
+    }
+  }
+  const artifact = buildArtifact({
+    schemaVersion: import_contracts4.CATALOG_RELEASE_SCHEMA_V1,
+    version: version2,
+    provenance: provenance(flags, process.cwd()),
+    actions: actions.map(({ key, artifactRef, digest: digest2 }) => ({
+      key,
+      artifactRef,
+      digest: digest2
+    }))
+  });
+  const digest = await pushArtifact(release, artifact, tag);
+  process.stderr.write(`\u2713 catalog release ${version2} (${actions.length} action artifact(s)) published to ${release.ref}:${tag}
+`);
+  process.stderr.write(`  the registry reports ${digest} \u2014 the digest to plan and pin.
+`);
+  process.stdout.write(`${release.ref}@${digest}
+`);
+}
+__name(runPublishRelease, "runPublishRelease");
+
+// src/catalog/verify-image.ts
+var import_contracts5 = __toESM(require_dist());
+import { readFileSync as readFileSync3 } from "fs";
+import { parse as parseYaml3 } from "yaml";
+var VERIFY_IMAGE_USAGE = "runveric catalog verify-image (<repository>@<digest> --key <action key> --commit <sha> | --from <release.yaml>)";
+var COMMIT = /^[0-9a-f]{40}$/;
+var isMapping2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+function single(value, flags) {
+  if (!flags.key || !flags.commit) throw new Error(`verify-image ${value} needs --key <action key> and --commit <sha>.`);
+  if (!COMMIT.test(flags.commit)) throw new Error(`--commit "${flags.commit}" is not a 40-hex commit.`);
+  const image = parseImageReference(value, "verify-image");
+  const misnamed = (0, import_contracts5.actionPackageRefusal)(flags.key, image.repository.ref);
+  if (misnamed !== null) throw new Error(misnamed);
+  return {
+    key: flags.key,
+    image,
+    provenance: {
+      repository: (0, import_contracts5.actionSourceRepository)(flags.key),
+      commit: flags.commit
+    },
+    label: `--key ${flags.key}`
+  };
+}
+__name(single, "single");
+async function fromRelease(path) {
+  let value;
+  try {
+    value = parseYaml3(readFileSync3(path, "utf8"));
+  } catch (cause) {
+    throw new Error(`--from ${path} could not be read as YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const candidates = [];
+  for (const action of (0, import_contracts5.parseCatalogReleaseSpec)(value).actions) {
+    const label = `${path}'s ${action.key}`;
+    const misnamed = (0, import_contracts5.actionPackageRefusal)(action.key, action.artifactRef);
+    if (misnamed !== null) throw new Error(`${label}: ${misnamed}`);
+    if (!isDigest(action.digest)) throw new Error(`${label}: "${action.digest}" is not a digest.`);
+    const repository = parseRepository(action.artifactRef, label);
+    const read = await readArtifactDocument(repository, action.digest);
+    const document = isMapping2(read) ? read : {};
+    const schemaVersion = document.schemaVersion;
+    if (schemaVersion === import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V1) continue;
+    if (schemaVersion !== import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2) {
+      throw new Error(`${label}: ${repository.ref}@${action.digest} declares schemaVersion ${JSON.stringify(schemaVersion)}; this CLI reads ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V1} and ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2}.`);
+    }
+    const image = isMapping2(document.image) ? document.image.digest : void 0;
+    const recorded = isMapping2(document.provenance) ? document.provenance : {};
+    if (typeof image !== "string" || typeof recorded.repository !== "string" || typeof recorded.commit !== "string") {
+      throw new Error(`${label}: its ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2} artifact carries no image digest or no provenance.`);
+    }
+    candidates.push({
+      key: action.key,
+      // ★ The image lives in the artifact's own package (D2) — the artifact names a digest, never a place.
+      image: parseImageReference(`${repository.ref}@${image}`, label),
+      provenance: {
+        repository: recorded.repository,
+        commit: recorded.commit
+      },
+      label
+    });
+  }
+  return candidates;
+}
+__name(fromRelease, "fromRelease");
+async function runVerifyImage(argv) {
+  const image = argv[0] !== void 0 && !argv[0].startsWith("--") ? argv[0] : void 0;
+  const { single: flags } = parseCatalogFlags(image === void 0 ? argv : argv.slice(1), [
+    "key",
+    "commit",
+    "from"
+  ]);
+  if (image !== void 0 && flags.from !== void 0) {
+    throw new Error("An image and --from are alternatives: verify one image, or every engine action release.yaml names.");
+  }
+  if (image === void 0 && flags.from === void 0) {
+    throw new Error(`Name an image or a release. Usage: ${VERIFY_IMAGE_USAGE}`);
+  }
+  if (flags.from !== void 0 && (flags.key !== void 0 || flags.commit !== void 0)) {
+    throw new Error("--key and --commit are read from each artifact when --from is given; pass one or the other.");
+  }
+  const candidates = image !== void 0 ? [
+    single(image, flags)
+  ] : await fromRelease(flags.from);
+  for (const candidate of candidates) {
+    const refusal = await imageRefusal(candidate.image, candidate.key, candidate.provenance);
+    if (refusal !== null) throw new Error(`${candidate.label}: ${refusal} Nothing was signed.`);
+  }
+  for (const candidate of candidates) {
+    process.stderr.write(`\u2713 ${candidate.key}: ${candidate.image.ref} \u2014 built in ${candidate.provenance.repository} at ${candidate.provenance.commit}
+`);
+    process.stdout.write(`${candidate.image.ref}
+`);
+  }
+  if (candidates.length === 0) process.stderr.write(`\u2713 ${flags.from} names no engine action \u2014 no image to sign.
+`);
+}
+__name(runVerifyImage, "runVerifyImage");
+
+// src/catalog/index.ts
+var CATALOG_USAGE = `runveric catalog \u2014 publish first-party catalog artifacts (docs/127)
+
+  ${PUBLISH_ACTION_USAGE}
+      Publish one action's manifest, verbatim, as an artifact \u2014 with --image, an engine action's
+      artifact naming its image by digest. stdout: <key>=<repository>@<digest>
+
+  ${PUBLISH_RELEASE_USAGE}
+      Publish a release naming each action artifact by digest. stdout: <repository>@<digest>
+
+  ${VERIFY_IMAGE_USAGE}
+      Judge an engine action's image by the server's rule before it is signed.
+      stdout: one <repository>@<digest> per image that passed
+
+  Credentials: GHCR_TOKEN (write:packages), or in a workflow GITHUB_TOKEN with packages: write.
+  Provenance: --repository/--commit, else GITHUB_SERVER_URL/GITHUB_REPOSITORY and GITHUB_SHA, else git.`;
+var SUBCOMMANDS = {
+  "publish-action": runPublishAction,
+  "publish-release": runPublishRelease,
+  "verify-image": runVerifyImage
+};
+async function runCatalog(argv) {
+  const [subcommand, ...rest] = argv;
+  if (subcommand === void 0 || subcommand === "--help" || rest.includes("--help")) {
+    process.stdout.write(`${CATALOG_USAGE}
+`);
+    return subcommand === void 0 ? 1 : 0;
+  }
+  const run3 = SUBCOMMANDS[subcommand];
+  if (run3 === void 0) {
+    printError(`\u2717 "catalog ${subcommand}" is not a command. There are ${Object.keys(SUBCOMMANDS).length}: ${Object.keys(SUBCOMMANDS).join(", ")}.`);
+    return 1;
+  }
+  try {
+    await run3(rest);
+    return 0;
+  } catch (error) {
+    printError(`\u2717 ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+__name(runCatalog, "runCatalog");
+
+// src/check.ts
+var import_action_manifest = __toESM(require_dist2());
+import { resolve as resolve2 } from "path";
+
+// src/package-dir.ts
+import { readdir, readFile, stat } from "fs/promises";
+import { join, relative, sep } from "path";
+var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".runveric",
+  "node_modules",
+  ".venv",
+  "__pycache__",
+  ".DS_Store"
+]);
+var MAX_FILES = 2e3;
+var MAX_TOTAL_BYTES = 16 * 1024 * 1024;
+var PackageDirectoryError = class extends Error {
+  static {
+    __name(this, "PackageDirectoryError");
+  }
+};
+async function readPackageDirectory(root) {
+  const properties = await stat(root).catch(() => null);
+  if (!properties?.isDirectory()) {
+    throw new PackageDirectoryError(`${root} is not a directory.`);
+  }
+  const files = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  const walk = /* @__PURE__ */ __name(async (directory) => {
+    for (const entry of await readdir(directory, {
+      withFileTypes: true
+    })) {
+      if (IGNORED_DIRECTORIES.has(entry.name)) continue;
+      const full = join(directory, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (files.size >= MAX_FILES) {
+        throw new PackageDirectoryError(`This directory holds more than ${MAX_FILES} files. That is almost certainly not a single action package \u2014 run this from the package directory itself.`);
+      }
+      const contents = await readFile(full);
+      totalBytes += contents.byteLength;
+      if (totalBytes > MAX_TOTAL_BYTES) {
+        throw new PackageDirectoryError(`This directory holds more than ${MAX_TOTAL_BYTES / (1024 * 1024)}MB. An action package is source, not artifacts \u2014 add build output to .gitignore.`);
+      }
+      files.set(toPackagePath(root, full), contents);
+    }
+  }, "walk");
+  await walk(root);
+  return files;
+}
+__name(readPackageDirectory, "readPackageDirectory");
+function toPackagePath(root, full) {
+  return relative(root, full).split(sep).join("/");
+}
+__name(toPackagePath, "toPackagePath");
+
+// src/check.ts
+var import_contracts6 = __toESM(require_dist());
 async function runCheck(options) {
-  const directory = resolve(options.directory ?? ".");
+  const directory = resolve2(options.directory ?? ".");
   let files;
   try {
     files = await readPackageDirectory(directory);
@@ -7135,7 +9535,7 @@ async function runCheck(options) {
     print(style.red("This package would be REFUSED at import."));
   } else if (report.lintBlocked) {
     print();
-    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
+    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts6.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
   }
   if (report.advisoryCount > 0) {
     print();
@@ -7155,11 +9555,11 @@ async function runCheck(options) {
 __name(runCheck, "runCheck");
 
 // src/init.ts
-var import_contracts2 = __toESM(require_dist());
+var import_contracts7 = __toESM(require_dist());
 var import_action_manifest2 = __toESM(require_dist2());
 import { mkdir, writeFile } from "fs/promises";
 import { createInterface } from "readline/promises";
-import { dirname, join as join2, resolve as resolve2 } from "path";
+import { dirname as dirname2, join as join2, resolve as resolve3 } from "path";
 async function runInit(options) {
   const interactive = process.stdin.isTTY === true && options.yes !== true;
   const ask = interactive ? prompter() : null;
@@ -7171,7 +9571,7 @@ async function runInit(options) {
     const interpreter = await resolveInterpreter(options.interpreter, ask);
     if (!interpreter) return 1;
     const author = options.author?.trim() || await ask?.("Author", id.split("/")[0]) || id.split("/")[0];
-    const directory = resolve2(options.directory ?? id.split("/")[1] ?? "action");
+    const directory = resolve3(options.directory ?? id.split("/")[1] ?? "action");
     const files = (0, import_action_manifest2.scaffoldActionPackage)({
       id,
       name,
@@ -7181,7 +9581,7 @@ async function runInit(options) {
     });
     for (const [path, contents] of files) {
       const target = join2(directory, path);
-      await mkdir(dirname(target), {
+      await mkdir(dirname2(target), {
         recursive: true
       });
       await writeFile(target, contents, {
@@ -7224,9 +9624,9 @@ async function resolveId(supplied, ask) {
 }
 __name(resolveId, "resolveId");
 async function resolveInterpreter(supplied, ask) {
-  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts2.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
+  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts7.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
   if (!isInterpreter(value)) {
-    printError(style.red(`"${value}" is not an interpreter ${import_contracts2.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts2.PACKAGE_INTERPRETERS.join(", ")}.`);
+    printError(style.red(`"${value}" is not an interpreter ${import_contracts7.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts7.PACKAGE_INTERPRETERS.join(", ")}.`);
     return null;
   }
   return value;
@@ -7247,7 +9647,7 @@ function prompter() {
 }
 __name(prompter, "prompter");
 function isInterpreter(value) {
-  return import_contracts2.PACKAGE_INTERPRETERS.includes(value);
+  return import_contracts7.PACKAGE_INTERPRETERS.includes(value);
 }
 __name(isInterpreter, "isInterpreter");
 function titleCase(value) {
@@ -7257,8 +9657,8 @@ __name(titleCase, "titleCase");
 
 // src/publish.ts
 var import_action_manifest3 = __toESM(require_dist2());
-var import_contracts3 = __toESM(require_dist());
-import { resolve as resolve3 } from "path";
+var import_contracts8 = __toESM(require_dist());
+import { resolve as resolve4 } from "path";
 
 // src/renamed-variable.ts
 function renamedVariableRefusal(current, retired, env = process.env) {
@@ -7269,15 +9669,15 @@ function renamedVariableRefusal(current, retired, env = process.env) {
 __name(renamedVariableRefusal, "renamedVariableRefusal");
 
 // src/publish.ts
-var TOKEN_ENV = import_contracts3.AUTHORING_CLI_ENV.token;
-var URL_ENV = import_contracts3.AUTHORING_CLI_ENV.url;
+var TOKEN_ENV = import_contracts8.AUTHORING_CLI_ENV.token;
+var URL_ENV = import_contracts8.AUTHORING_CLI_ENV.url;
 async function runPublish(options) {
-  const directory = resolve3(options.directory ?? ".");
+  const directory = resolve4(options.directory ?? ".");
   const baseUrl = (options.to ?? process.env[URL_ENV] ?? "").trim().replace(/\/+$/, "");
-  const token = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
+  const token2 = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
   const stale = [
-    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts3.RETIRED_AUTHORING_CLI_ENV.url) : null,
-    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts3.RETIRED_AUTHORING_CLI_ENV.token) : null
+    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts8.RETIRED_AUTHORING_CLI_ENV.url) : null,
+    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts8.RETIRED_AUTHORING_CLI_ENV.token) : null
   ].filter((sentence) => sentence !== null);
   if (stale.length > 0) {
     for (const sentence of stale) printError(style.red(sentence));
@@ -7287,8 +9687,8 @@ async function runPublish(options) {
     printError(style.red("Where to?") + ` Pass --to https://your-runveric.example.com, or set ${URL_ENV}.`);
     return 1;
   }
-  if (!token) {
-    printError(style.red(`Publishing needs ${import_contracts3.BRAND_ARTICLE} ${import_contracts3.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
+  if (!token2) {
+    printError(style.red(`Publishing needs ${import_contracts8.BRAND_ARTICLE} ${import_contracts8.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
     return 1;
   }
   let files;
@@ -7308,7 +9708,7 @@ async function runPublish(options) {
       errors: report.errorCount,
       warnings: report.warningCount
     });
-    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts3.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
+    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts8.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
     return 1;
   }
   if (report.advisoryCount > 0) {
@@ -7335,7 +9735,7 @@ async function runPublish(options) {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${token}`
+        authorization: `Bearer ${token2}`
       },
       body
     });
@@ -7355,7 +9755,7 @@ Publish refused (${response.status}).`));
   try {
     version2 = JSON.parse(text);
   } catch {
-    printError(style.red(`${import_contracts3.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
+    printError(style.red(`${import_contracts8.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
     return 1;
   }
   print();
@@ -7364,7 +9764,7 @@ Publish refused (${response.status}).`));
   print(`  content digest ${version2.contentDigest}`);
   print(`  tier           ${version2.tier} ${style.grey(`(${version2.provenance})`)}`);
   print();
-  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts3.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
+  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts8.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
   print();
   return 0;
 }
@@ -7376,11 +9776,11 @@ function formatProblem(text) {
   } catch {
     return `  ${text}`;
   }
-  const problem = (0, import_contracts3.parseProblemDocument)(parsed);
+  const problem = (0, import_contracts8.parseProblemDocument)(parsed);
   if (!problem) return `  ${text}`;
   const lines = [];
   if (problem.detail) lines.push(`  ${problem.detail}`);
-  for (const error of (0, import_contracts3.problemFieldErrors)(problem)) {
+  for (const error of (0, import_contracts8.problemFieldErrors)(problem)) {
     lines.push(error.field ? `  ${style.bold(error.field)}: ${error.message}` : `  ${error.message}`);
   }
   return lines.length > 0 ? lines.join("\n") : `  ${text}`;
@@ -7388,12 +9788,12 @@ function formatProblem(text) {
 __name(formatProblem, "formatProblem");
 
 // src/runner-image.ts
-var import_contracts4 = __toESM(require_dist());
+var import_contracts9 = __toESM(require_dist());
 import { execFile } from "child_process";
 import { promisify } from "util";
 var run = promisify(execFile);
 var LOCAL_RUNNER_IMAGE = "runveric-package-runner:local";
-var RUNNER_IMAGE_ENV = import_contracts4.AUTHORING_CLI_ENV.runnerImage;
+var RUNNER_IMAGE_ENV = import_contracts9.AUTHORING_CLI_ENV.runnerImage;
 var RenamedVariableError = class extends Error {
   static {
     __name(this, "RenamedVariableError");
@@ -7410,7 +9810,7 @@ function resolveRunnerImage(flag) {
     reference: configured,
     origin: "environment"
   };
-  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts4.RETIRED_AUTHORING_CLI_ENV.runnerImage);
+  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts9.RETIRED_AUTHORING_CLI_ENV.runnerImage);
   if (stale) throw new RenamedVariableError(stale);
   return {
     reference: LOCAL_RUNNER_IMAGE,
@@ -7425,7 +9825,7 @@ function runnerImageNote(image) {
     case "environment":
       return `from ${RUNNER_IMAGE_ENV}`;
     case "local-build":
-      return `locally built \u2014 NOT the image your ${import_contracts4.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
+      return `locally built \u2014 NOT the image your ${import_contracts9.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
   }
 }
 __name(runnerImageNote, "runnerImageNote");
@@ -7442,7 +9842,7 @@ async function assertDockerAvailable() {
       "{{.Server.Version}}"
     ]);
   } catch {
-    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts4.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
+    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts9.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
   }
 }
 __name(assertDockerAvailable, "assertDockerAvailable");
@@ -7465,7 +9865,7 @@ var import_action_manifest4 = __toESM(require_dist2());
 import { spawn } from "child_process";
 import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join3, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve5 } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/azure-credential.ts
@@ -7488,7 +9888,7 @@ async function acquireAzureCredential() {
   if (!account.id || !account.tenantId) {
     throw new AzureCredentialError("`az account show` returned no subscription. Run `az login` and `az account set --subscription <id>` first.");
   }
-  const token = await azJson([
+  const token2 = await azJson([
     "account",
     "get-access-token",
     "--resource",
@@ -7496,11 +9896,11 @@ async function acquireAzureCredential() {
     "--output",
     "json"
   ]);
-  if (!token.accessToken) {
+  if (!token2.accessToken) {
     throw new AzureCredentialError("`az account get-access-token` returned no access token.");
   }
   return {
-    token: token.accessToken,
+    token: token2.accessToken,
     // The identical names the credential adapter puts in a lease, so a package reads the same
     // environment here and in production.
     env: {
@@ -7535,7 +9935,7 @@ ${message.trim()}`);
 __name(azJson, "azJson");
 
 // src/test.ts
-var import_contracts5 = __toESM(require_dist());
+var import_contracts10 = __toESM(require_dist());
 var PHASES = [
   "validate",
   "run",
@@ -7549,10 +9949,10 @@ var CONTAINER = {
   creds: "/runveric/creds"
 };
 async function runTest(options) {
-  const directory = resolve4(options.directory ?? ".");
+  const directory = resolve5(options.directory ?? ".");
   const phase = options.phase ?? "run";
   if (!PHASES.includes(phase)) {
-    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts5.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
+    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts10.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
     return 1;
   }
   let files;
@@ -7624,9 +10024,9 @@ async function runTest(options) {
     print(`  runner image   ${image.reference} ${style.grey(`(${runnerImageNote(image)})`)}`);
     print(`  interpreter    ${interpreter}@${manifest.runtime.version}`);
     print(`  entrypoint     ${entrypoint}${import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[interpreter].entryFile}`);
-    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts5.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
+    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts10.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
     if (manifest.requiresNetwork) {
-      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts5.BRAND_SHORT_NAME} enforces it`)}`);
+      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts10.BRAND_SHORT_NAME} enforces it`)}`);
     } else {
       print(`  network        ${style.grey("none \u2014 this package declares requiresNetwork: false")}`);
     }
@@ -7728,13 +10128,13 @@ async function materialize(workspace, input) {
   })));
   for (const [path, contents] of input.files) {
     const target = join3(layout.packageRoot, path);
-    await mkdir2(dirname2(target), {
+    await mkdir2(dirname3(target), {
       recursive: true
     });
     await writeFile2(target, contents);
   }
   const context = {
-    protocolVersion: import_contracts5.PACKAGE_EXECUTION_PROTOCOL_VERSION,
+    protocolVersion: import_contracts10.PACKAGE_EXECUTION_PROTOCOL_VERSION,
     // A recognisable id rather than a random uuid: it appears in the package's own log lines,
     // and "local-test" tells the reader instantly that this was not a real run.
     executionId: "local-test",
@@ -7760,7 +10160,7 @@ async function runContainer(options) {
   const launch = import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[options.interpreter];
   const script = `${CONTAINER.packageRoot}/${options.entrypoint}${launch.entryFile}`;
   const environment = {
-    RUNVERIC_PROTOCOL_VERSION: import_contracts5.PACKAGE_RESULT_PROTOCOL_VERSION,
+    RUNVERIC_PROTOCOL_VERSION: import_contracts10.PACKAGE_RESULT_PROTOCOL_VERSION,
     RUNVERIC_PHASE: options.phase,
     RUNVERIC_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
     RUNVERIC_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
@@ -7887,13 +10287,13 @@ function emitLine(line, stderr, onEvent) {
 __name(emitLine, "emitLine");
 async function reportOutcome(options) {
   if (options.exit.timedOut) {
-    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts5.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
+    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts10.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
     return 1;
   }
   const exists = await stat2(options.resultPath).catch(() => null);
   if (!exists?.isFile() || exists.size === 0) {
     printError(style.red("\nThe package wrote no result.") + `
-  result.json is the only channel ${import_contracts5.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
+  result.json is the only channel ${import_contracts10.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
   Write it as the last thing your script does, on every path \u2014 including the ones that fail.`);
     return 1;
   }
@@ -7901,7 +10301,7 @@ async function reportOutcome(options) {
   try {
     parsed = JSON.parse(await readFile2(options.resultPath, "utf8"));
   } catch {
-    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts5.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
+    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts10.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
     return 1;
   }
   let result;
@@ -7909,14 +10309,14 @@ async function reportOutcome(options) {
     result = (0, import_action_manifest4.validatePackageResult)(parsed, options.phase);
   } catch (error) {
     printError(style.red(`
-${import_contracts5.BRAND_SHORT_NAME} would REFUSE this result.`) + `
+${import_contracts10.BRAND_SHORT_NAME} would REFUSE this result.`) + `
   ${error instanceof Error ? error.message : String(error)}
   This is the same check the control plane runs, so fixing it here fixes it there.`);
     return 1;
   }
   printResult(result);
   if (options.exit.code !== 0) {
-    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts5.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
+    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts10.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
     print();
   }
   return result.status === "succeeded" ? 0 : 1;
@@ -7925,7 +10325,7 @@ __name(reportOutcome, "reportOutcome");
 async function readJsonFile(path) {
   let source;
   try {
-    source = await readFile2(resolve4(path), "utf8");
+    source = await readFile2(resolve5(path), "utf8");
   } catch {
     throw new Error(`Could not read ${path}.`);
   }
@@ -7943,9 +10343,9 @@ async function readJsonFile(path) {
 __name(readJsonFile, "readJsonFile");
 
 // src/main.ts
-var import_contracts6 = __toESM(require_dist());
+var import_contracts11 = __toESM(require_dist());
 var USAGE = `
-${style.bold("runveric")} \u2014 author ${import_contracts6.BRAND_ARTICLE} ${import_contracts6.BRAND_SHORT_NAME} action, without pushing anything.
+${style.bold("runveric")} \u2014 author ${import_contracts11.BRAND_ARTICLE} ${import_contracts11.BRAND_SHORT_NAME} action, without pushing anything.
 
 ${style.bold("USAGE")}
   runveric <command> [options]
@@ -7953,8 +10353,9 @@ ${style.bold("USAGE")}
 ${style.bold("COMMANDS")}
   init [directory]        Scaffold a working action. It passes check and test immediately.
   check                   Validate the package. Offline \u2014 no account, no cloud, no network.
-  test                    Run one phase in the real ${import_contracts6.BRAND_SHORT_NAME} runner image.
-  publish                 Upload it to ${import_contracts6.BRAND_SHORT_NAME} as an authored version. Needs an account.
+  test                    Run one phase in the real ${import_contracts11.BRAND_SHORT_NAME} runner image.
+  publish                 Upload it to ${import_contracts11.BRAND_SHORT_NAME} as an authored version. Needs an account.
+  catalog <command>       Publish first-party catalog artifacts. Not for authoring: see \`runveric catalog --help\`.
 
 ${style.bold("init")}
   --id <publisher/name>   The action id. Required.
@@ -7977,9 +10378,9 @@ ${style.bold("test")}
   --keep                  Keep the materialized /runveric tree for inspection.
 
 ${style.bold("publish")}
-  --to <url>              Your ${import_contracts6.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
+  --to <url>              Your ${import_contracts11.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
   --token <token>         Access token. Defaults to $${TOKEN_ENV}.
-  --force                 Publish despite lint errors. Never bypasses ${import_contracts6.BRAND_SHORT_NAME}'s validation.
+  --force                 Publish despite lint errors. Never bypasses ${import_contracts11.BRAND_SHORT_NAME}'s validation.
 
 ${style.bold("EVERYWHERE")}
   --dir <path>            The package directory. Defaults to the current directory.
@@ -8022,7 +10423,9 @@ __name(parseArgv, "parseArgv");
 var first = /* @__PURE__ */ __name((parsed, name) => parsed.flags.get(name)?.[0], "first");
 var bool = /* @__PURE__ */ __name((parsed, name) => parsed.flags.get(name)?.[0] === "true", "bool");
 async function main() {
-  const parsed = parseArgv(process.argv.slice(2));
+  const argv = process.argv.slice(2);
+  if (argv[0] === "catalog") return runCatalog(argv.slice(1));
+  const parsed = parseArgv(argv);
   if (parsed.flags.has("version")) {
     print(version);
     return 0;
@@ -8090,7 +10493,7 @@ async function main() {
         force: bool(parsed, "force")
       });
     default:
-      printError(style.red(`"${parsed.command}" is not a command.`) + " There are four: init, check, test, publish.");
+      printError(style.red(`"${parsed.command}" is not a command.`) + " There are four: init, check, test, publish \u2014 and catalog, which publishes first-party catalog artifacts.");
       return 1;
   }
 }