@runveric/cli 0.2.0 → 0.4.0

package/dist/runveric.mjs

@@ -212,16 +212,18 @@ var require_wire_identity = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PROBLEM_TYPE_BASE = exports.CATALOG_ARTIFACT_MEDIA_TYPE = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = exports.CATALOG_RELEASE_SCHEMA_V1 = exports.EVIDENCE_PACK_SCHEMA_VERSION = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
+    exports.PROBLEM_TYPE_BASE = exports.CATALOG_ARTIFACT_MEDIA_TYPE = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V2 = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = exports.CATALOG_RELEASE_SCHEMA_V1 = exports.EVIDENCE_PACK_SCHEMA_VERSION = exports.ACTION_PROTOCOL_V1 = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
     exports.problemType = problemType;
     exports.PACKAGE_RESULT_PROTOCOL_VERSION = "runveric.dev/package-result/v1";
     exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "runveric.dev/package-execution/v1";
     exports.ACTION_MANIFEST_API_VERSION = "runveric.dev/action/v1";
     exports.PACKAGE_WORK_ITEM_VERSION = "runveric.dev/package-work-item/v1";
     exports.RUNNER_PROTOCOL_VERSION = "runveric.dev/runner-channel/v2";
+    exports.ACTION_PROTOCOL_V1 = "runveric.dev/action-protocol/v1";
     exports.EVIDENCE_PACK_SCHEMA_VERSION = "runveric.dev/evidence-pack/v1";
     exports.CATALOG_RELEASE_SCHEMA_V1 = "runveric.dev/catalog-release/v1";
     exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V1 = "runveric.dev/catalog-action/v1";
+    exports.CATALOG_ACTION_ARTIFACT_SCHEMA_V2 = "runveric.dev/catalog-action/v2";
     exports.CATALOG_ARTIFACT_MEDIA_TYPE = "application/vnd.runveric.catalog-artifact+json";
     exports.PROBLEM_TYPE_BASE = "https://runveric.dev/errors";
     function problemType(slug) {
@@ -611,16 +613,134 @@ var require_catalog_release = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.ARTIFACT_DIGEST_PATTERN = exports.ARTIFACT_REPOSITORY_PATTERN = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = exports.CATALOG_RELEASE_SCHEMA_VERSIONS = void 0;
+    exports.CatalogReleaseStateError = exports.CATALOG_SYNC_STALE_AFTER_MINUTES = exports.CATALOG_SYNC_INTERVAL_MINUTES = exports.CATALOG_SYNC_SOURCES = exports.CATALOG_SYNC_RUN_OUTCOMES = exports.ARTIFACT_DIGEST_PATTERN = exports.ARTIFACT_REPOSITORY_PATTERN = exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = exports.CATALOG_RELEASE_SCHEMA_VERSIONS = void 0;
+    exports.parseCatalogReleaseState = parseCatalogReleaseState;
     var wire_identity_1 = require_wire_identity();
     exports.CATALOG_RELEASE_SCHEMA_VERSIONS = [
       wire_identity_1.CATALOG_RELEASE_SCHEMA_V1
     ];
     exports.CATALOG_ACTION_ARTIFACT_SCHEMA_VERSIONS = [
-      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V1
+      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+      wire_identity_1.CATALOG_ACTION_ARTIFACT_SCHEMA_V2
     ];
     exports.ARTIFACT_REPOSITORY_PATTERN = /^[a-z0-9][a-z0-9.-]*(:[0-9]+)?(\/[a-z0-9][a-z0-9._-]*)+$/;
     exports.ARTIFACT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+    exports.CATALOG_SYNC_RUN_OUTCOMES = [
+      "applied",
+      "refused",
+      "superseded"
+    ];
+    exports.CATALOG_SYNC_SOURCES = [
+      "directory",
+      "release"
+    ];
+    exports.CATALOG_SYNC_INTERVAL_MINUTES = 15;
+    exports.CATALOG_SYNC_STALE_AFTER_MINUTES = exports.CATALOG_SYNC_INTERVAL_MINUTES * 2;
+    var CatalogReleaseStateError = class CatalogReleaseStateError extends Error {
+      static {
+        __name(this, "CatalogReleaseStateError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "CatalogReleaseStateError";
+      }
+    };
+    exports.CatalogReleaseStateError = CatalogReleaseStateError;
+    function stateObject(path, value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new CatalogReleaseStateError(`${path} is not an object.`);
+      }
+      return value;
+    }
+    __name(stateObject, "stateObject");
+    function stateString(path, value, pattern, expected = "a non-empty string") {
+      if (typeof value !== "string" || value === "" || pattern !== void 0 && !pattern.test(value)) {
+        throw new CatalogReleaseStateError(`${path} is ${JSON.stringify(value)}, not ${expected}.`);
+      }
+      return value;
+    }
+    __name(stateString, "stateString");
+    function stateInstant(path, value) {
+      const text = stateString(path, value);
+      if (Number.isNaN(Date.parse(text))) {
+        throw new CatalogReleaseStateError(`${path} is "${text}", which is not a timestamp.`);
+      }
+      return text;
+    }
+    __name(stateInstant, "stateInstant");
+    var orNull = /* @__PURE__ */ __name((value, read) => value === null ? null : read(value), "orNull");
+    function stateMember(path, value, members) {
+      if (typeof value === "string" && members.includes(value)) return value;
+      throw new CatalogReleaseStateError(`${path} is ${JSON.stringify(value)}; this build reads ${members.join(", ")}.`);
+    }
+    __name(stateMember, "stateMember");
+    function parseSyncRun(value) {
+      const run3 = stateObject("lastSync", value);
+      const source = stateMember("lastSync.source", run3.source, exports.CATALOG_SYNC_SOURCES);
+      const release = orNull(run3.release, (raw) => {
+        const fields = stateObject("lastSync.release", raw);
+        return {
+          artifactRef: stateString("lastSync.release.artifactRef", fields.artifactRef, exports.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+          digest: stateString("lastSync.release.digest", fields.digest, exports.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+          version: orNull(fields.version, (label) => stateString("lastSync.release.version", label))
+        };
+      });
+      if (source === "release" !== (release !== null)) {
+        throw new CatalogReleaseStateError(`lastSync.source is "${source}" and lastSync.release is ${release === null ? "null" : "set"}; a run names a release exactly when a release declared it.`);
+      }
+      return {
+        startedAt: stateInstant("lastSync.startedAt", run3.startedAt),
+        finishedAt: stateInstant("lastSync.finishedAt", run3.finishedAt),
+        imageTag: orNull(run3.imageTag, (tag) => stateString("lastSync.imageTag", tag)),
+        source,
+        release,
+        outcome: stateMember("lastSync.outcome", run3.outcome, exports.CATALOG_SYNC_RUN_OUTCOMES),
+        detail: stateString("lastSync.detail", run3.detail)
+      };
+    }
+    __name(parseSyncRun, "parseSyncRun");
+    function parsePinned(value) {
+      const pin = stateObject("release", value);
+      return {
+        artifactRef: stateString("release.artifactRef", pin.artifactRef, exports.ARTIFACT_REPOSITORY_PATTERN, "a registry repository"),
+        digest: stateString("release.digest", pin.digest, exports.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
+        version: stateString("release.version", pin.version),
+        provenance: orNull(pin.provenance, (raw) => {
+          const fields = stateObject("release.provenance", raw);
+          return {
+            repository: stateString("release.provenance.repository", fields.repository),
+            commit: stateString("release.provenance.commit", fields.commit)
+          };
+        }),
+        pinnedBy: stateString("release.pinnedBy", pin.pinnedBy),
+        pinnedByName: orNull(pin.pinnedByName, (name) => stateString("release.pinnedByName", name)),
+        pinnedAt: stateInstant("release.pinnedAt", pin.pinnedAt)
+      };
+    }
+    __name(parsePinned, "parsePinned");
+    function parseCatalogReleaseState(value) {
+      const state = stateObject("the catalog release state", value);
+      for (const field of [
+        "release",
+        "imageTag",
+        "lastSync",
+        "liveSince"
+      ]) {
+        if (!(field in state)) throw new CatalogReleaseStateError(`${field} is missing.`);
+      }
+      const release = orNull(state.release, parsePinned);
+      const liveSince = orNull(state.liveSince, (instant) => stateInstant("liveSince", instant));
+      if (release === null && liveSince !== null) {
+        throw new CatalogReleaseStateError("liveSince is set with nothing pinned; only a pin goes live.");
+      }
+      return {
+        release,
+        imageTag: orNull(state.imageTag, (tag) => stateString("imageTag", tag)),
+        lastSync: orNull(state.lastSync, parseSyncRun),
+        liveSince
+      };
+    }
+    __name(parseCatalogReleaseState, "parseCatalogReleaseState");
   }
 });
 
@@ -631,12 +751,13 @@ var require_action_repository = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.ACTION_REPOSITORY_PREFIX = void 0;
+    exports.ACTION_SOURCE_REPOSITORY_PREFIX = exports.ACTION_REPOSITORY_PREFIX = void 0;
     exports.actionKeyRefusal = actionKeyRefusal;
     exports.isActionKey = isActionKey;
     exports.actionRepositoryName = actionRepositoryName;
+    exports.actionSourceRepository = actionSourceRepository2;
     exports.actionKeyOf = actionKeyOf;
-    exports.actionPackageRefusal = actionPackageRefusal3;
+    exports.actionPackageRefusal = actionPackageRefusal4;
     exports.ACTION_REPOSITORY_PREFIX = "action-";
     var WORD = /^[a-z][a-z0-9]*$/;
     var VERB = /^[a-z][a-z0-9]*(?:[A-Z][a-z0-9]+)*$/;
@@ -666,6 +787,11 @@ var require_action_repository = __commonJS({
       return `${exports.ACTION_REPOSITORY_PREFIX}${provider}-${resource}-${kebab(verb)}`;
     }
     __name(actionRepositoryName, "actionRepositoryName");
+    exports.ACTION_SOURCE_REPOSITORY_PREFIX = "https://github.com/runveric/";
+    function actionSourceRepository2(key) {
+      return `${exports.ACTION_SOURCE_REPOSITORY_PREFIX}${actionRepositoryName(key)}`;
+    }
+    __name(actionSourceRepository2, "actionSourceRepository");
     function actionKeyOf(name) {
       if (!name.startsWith(exports.ACTION_REPOSITORY_PREFIX)) return null;
       const [provider, resource, first2, ...rest] = name.slice(exports.ACTION_REPOSITORY_PREFIX.length).split("-");
@@ -675,7 +801,7 @@ var require_action_repository = __commonJS({
       return isActionKey(key) && actionRepositoryName(key) === name ? key : null;
     }
     __name(actionKeyOf, "actionKeyOf");
-    function actionPackageRefusal3(key, artifactRef) {
+    function actionPackageRefusal4(key, artifactRef) {
       const keyRefusal = actionKeyRefusal(key);
       if (keyRefusal !== null) return `${keyRefusal} No package can carry it.`;
       const cut = artifactRef.lastIndexOf("/");
@@ -684,7 +810,7 @@ var require_action_repository = __commonJS({
       if (named === expected) return null;
       return `action "${key}" is published only from a package named "${expected}" (${artifactRef.slice(0, cut + 1)}${expected}), not "${named}". An action's package carries its key's name, so an artifact cannot claim an identity its package does not carry.`;
     }
-    __name(actionPackageRefusal3, "actionPackageRefusal");
+    __name(actionPackageRefusal4, "actionPackageRefusal");
   }
 });
 
@@ -697,7 +823,7 @@ var require_catalog_release_spec = __commonJS({
     });
     exports.CatalogReleaseSpecError = void 0;
     exports.splitArtifactReference = splitArtifactReference;
-    exports.parseCatalogReleaseSpec = parseCatalogReleaseSpec2;
+    exports.parseCatalogReleaseSpec = parseCatalogReleaseSpec3;
     var CatalogReleaseSpecError = class CatalogReleaseSpecError extends Error {
       static {
         __name(this, "CatalogReleaseSpecError");
@@ -717,9 +843,9 @@ var require_catalog_release_spec = __commonJS({
       };
     }
     __name(splitArtifactReference, "splitArtifactReference");
-    var isMapping2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
-    function parseCatalogReleaseSpec2(value) {
-      if (!isMapping2(value)) {
+    var isMapping3 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+    function parseCatalogReleaseSpec3(value) {
+      if (!isMapping3(value)) {
         throw new CatalogReleaseSpecError("release.yaml is not a mapping of `version` and `actions`.");
       }
       const unknown = Object.keys(value).filter((key) => key !== "version" && key !== "actions");
@@ -730,10 +856,10 @@ var require_catalog_release_spec = __commonJS({
       if (typeof version2 !== "string" || version2.trim().length === 0) {
         throw new CatalogReleaseSpecError(`release.yaml's version is ${JSON.stringify(version2 ?? null)}, not a label. Write it as a quoted string \u2014 version: "2026.10.1" \u2014 because YAML reads an unquoted 2026.10 as a number.`);
       }
-      if (actions === null || actions === void 0 || isMapping2(actions) && Object.keys(actions).length === 0) {
+      if (actions === null || actions === void 0 || isMapping3(actions) && Object.keys(actions).length === 0) {
         throw new CatalogReleaseSpecError("release.yaml declares no action. An empty release is refused: pinned, it would declare a catalog with nothing in it.");
       }
-      if (!isMapping2(actions)) {
+      if (!isMapping3(actions)) {
         throw new CatalogReleaseSpecError("release.yaml's actions is not a mapping of action key to <repository>@<digest>.");
       }
       return {
@@ -750,7 +876,7 @@ var require_catalog_release_spec = __commonJS({
         })
       };
     }
-    __name(parseCatalogReleaseSpec2, "parseCatalogReleaseSpec");
+    __name(parseCatalogReleaseSpec3, "parseCatalogReleaseSpec");
   }
 });
 
@@ -761,7 +887,7 @@ var require_catalog_lock = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.CatalogLockError = exports.CATALOG_LOCK_FILE = exports.CATALOG_LOCK_SCHEMA_V1 = void 0;
+    exports.MANIFEST_SHA256_PATTERN = exports.CatalogLockError = exports.CATALOG_LOCK_ENGINE_EXECUTION = exports.CATALOG_LOCK_FILE = exports.CATALOG_LOCK_SCHEMA_V1 = void 0;
     exports.parseCatalogLock = parseCatalogLock;
     exports.catalogLockText = catalogLockText;
     exports.authoredElsewhere = authoredElsewhere;
@@ -769,6 +895,7 @@ var require_catalog_lock = __commonJS({
     var catalog_release_1 = require_catalog_release();
     exports.CATALOG_LOCK_SCHEMA_V1 = "runveric.catalog-lock/v1";
     exports.CATALOG_LOCK_FILE = "release.lock.json";
+    exports.CATALOG_LOCK_ENGINE_EXECUTION = "engine";
     var CatalogLockError = class CatalogLockError extends Error {
       static {
         __name(this, "CatalogLockError");
@@ -779,7 +906,7 @@ var require_catalog_lock = __commonJS({
       }
     };
     exports.CatalogLockError = CatalogLockError;
-    var SHA256_HEX = /^[0-9a-f]{64}$/;
+    exports.MANIFEST_SHA256_PATTERN = /^[0-9a-f]{64}$/;
     function objectAt(path, value, keys) {
       if (typeof value !== "object" || value === null || Array.isArray(value)) {
         throw new CatalogLockError(`${path} is not an object.`);
@@ -834,7 +961,9 @@ var require_catalog_lock = __commonJS({
           "artifactRef",
           "digest",
           "manifestSha256",
-          "provenance"
+          "provenance",
+          "executes",
+          "imageDigest"
         ]);
         const key = stringAt(`${path}.key`, action.key);
         const artifactRef = stringAt(`${path}.artifactRef`, action.artifactRef, catalog_release_1.ARTIFACT_REPOSITORY_PATTERN, "a registry repository");
@@ -848,14 +977,24 @@ var require_catalog_lock = __commonJS({
           "repository",
           "commit"
         ]);
+        if (action.executes === void 0 !== (action.imageDigest === void 0)) {
+          throw new CatalogLockError(`${path} carries ${action.executes === void 0 ? "imageDigest without executes" : "executes without imageDigest"}; an engine action records both, a built-in neither.`);
+        }
+        if (action.executes !== void 0 && action.executes !== exports.CATALOG_LOCK_ENGINE_EXECUTION) {
+          throw new CatalogLockError(`${path}.executes is ${JSON.stringify(action.executes)}; the one value it takes is "${exports.CATALOG_LOCK_ENGINE_EXECUTION}".`);
+        }
         lock.actions.push({
           key,
           artifactRef,
           digest: stringAt(`${path}.digest`, action.digest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest"),
-          manifestSha256: stringAt(`${path}.manifestSha256`, action.manifestSha256, SHA256_HEX, "64 lowercase hex characters"),
+          manifestSha256: stringAt(`${path}.manifestSha256`, action.manifestSha256, exports.MANIFEST_SHA256_PATTERN, "64 lowercase hex characters"),
           provenance: {
             repository: stringAt(`${path}.provenance.repository`, provenance2.repository),
             commit: stringAt(`${path}.provenance.commit`, provenance2.commit)
+          },
+          ...action.executes === void 0 ? {} : {
+            executes: exports.CATALOG_LOCK_ENGINE_EXECUTION,
+            imageDigest: stringAt(`${path}.imageDigest`, action.imageDigest, catalog_release_1.ARTIFACT_DIGEST_PATTERN, "a sha256 digest")
           }
         });
       });
@@ -880,6 +1019,10 @@ var require_catalog_lock = __commonJS({
           provenance: {
             repository: action.provenance.repository,
             commit: action.provenance.commit
+          },
+          ...action.executes === void 0 || action.imageDigest === void 0 ? {} : {
+            executes: action.executes,
+            imageDigest: action.imageDigest
           }
         }))
       };
@@ -1654,6 +1797,7 @@ var require_validation = __commonJS({
     exports.isCheckLevel = isCheckLevel;
     exports.isRefusalCode = isRefusalCode;
     exports.isDecisionCode = isDecisionCode;
+    exports.validationCheckOf = validationCheckOf;
     exports.scopeFailureDetail = scopeFailureDetail;
     exports.targetsUnavailableFrom = targetsUnavailableFrom;
     exports.compareTargets = compareTargets;
@@ -1796,12 +1940,69 @@ var require_validation = __commonJS({
       "disk.customerKey",
       "disk.customerKeyUnverified",
       "disk.guestEncrypted",
-      "disk.noSnapshot"
+      "disk.noSnapshot",
+      // A confidential VM's disk: its snapshot keeps the VM's guest state, region-bound, and restoring
+      // one is unverified (docs/126 §6.6.1) — the operator's call, never a refusal.
+      "disk.confidential"
     ];
     function isDecisionCode(value) {
       return typeof value === "string" && exports.DECISION_CODES.includes(value);
     }
     __name(isDecisionCode, "isDecisionCode");
+    function validationCheckOf(value) {
+      const raw = typeof value === "object" && value !== null ? value : {};
+      const level = raw.level;
+      if (!isCheckLevel(level)) {
+        return {
+          refusal: `A check level of "${String(level)}" is not in the vocabulary.`
+        };
+      }
+      if (typeof raw.title !== "string" || raw.title.length === 0) {
+        return {
+          refusal: "Every check must carry a title."
+        };
+      }
+      if (raw.decision !== void 0 && raw.refusal !== void 0) {
+        return {
+          refusal: `A check carrying both a decision ("${String(raw.decision)}") and a refusal ("${String(raw.refusal)}") is not a check any producer of ours can build.`
+        };
+      }
+      if (raw.decision !== void 0) {
+        if (!isDecisionCode(raw.decision) || level === "info") {
+          return {
+            refusal: `A check's decision of "${String(raw.decision)}" at level "${level}" is not one this channel accepts.`
+          };
+        }
+        return {
+          check: {
+            level,
+            title: raw.title,
+            decision: raw.decision
+          }
+        };
+      }
+      if (raw.refusal !== void 0) {
+        if (!isRefusalCode(raw.refusal) || level !== "error") {
+          return {
+            refusal: `A check's refusal of "${String(raw.refusal)}" at level "${level}" is not one this channel accepts.`
+          };
+        }
+        return {
+          check: {
+            level,
+            title: raw.title,
+            refusal: raw.refusal
+          }
+        };
+      }
+      return {
+        check: {
+          level,
+          title: raw.title
+        }
+      };
+    }
+    __name(validationCheckOf, "validationCheckOf");
     function scopeFailureDetail(error) {
       const raw = error instanceof Error ? error.message : String(error);
       const oneLine = raw.replace(/\s+/g, " ").trim().replace(/[.!]+$/, "");
@@ -1872,7 +2073,7 @@ var require_execution = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.REFUSAL_CODES = exports.isRefusalCode = exports.isDecisionCode = exports.isCheckLevel = exports.DECISION_CODES = exports.CHECK_LEVELS = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
+    exports.ACCEPTING_A_PROVENANCE_IS_NOT_A_CAPABILITY = exports.RUNNER_PACKAGE_RUNTIME_NOT_PINNED = exports.CONNECTOR_UNAVAILABLE_MESSAGE = exports.ACTION_RUNNABILITY_CAUSE_KINDS = exports.EXECUTION_LOG_ACTIVITY_PHRASE = exports.EXECUTION_LOG_CONNECTION_PHRASE = exports.EXECUTION_LOG_STREAM_PHASES = exports.EXECUTION_LOG_ACTIVITIES = exports.validationCheckOf = exports.targetsValidationCheck = exports.targetSummarySentence = exports.targetSummaryOf = exports.targetSummaryLabel = exports.targetsUnavailableFrom = exports.targetsUnavailable = exports.targetComparisonSentence = exports.targetComparisonLevel = exports.targetComparisonLabel = exports.TARGETS_NOT_COUNTED = exports.TARGETS_NO_SCOPE = exports.TARGET_COUNT_ABSENCES = exports.TARGET_COMPARISON_KINDS = exports.singleTarget = exports.scopeFailureDetail = exports.noTargetsResolved = exports.isTargetCountAbsence = exports.eligibleTargetCount = exports.compareTargets = exports.REFUSAL_CODES = exports.isRefusalCode = exports.isDecisionCode = exports.isCheckLevel = exports.DECISION_CODES = exports.CHECK_LEVELS = exports.SUBSCRIPTION_ID_FIELD_RENAMED = void 0;
     exports.executionLogStreamSentence = executionLogStreamSentence;
     exports.actionRunnabilityCopy = actionRunnabilityCopy;
     exports.actionRunnabilityHeadline = actionRunnabilityHeadline;
@@ -2033,6 +2234,12 @@ var require_execution = __commonJS({
         return validation_1.targetsValidationCheck;
       }, "get")
     });
+    Object.defineProperty(exports, "validationCheckOf", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return validation_1.validationCheckOf;
+      }, "get")
+    });
     exports.EXECUTION_LOG_ACTIVITIES = [
       "executing",
       "queued",
@@ -2216,11 +2423,15 @@ var require_decisions = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.DECISION_ACKNOWLEDGEMENT = void 0;
+    exports.DECISION_ACKNOWLEDGEMENT = exports.TARGET_DISPOSITIONS = exports.UNDECIDED_AT_RUN = void 0;
     exports.recordedDecisionsOf = recordedDecisionsOf;
+    exports.settleDecisionChecks = settleDecisionChecks;
     exports.raisedDecisionCodes = raisedDecisionCodes;
     exports.decisionMismatch = decisionMismatch;
     exports.decisionMismatchSentence = decisionMismatchSentence;
+    exports.targetDecisionsMismatchSentence = targetDecisionsMismatchSentence;
+    exports.decisionsMadeAtSubmit = decisionsMadeAtSubmit;
+    exports.isTargetDisposition = isTargetDisposition;
     var validation_1 = require_validation();
     function recordedDecisionsOf(stored) {
       if (!Array.isArray(stored)) return [];
@@ -2241,6 +2452,22 @@ var require_decisions = __commonJS({
       return read;
     }
     __name(recordedDecisionsOf, "recordedDecisionsOf");
+    exports.UNDECIDED_AT_RUN = "Nobody acknowledged this before the run, so it was not acted on.";
+    function settleDecisionChecks(checks, inHand) {
+      if (inHand.phase === "plan") return [
+        ...checks
+      ];
+      return checks.map((check) => {
+        if (!check.decision || check.level === "error") return check;
+        if (inHand.recorded.some((decision) => decision.code === check.decision)) return check;
+        return {
+          ...check,
+          level: "error",
+          title: `${check.title} ${exports.UNDECIDED_AT_RUN}`
+        };
+      });
+    }
+    __name(settleDecisionChecks, "settleDecisionChecks");
     function raisedDecisionCodes(checks) {
       const raised = [];
       for (const check of checks) {
@@ -2258,27 +2485,57 @@ var require_decisions = __commonJS({
       };
     }
     __name(decisionMismatch, "decisionMismatch");
-    function decisionMismatchSentence(mismatch) {
+    function decisionMismatchSentence(mismatch, checks = []) {
+      return `This run was not submitted: the checks were run again at submit, and they no longer match what was acknowledged. ${mismatchParts(mismatch, checks).join(" ")} Review the plan and submit again.`;
+    }
+    __name(decisionMismatchSentence, "decisionMismatchSentence");
+    function targetDecisionsMismatchSentence(mismatches) {
+      const parts = mismatches.map((target) => target.unknown ? `${target.label}: no longer one of this step's targets.` : `${target.label}: ${mismatchParts(target, target.checks).join(" ")}`);
+      const count = mismatches.length;
+      return `This run was not started: the checks were run again, and for ${count} ${count === 1 ? "target" : "targets"} they no longer match what was decided. ${parts.join(" ")} Review the plan and start the run again.`;
+    }
+    __name(targetDecisionsMismatchSentence, "targetDecisionsMismatchSentence");
+    function mismatchParts(mismatch, checks) {
       const parts = [];
-      if (mismatch.unacknowledged.length > 0) {
-        parts.push(`the plan raised ${quoteCodes(mismatch.unacknowledged)}, which ${mismatch.unacknowledged.length === 1 ? "was" : "were"} not acknowledged`);
+      for (const code of mismatch.unacknowledged) {
+        const sentence = checks.find((check) => check.decision === code)?.title ?? exports.DECISION_ACKNOWLEDGEMENT[code];
+        parts.push(`Not acknowledged: ${withStop(sentence)}`);
       }
-      if (mismatch.notRaised.length > 0) {
-        parts.push(`${quoteCodes(mismatch.notRaised)} ${mismatch.notRaised.length === 1 ? "was" : "were"} acknowledged but the plan does not raise ${mismatch.notRaised.length === 1 ? "it" : "them"}`);
+      for (const code of mismatch.notRaised) {
+        parts.push(`Acknowledged, but no longer raised: \u201C${exports.DECISION_ACKNOWLEDGEMENT[code]}\u201D.`);
       }
-      return `This run was not submitted: ${parts.join(", and ")}. The checks were run again at submit and decide what needs acknowledging \u2014 review the plan and submit again.`;
+      return parts;
     }
-    __name(decisionMismatchSentence, "decisionMismatchSentence");
-    function quoteCodes(codes) {
-      return codes.map((code) => `"${code}"`).join(", ");
+    __name(mismatchParts, "mismatchParts");
+    function decisionsMadeAtSubmit(codes, by, at) {
+      return codes.map((code) => ({
+        code,
+        acknowledgedBy: by,
+        acknowledgedAt: at.toISOString()
+      }));
+    }
+    __name(decisionsMadeAtSubmit, "decisionsMadeAtSubmit");
+    exports.TARGET_DISPOSITIONS = [
+      "ready",
+      "left_out",
+      "refused"
+    ];
+    function isTargetDisposition(value) {
+      return typeof value === "string" && exports.TARGET_DISPOSITIONS.includes(value);
+    }
+    __name(isTargetDisposition, "isTargetDisposition");
+    function withStop(sentence) {
+      const trimmed = sentence.trim();
+      return /[.!?]$/.test(trimmed) ? trimmed : `${trimmed}.`;
     }
-    __name(quoteCodes, "quoteCodes");
+    __name(withStop, "withStop");
     exports.DECISION_ACKNOWLEDGEMENT = {
       "disk.recentlyDetached": "Delete it even though it was detached recently",
       "disk.customerKey": "Delete it \u2014 restoring later depends on this key staying enabled",
       "disk.customerKeyUnverified": "Delete it without confirmation that the key is enabled",
       "disk.guestEncrypted": "Delete it \u2014 restoring later depends on the guest's encryption secrets",
-      "disk.noSnapshot": "Delete it with no snapshot \u2014 this cannot be undone"
+      "disk.noSnapshot": "Delete it with no snapshot \u2014 this cannot be undone",
+      "disk.confidential": "Delete it, accepting that restoring a confidential VM disk is not verified"
     };
   }
 });
@@ -2642,8 +2899,59 @@ var require_governance = __commonJS({
       value: true
     });
     exports.ANY_POLICY_MATCH = void 0;
+    exports.approvalAssessmentOf = approvalAssessmentOf;
+    exports.planAssessmentOf = planAssessmentOf;
     exports.approvalOutcome = approvalOutcome;
     exports.policyScopeSentence = policyScopeSentence;
+    var decisions_1 = require_decisions();
+    function approvalAssessmentOf(checks, decided) {
+      const assessment = {
+        facts: [],
+        warnings: [],
+        decisions: []
+      };
+      for (const check of checks) {
+        if (check.decision) {
+          const answer = decided.find((decision) => decision.code === check.decision);
+          if (answer) assessment.decisions.push({
+            ...answer,
+            title: check.title
+          });
+        } else if (check.level === "warn") {
+          assessment.warnings.push(check.title);
+        } else if (check.level === "info") {
+          assessment.facts.push(check.title);
+        }
+      }
+      return assessment;
+    }
+    __name(approvalAssessmentOf, "approvalAssessmentOf");
+    function planAssessmentOf(value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+      const a = value;
+      if (!Array.isArray(a.facts) || !Array.isArray(a.warnings) || !Array.isArray(a.decisions)) {
+        return null;
+      }
+      const decisions = [];
+      for (const entry of a.decisions) {
+        const [decision] = (0, decisions_1.recordedDecisionsOf)([
+          entry
+        ]);
+        const title = typeof entry === "object" && entry !== null ? entry.title : null;
+        if (!decision || typeof title !== "string") return null;
+        decisions.push({
+          ...decision,
+          title
+        });
+      }
+      const strings = /* @__PURE__ */ __name((list) => list.filter((item) => typeof item === "string"), "strings");
+      return {
+        facts: strings(a.facts),
+        warnings: strings(a.warnings),
+        decisions
+      };
+    }
+    __name(planAssessmentOf, "planAssessmentOf");
     exports.ANY_POLICY_MATCH = {
       environments: [],
       riskLevels: [],
@@ -2754,7 +3062,10 @@ var require_operations = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.OPERATION_RUN_TARGET_STATUSES = exports.OPERATION_RUN_STEP_STATUSES = exports.OPERATION_RUN_STATUSES = exports.STEP_FAILURE_POLICIES = exports.OPERATION_STEP_KINDS = exports.DRY_RUN_OUTCOMES = exports.OPERATION_VERIFICATION_LIFECYCLES = exports.OPERATION_HEALTH_STATES = exports.OPERATION_LIFECYCLES = void 0;
+    exports.PREVIEW_UNCHECKED_SENTENCE = exports.PREVIEW_UNCHECKED_REASONS = exports.OPERATION_RUN_TARGET_STATUSES = exports.OPERATION_RUN_STEP_STATUSES = exports.OPERATION_RUN_STATUSES = exports.STEP_FAILURE_POLICIES = exports.OPERATION_STEP_KINDS = exports.DRY_RUN_OUTCOMES = exports.OPERATION_VERIFICATION_LIFECYCLES = exports.OPERATION_HEALTH_STATES = exports.OPERATION_LIFECYCLES = void 0;
+    exports.targetPlanOf = targetPlanOf;
+    var governance_1 = require_governance();
+    var decisions_1 = require_decisions();
     exports.OPERATION_LIFECYCLES = [
       "draft",
       "published",
@@ -2821,6 +3132,35 @@ var require_operations = __commonJS({
       "rolled_back",
       "rollback_failed"
     ];
+    function targetPlanOf(stored) {
+      if (!Array.isArray(stored)) return null;
+      const plan = [];
+      for (const entry of stored) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+        const { ref, label, disposition, decisions, assessment, refusal } = entry;
+        if (typeof ref !== "string" || ref.length === 0) continue;
+        if (typeof label !== "string" || !(0, decisions_1.isTargetDisposition)(disposition)) continue;
+        if (refusal !== null && typeof refusal !== "string") continue;
+        plan.push({
+          ref,
+          label,
+          disposition,
+          decisions: (0, decisions_1.recordedDecisionsOf)(decisions),
+          assessment: (0, governance_1.planAssessmentOf)(assessment),
+          refusal: refusal ?? null
+        });
+      }
+      return plan;
+    }
+    __name(targetPlanOf, "targetPlanOf");
+    exports.PREVIEW_UNCHECKED_REASONS = [
+      "depends_on_earlier_output",
+      "connector_plans_no_checks"
+    ];
+    exports.PREVIEW_UNCHECKED_SENTENCE = {
+      depends_on_earlier_output: "Not checked before the run: this step's parameters come from an earlier step's outputs, which exist only once that step has run. Each target is checked when its execution is submitted, and a target that would need a decision is not acted on.",
+      connector_plans_no_checks: "This action runs no checks of its own before the run."
+    };
   }
 });
 
@@ -2943,7 +3283,7 @@ var require_package_execution = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PACKAGE_CONTAINER_ENV = exports.PACKAGE_PHASES = void 0;
+    exports.RUN_TOKEN_REJECTED = exports.RUN_TOKEN_HEADER = exports.PACKAGE_RUNNER_ENTRYPOINT = exports.PACKAGE_CONTAINER_ENV = exports.PACKAGE_PHASES = void 0;
     exports.PACKAGE_PHASES = [
       "validate",
       "run",
@@ -2965,6 +3305,11 @@ var require_package_execution = __commonJS({
       egressControlUrl: "RUNVERIC_EGRESS_CONTROL_URL",
       egressControlToken: "RUNVERIC_EGRESS_CONTROL_TOKEN"
     };
+    exports.PACKAGE_RUNNER_ENTRYPOINT = [
+      "/opt/runveric/runner/launch.sh"
+    ];
+    exports.RUN_TOKEN_HEADER = "x-runveric-run-token";
+    exports.RUN_TOKEN_REJECTED = "This run token is not valid for this execution.";
   }
 });
 
@@ -3215,6 +3560,803 @@ var require_runners = __commonJS({
   }
 });
 
+// ../contracts/dist/scoped-credential.js
+var require_scoped_credential = __commonJS({
+  "../contracts/dist/scoped-credential.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.RunnerStepCredentialExpiredError = exports.RunnerStepCredentialError = exports.STEP_CREDENTIAL_FAILURE = exports.ENGINE_ACTION_TOKEN_HOLDER = exports.RUNNER_STEP_TOKEN_HOLDER = exports.StaticScopedCredential = void 0;
+    var StaticScopedCredential = class StaticScopedCredential {
+      static {
+        __name(this, "StaticScopedCredential");
+      }
+      now;
+      holder;
+      byScope;
+      constructor(tokens2, now = Date.now, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        this.now = now;
+        this.holder = holder;
+        this.byScope = new Map(tokens2.map((token2) => [
+          token2.scope,
+          token2
+        ]));
+      }
+      async getToken(scopes) {
+        const requested = typeof scopes === "string" ? [
+          scopes
+        ] : scopes;
+        for (const scope of requested) {
+          const token2 = this.byScope.get(scope);
+          if (token2) {
+            if (token2.expiresOnTimestamp <= this.now()) {
+              throw new RunnerStepCredentialExpiredError(scope, token2.expiresOnTimestamp, this.now(), this.holder);
+            }
+            return {
+              token: token2.token,
+              expiresOnTimestamp: token2.expiresOnTimestamp
+            };
+          }
+        }
+        throw new RunnerStepCredentialError(requested, [
+          ...this.byScope.keys()
+        ], this.holder);
+      }
+    };
+    exports.StaticScopedCredential = StaticScopedCredential;
+    exports.RUNNER_STEP_TOKEN_HOLDER = {
+      noun: "step",
+      whereDeclared: "The channel mints exactly what a connector's azureAudiences declares, so this connector reaches an Azure resource it does not say it reaches.",
+      whyNoMore: "A step container is handed minted bytes and nothing it can use to get another, so the step ran longer than its own credential and cannot continue."
+    };
+    exports.ENGINE_ACTION_TOKEN_HOLDER = {
+      noun: "action",
+      whereDeclared: "The engine mints exactly the audiences an action's manifest declares in execution.audiences, so this action reaches an Azure resource it does not say it reaches.",
+      whyNoMore: "An action is handed minted bytes and nothing it can use to get another, so it ran longer than its own credential and cannot continue."
+    };
+    exports.STEP_CREDENTIAL_FAILURE = "runvericStepCredentialFailure";
+    var RunnerStepCredentialError = class RunnerStepCredentialError extends Error {
+      static {
+        __name(this, "RunnerStepCredentialError");
+      }
+      constructor(requested, available, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        super(`This ${holder.noun} was authorized for ${available.length > 0 ? available.map(quote).join(", ") : "no scopes"} and asked for ${requested.map(quote).join(", ")}. ${holder.whereDeclared}`);
+        this.name = "RunnerStepCredentialError";
+      }
+      /** Not a fact about the resource — see {@link STEP_CREDENTIAL_FAILURE}. */
+      [exports.STEP_CREDENTIAL_FAILURE] = true;
+    };
+    exports.RunnerStepCredentialError = RunnerStepCredentialError;
+    var RunnerStepCredentialExpiredError = class RunnerStepCredentialExpiredError extends Error {
+      static {
+        __name(this, "RunnerStepCredentialExpiredError");
+      }
+      constructor(scope, expiresOnTimestamp, now, holder = exports.RUNNER_STEP_TOKEN_HOLDER) {
+        super(`This ${holder.noun}'s token for ${quote(scope)} expired ${Math.round((now - expiresOnTimestamp) / 1e3)}s ago, at ${new Date(expiresOnTimestamp).toISOString()}. ${holder.whyNoMore}`);
+        this.name = "RunnerStepCredentialExpiredError";
+      }
+      /** Not a fact about the resource — see {@link STEP_CREDENTIAL_FAILURE}. */
+      [exports.STEP_CREDENTIAL_FAILURE] = true;
+    };
+    exports.RunnerStepCredentialExpiredError = RunnerStepCredentialExpiredError;
+    function quote(scope) {
+      return `"${scope}"`;
+    }
+    __name(quote, "quote");
+  }
+});
+
+// ../contracts/dist/action-protocol.js
+var require_action_protocol = __commonJS({
+  "../contracts/dist/action-protocol.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ActionProtocolError = exports.JWT_SHAPE = exports.REDACTED_SECRET = exports.ENGINE_RUN_ROUTES = exports.ACTION_PROBE_ENV = exports.ACTION_RUNTIME_PROBE_FLAG = exports.ACTION_CONTAINER_ENV = exports.MAX_PLAN_VALIDATE_TARGETS = exports.ACTION_PROTOCOL_LIMITS = exports.ACTION_EXECUTION_KINDS = exports.ENGINE_CONNECTOR_KEY = exports.ACTION_CONTRACTS = void 0;
+    exports.isActionContract = isActionContract;
+    exports.engineRunUrl = engineRunUrl;
+    exports.actionAudienceRefusal = actionAudienceRefusal;
+    exports.actionTokenScope = actionTokenScope;
+    exports.redactSecrets = redactSecrets;
+    exports.redactJwtShaped = redactJwtShaped;
+    exports.carriesJwtShaped = carriesJwtShaped;
+    exports.jsonByteLength = jsonByteLength;
+    exports.parseActionInvocation = parseActionInvocation;
+    exports.parseActionEvent = parseActionEvent;
+    exports.tooManyEvents = tooManyEvents;
+    exports.parseActionCheckpoint = parseActionCheckpoint;
+    exports.parseCheckpointAck = parseCheckpointAck;
+    exports.parseActionReport = parseActionReport;
+    var wire_identity_1 = require_wire_identity();
+    var package_execution_1 = require_package_execution();
+    var validation_1 = require_validation();
+    exports.ACTION_CONTRACTS = [
+      wire_identity_1.ACTION_PROTOCOL_V1
+    ];
+    function isActionContract(value) {
+      return typeof value === "string" && exports.ACTION_CONTRACTS.includes(value);
+    }
+    __name(isActionContract, "isActionContract");
+    exports.ENGINE_CONNECTOR_KEY = "runveric.engine";
+    exports.ACTION_EXECUTION_KINDS = [
+      "engine"
+    ];
+    exports.ACTION_PROTOCOL_LIMITS = {
+      maxEvents: 500,
+      maxEventBytes: 2048,
+      maxReportBytes: 262144,
+      maxRestorePointBytes: 65536
+    };
+    exports.MAX_PLAN_VALIDATE_TARGETS = 200;
+    exports.ACTION_CONTAINER_ENV = {
+      runToken: "RUNVERIC_ACTION_RUN_TOKEN",
+      callbackBaseUrl: "RUNVERIC_ACTION_CALLBACK_BASE_URL",
+      runId: "RUNVERIC_ACTION_RUN_ID",
+      imageDigest: "RUNVERIC_ACTION_IMAGE_DIGEST"
+    };
+    exports.ACTION_RUNTIME_PROBE_FLAG = "--probe";
+    exports.ACTION_PROBE_ENV = {
+      identities: "RUNVERIC_PROBE_IDENTITIES"
+    };
+    exports.ENGINE_RUN_ROUTES = {
+      base: "internal/engine-runs",
+      invocation: "invocation",
+      events: "events",
+      checkpoint: "checkpoint",
+      report: "report"
+    };
+    function engineRunUrl(callbackBaseUrl, runId, message) {
+      const origin2 = callbackBaseUrl.replace(/\/+$/, "");
+      return `${origin2}/${exports.ENGINE_RUN_ROUTES.base}/${encodeURIComponent(runId)}/${exports.ENGINE_RUN_ROUTES[message]}`;
+    }
+    __name(engineRunUrl, "engineRunUrl");
+    function actionAudienceRefusal(value) {
+      if (typeof value === "string" && AUDIENCE_ORIGIN.test(value)) return null;
+      return `"${String(value)}" is not an audience. An audience is the https origin of the resource a token is for \u2014 lowercase, with no port, path or trailing slash, e.g. "https://management.azure.com".`;
+    }
+    __name(actionAudienceRefusal, "actionAudienceRefusal");
+    var AUDIENCE_ORIGIN = /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+    function actionTokenScope(audience) {
+      return `${audience}/.default`;
+    }
+    __name(actionTokenScope, "actionTokenScope");
+    exports.REDACTED_SECRET = "[redacted]";
+    function redactSecrets(value, secrets) {
+      const present = secrets.filter((secret) => secret.length > 0);
+      if (present.length === 0) return value;
+      return mapStrings(value, (text) => present.reduce((out, secret) => out.split(secret).join(exports.REDACTED_SECRET), text));
+    }
+    __name(redactSecrets, "redactSecrets");
+    exports.JWT_SHAPE = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/;
+    function redactJwtShaped(value) {
+      const everyMatch = new RegExp(exports.JWT_SHAPE.source, "g");
+      return mapStrings(value, (text) => text.replace(everyMatch, exports.REDACTED_SECRET));
+    }
+    __name(redactJwtShaped, "redactJwtShaped");
+    function carriesJwtShaped(value) {
+      let found = false;
+      mapStrings(value, (text) => {
+        found ||= exports.JWT_SHAPE.test(text);
+        return text;
+      });
+      return found;
+    }
+    __name(carriesJwtShaped, "carriesJwtShaped");
+    function mapStrings(value, scrub) {
+      const walk = /* @__PURE__ */ __name((node) => {
+        if (typeof node === "string") return scrub(node);
+        if (Array.isArray(node)) return node.map(walk);
+        if (node !== null && typeof node === "object") {
+          return Object.fromEntries(Object.entries(node).map(([key, item]) => [
+            scrub(key),
+            walk(item)
+          ]));
+        }
+        return node;
+      }, "walk");
+      return walk(value);
+    }
+    __name(mapStrings, "mapStrings");
+    function jsonByteLength(value) {
+      const text = JSON.stringify(value) ?? "";
+      let bytes = 0;
+      for (const char of text) {
+        const point = char.codePointAt(0) ?? 0;
+        bytes += point < 128 ? 1 : point < 2048 ? 2 : point < 65536 ? 3 : 4;
+      }
+      return bytes;
+    }
+    __name(jsonByteLength, "jsonByteLength");
+    var ActionProtocolError = class ActionProtocolError extends Error {
+      static {
+        __name(this, "ActionProtocolError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "ActionProtocolError";
+      }
+    };
+    exports.ActionProtocolError = ActionProtocolError;
+    function parseActionInvocation(body) {
+      const raw = objectOf(body, "The invocation");
+      onlyKeys(raw, INVOCATION_KEYS, "The invocation");
+      if (!isActionContract(raw.protocol)) {
+        throw new ActionProtocolError(`The invocation speaks ${String(raw.protocol)}, and this runtime speaks ${exports.ACTION_CONTRACTS.join(", ")}.`);
+      }
+      const phase = raw.phase;
+      if (typeof phase !== "string" || !package_execution_1.PACKAGE_PHASES.includes(phase)) {
+        throw new ActionProtocolError(`An invocation phase of "${String(phase)}" is not in the vocabulary.`);
+      }
+      const actionRaw = objectOf(raw.action, "The invocation's action");
+      onlyKeys(actionRaw, [
+        "key",
+        "version",
+        "image"
+      ], "The invocation's action");
+      const action = {
+        key: nonEmpty(actionRaw.key, "The action's key"),
+        version: nonEmpty(actionRaw.version, "The action's version"),
+        image: digestPinned(actionRaw.image)
+      };
+      const executionRaw = objectOf(raw.execution, "The invocation's execution");
+      onlyKeys(executionRaw, [
+        "id",
+        "tenantId",
+        "correlationId",
+        "dryRun"
+      ], "The invocation's execution");
+      if (typeof executionRaw.dryRun !== "boolean") {
+        throw new ActionProtocolError("The invocation's execution must say whether it is a dry run.");
+      }
+      const execution = {
+        id: nonEmpty(executionRaw.id, "The execution's id"),
+        tenantId: nonEmpty(executionRaw.tenantId, "The execution's tenant"),
+        correlationId: nonEmpty(executionRaw.correlationId, "The execution's correlation id"),
+        dryRun: executionRaw.dryRun
+      };
+      const limits = parseLimits(raw.limits);
+      const decisions = parseDecisions(raw.decisions);
+      const targets = parseTargets(raw.targets);
+      const credentials = {
+        tokens: parseTokens(objectOf(raw.credentials, "The invocation's credentials"))
+      };
+      const restorePoint = nullableObject(raw.restorePoint, "The invocation's restore point");
+      const priorResult = nullableObject(raw.priorResult, "The invocation's prior result");
+      if (restorePoint !== null && jsonByteLength(restorePoint) > limits.maxRestorePointBytes) {
+        throw new ActionProtocolError(`The invocation's restore point is larger than ${limits.maxRestorePointBytes} bytes.`);
+      }
+      const base = {
+        protocol: raw.protocol,
+        action,
+        execution,
+        targets,
+        credentials,
+        limits
+      };
+      if (phase === "validate") {
+        if (raw.mode !== "plan" && raw.mode !== "run") {
+          throw new ActionProtocolError(`A validate invocation's mode of "${String(raw.mode)}" is not "plan" or "run".`);
+        }
+        if (raw.mode !== decisions.phase) {
+          throw new ActionProtocolError(`A validate invocation in ${raw.mode} mode carries ${decisions.phase}-phase decisions; the two are the same fact.`);
+        }
+        assertTargetCount(targets.length, raw.mode === "plan" ? exports.MAX_PLAN_VALIDATE_TARGETS : 1, `A ${raw.mode}-mode validate`);
+        if (restorePoint !== null || priorResult !== null) {
+          throw new ActionProtocolError("A validate invocation carries no restore point and no prior result.");
+        }
+        return {
+          ...base,
+          phase,
+          mode: raw.mode,
+          decisions,
+          restorePoint: null,
+          priorResult: null
+        };
+      }
+      if (raw.mode !== void 0) {
+        throw new ActionProtocolError(`A ${phase} invocation has no mode \u2014 only a validate is asked in a mode.`);
+      }
+      if (decisions.phase !== "run") {
+        throw new ActionProtocolError(`A ${phase} invocation carries a run's decisions, never a plan's.`);
+      }
+      assertTargetCount(targets.length, 1, `A ${phase}`);
+      if (phase === "run") {
+        if (priorResult !== null) {
+          throw new ActionProtocolError("A run invocation carries no prior result \u2014 only a rollback reads one.");
+        }
+        return {
+          ...base,
+          phase,
+          decisions,
+          restorePoint,
+          priorResult: null
+        };
+      }
+      return {
+        ...base,
+        phase: "rollback",
+        decisions,
+        restorePoint,
+        priorResult
+      };
+    }
+    __name(parseActionInvocation, "parseActionInvocation");
+    function parseActionEvent(body, limits, alreadyReceived) {
+      if (alreadyReceived >= limits.maxEvents) throw tooManyEvents(limits);
+      const raw = objectOf(body, "An event");
+      onlyKeys(raw, [
+        "level",
+        "message",
+        "data"
+      ], "An event");
+      if (jsonByteLength(raw) > limits.maxEventBytes) {
+        throw new ActionProtocolError(`An event is larger than ${limits.maxEventBytes} bytes.`);
+      }
+      if (typeof raw.level !== "string" || !Object.hasOwn(EVENT_LEVELS, raw.level)) {
+        throw new ActionProtocolError(`An event level of "${String(raw.level)}" is not in the vocabulary.`);
+      }
+      const message = nonEmpty(raw.message, "An event's message");
+      if (raw.data === void 0) return {
+        level: raw.level,
+        message
+      };
+      return {
+        level: raw.level,
+        message,
+        data: jsonObject(raw.data, "An event's data")
+      };
+    }
+    __name(parseActionEvent, "parseActionEvent");
+    function tooManyEvents(limits) {
+      return new ActionProtocolError(`The action sent more than ${limits.maxEvents} events.`);
+    }
+    __name(tooManyEvents, "tooManyEvents");
+    function parseActionCheckpoint(body, limits) {
+      const raw = objectOf(body, "A checkpoint");
+      onlyKeys(raw, [
+        "kind",
+        "record"
+      ], "A checkpoint");
+      if (raw.kind !== "restore_point") {
+        throw new ActionProtocolError(`A checkpoint of kind "${String(raw.kind)}" is not one this contract knows.`);
+      }
+      const record = jsonObject(raw.record, "A checkpoint's record");
+      if (jsonByteLength(record) > limits.maxRestorePointBytes) {
+        throw new ActionProtocolError(`A restore point is larger than ${limits.maxRestorePointBytes} bytes.`);
+      }
+      return {
+        kind: "restore_point",
+        record
+      };
+    }
+    __name(parseActionCheckpoint, "parseActionCheckpoint");
+    function parseCheckpointAck(body) {
+      const raw = objectOf(body, "A checkpoint acknowledgement");
+      onlyKeys(raw, [
+        "acknowledged"
+      ], "A checkpoint acknowledgement");
+      if (raw.acknowledged !== true) {
+        throw new ActionProtocolError("The checkpoint was not acknowledged.");
+      }
+      return {
+        acknowledged: true
+      };
+    }
+    __name(parseCheckpointAck, "parseCheckpointAck");
+    function parseActionReport(body, sent) {
+      const raw = objectOf(body, "The report");
+      onlyKeys(raw, [
+        "phase",
+        "checks",
+        "outcome"
+      ], "The report");
+      if (jsonByteLength(raw) > sent.limits.maxReportBytes) {
+        throw new ActionProtocolError(`The report is larger than ${sent.limits.maxReportBytes} bytes.`);
+      }
+      if (raw.phase !== sent.phase) {
+        throw new ActionProtocolError(`The report is for phase "${String(raw.phase)}", but this invocation is for "${sent.phase}".`);
+      }
+      if (sent.phase === "validate") {
+        if (raw.checks === void 0 === (raw.outcome === void 0)) {
+          throw new ActionProtocolError("A validate report carries checks, or \u2014 when they could not run \u2014 a failed outcome; exactly one of the two.");
+        }
+        if (raw.outcome !== void 0) {
+          const outcome = parseOutcome(raw.outcome);
+          if (outcome.status !== "failed") {
+            throw new ActionProtocolError(`A validate report's outcome can only say the checks failed to run, never "${outcome.status}" \u2014 the engine decides what checks mean.`);
+          }
+          return {
+            phase: "validate",
+            outcome
+          };
+        }
+        const byRef = objectOf(raw.checks, "A validate report's checks");
+        const expected = new Set(sent.targets.map((target) => target.ref));
+        for (const ref of Object.keys(byRef)) {
+          if (!expected.has(ref)) {
+            throw new ActionProtocolError(`The report answers for "${ref}", which is not one of the targets it was given.`);
+          }
+        }
+        const checks = sent.targets.map(({ ref }) => {
+          if (!Object.hasOwn(byRef, ref)) {
+            throw new ActionProtocolError(`The report says nothing about "${ref}", one of the targets it was given.`);
+          }
+          const list = byRef[ref];
+          if (!Array.isArray(list)) {
+            throw new ActionProtocolError(`The checks for "${ref}" must be an array.`);
+          }
+          return {
+            ref,
+            checks: list.map((entry) => {
+              const parsed = (0, validation_1.validationCheckOf)(entry);
+              if ("refusal" in parsed) throw new ActionProtocolError(`The checks for "${ref}": ${parsed.refusal}`);
+              return parsed.check;
+            })
+          };
+        });
+        return {
+          phase: "validate",
+          checks
+        };
+      }
+      if (raw.checks !== void 0) {
+        throw new ActionProtocolError(`A ${sent.phase} report carries an outcome, never checks \u2014 those are the validate phase's answer.`);
+      }
+      return {
+        phase: sent.phase,
+        outcome: parseOutcome(raw.outcome)
+      };
+    }
+    __name(parseActionReport, "parseActionReport");
+    var INVOCATION_KEYS = [
+      "protocol",
+      "action",
+      "phase",
+      "mode",
+      "execution",
+      "targets",
+      "decisions",
+      "restorePoint",
+      "priorResult",
+      "credentials",
+      "limits"
+    ];
+    var EVENT_LEVELS = {
+      info: true,
+      warn: true,
+      error: true,
+      success: true
+    };
+    var OUTCOME_STATUSES = {
+      succeeded: true,
+      failed: true,
+      cancelled: true
+    };
+    function parseOutcome(value) {
+      if (value === void 0) {
+        throw new ActionProtocolError("A run or rollback report must carry an outcome.");
+      }
+      const raw = objectOf(value, "An outcome");
+      onlyKeys(raw, [
+        "status",
+        "message",
+        "data"
+      ], "An outcome");
+      if (typeof raw.status !== "string" || !Object.hasOwn(OUTCOME_STATUSES, raw.status)) {
+        throw new ActionProtocolError(`An outcome status of "${String(raw.status)}" is not in the vocabulary.`);
+      }
+      const status = raw.status;
+      const message = nonEmpty(raw.message, "An outcome's message");
+      if (raw.data === void 0) return {
+        status,
+        message
+      };
+      return {
+        status,
+        message,
+        data: jsonObject(raw.data, "An outcome's data")
+      };
+    }
+    __name(parseOutcome, "parseOutcome");
+    function parseLimits(value) {
+      const raw = objectOf(value, "The invocation's limits");
+      onlyKeys(raw, [
+        "deadline",
+        "maxEvents",
+        "maxEventBytes",
+        "maxReportBytes",
+        "maxRestorePointBytes"
+      ], "The invocation's limits");
+      return {
+        deadline: isoInstant(raw.deadline, "The deadline"),
+        maxEvents: positiveInteger(raw.maxEvents, "maxEvents"),
+        maxEventBytes: positiveInteger(raw.maxEventBytes, "maxEventBytes"),
+        maxReportBytes: positiveInteger(raw.maxReportBytes, "maxReportBytes"),
+        maxRestorePointBytes: positiveInteger(raw.maxRestorePointBytes, "maxRestorePointBytes")
+      };
+    }
+    __name(parseLimits, "parseLimits");
+    function parseDecisions(value) {
+      const raw = objectOf(value, "The invocation's decisions");
+      if (raw.phase === "plan") {
+        onlyKeys(raw, [
+          "phase"
+        ], "A plan's decisions");
+        return {
+          phase: "plan"
+        };
+      }
+      if (raw.phase !== "run") {
+        throw new ActionProtocolError(`A decisions phase of "${String(raw.phase)}" is not "plan" or "run".`);
+      }
+      onlyKeys(raw, [
+        "phase",
+        "recorded"
+      ], "A run's decisions");
+      if (!Array.isArray(raw.recorded)) {
+        throw new ActionProtocolError("A run's decisions must carry the recorded list, even when it is empty.");
+      }
+      const recorded = raw.recorded.map((entry) => {
+        const decision = objectOf(entry, "A recorded decision");
+        onlyKeys(decision, [
+          "code",
+          "acknowledgedBy",
+          "acknowledgedAt"
+        ], "A recorded decision");
+        if (!(0, validation_1.isDecisionCode)(decision.code)) {
+          throw new ActionProtocolError(`A recorded decision of "${String(decision.code)}" is not in the vocabulary.`);
+        }
+        return {
+          code: decision.code,
+          acknowledgedBy: nonEmpty(decision.acknowledgedBy, "Who acknowledged a decision"),
+          acknowledgedAt: isoInstant(decision.acknowledgedAt, "When a decision was acknowledged")
+        };
+      });
+      if (new Set(recorded.map((decision) => decision.code)).size !== recorded.length) {
+        throw new ActionProtocolError("A run's decisions record one code twice.");
+      }
+      return {
+        phase: "run",
+        recorded
+      };
+    }
+    __name(parseDecisions, "parseDecisions");
+    function parseTargets(value) {
+      if (!Array.isArray(value)) {
+        throw new ActionProtocolError("The invocation's targets must be an array.");
+      }
+      const targets = value.map((entry) => {
+        const raw = objectOf(entry, "A target");
+        onlyKeys(raw, [
+          "ref",
+          "parameters"
+        ], "A target");
+        return {
+          ref: nonEmpty(raw.ref, "A target's ref"),
+          parameters: jsonObject(raw.parameters, "A target's parameters")
+        };
+      });
+      if (new Set(targets.map((target) => target.ref)).size !== targets.length) {
+        throw new ActionProtocolError("The invocation names one target twice.");
+      }
+      return targets;
+    }
+    __name(parseTargets, "parseTargets");
+    function assertTargetCount(count, max, what) {
+      if (count < 1 || count > max) {
+        throw new ActionProtocolError(max === 1 ? `${what} acts on exactly one target; this invocation names ${count}.` : `${what} checks between 1 and ${max} targets; this invocation names ${count}.`);
+      }
+    }
+    __name(assertTargetCount, "assertTargetCount");
+    function parseTokens(credentials) {
+      onlyKeys(credentials, [
+        "tokens"
+      ], "The invocation's credentials");
+      if (!Array.isArray(credentials.tokens)) {
+        throw new ActionProtocolError("The invocation's credentials must carry a tokens array, even when it is empty.");
+      }
+      const tokens2 = credentials.tokens.map((entry) => {
+        const raw = objectOf(entry, "A token");
+        onlyKeys(raw, [
+          "audience",
+          "token",
+          "expiresOn"
+        ], "A token");
+        const refusal = actionAudienceRefusal(raw.audience);
+        if (refusal !== null) throw new ActionProtocolError(refusal);
+        return {
+          audience: raw.audience,
+          token: nonEmpty(raw.token, "A token's value"),
+          expiresOn: isoInstant(raw.expiresOn, "A token's expiry")
+        };
+      });
+      if (new Set(tokens2.map((token2) => token2.audience)).size !== tokens2.length) {
+        throw new ActionProtocolError("The invocation carries two tokens for one audience.");
+      }
+      return tokens2;
+    }
+    __name(parseTokens, "parseTokens");
+    var DIGEST_PINNED_IMAGE = /^[a-z0-9][a-z0-9._\-/:]*@sha256:[0-9a-f]{64}$/;
+    function digestPinned(value) {
+      if (typeof value !== "string" || !DIGEST_PINNED_IMAGE.test(value)) {
+        throw new ActionProtocolError(`The action's image "${String(value)}" is not addressed by digest. Nothing on the execution path resolves a tag (docs/128 \xA713.2).`);
+      }
+      return value;
+    }
+    __name(digestPinned, "digestPinned");
+    function objectOf(value, what) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new ActionProtocolError(`${what} must be an object.`);
+      }
+      return value;
+    }
+    __name(objectOf, "objectOf");
+    function onlyKeys(raw, allowed, what) {
+      for (const key of Object.keys(raw)) {
+        if (!allowed.includes(key)) {
+          throw new ActionProtocolError(`${what} carries "${key}", which this contract does not have.`);
+        }
+      }
+    }
+    __name(onlyKeys, "onlyKeys");
+    function nonEmpty(value, what) {
+      if (typeof value !== "string" || value.length === 0) {
+        throw new ActionProtocolError(`${what} must be a non-empty string.`);
+      }
+      return value;
+    }
+    __name(nonEmpty, "nonEmpty");
+    function positiveInteger(value, what) {
+      if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+        throw new ActionProtocolError(`The limit "${what}" must be a positive integer.`);
+      }
+      return value;
+    }
+    __name(positiveInteger, "positiveInteger");
+    function isoInstant(value, what) {
+      if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+        throw new ActionProtocolError(`${what} must be an ISO-8601 instant.`);
+      }
+      return value;
+    }
+    __name(isoInstant, "isoInstant");
+    function nullableObject(value, what) {
+      return value === null ? null : jsonObject(value, what);
+    }
+    __name(nullableObject, "nullableObject");
+    function jsonObject(value, what) {
+      if (!isJsonObject(value)) {
+        throw new ActionProtocolError(`${what} must be a JSON object.`);
+      }
+      return value;
+    }
+    __name(jsonObject, "jsonObject");
+    function isJsonObject(value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+      const prototype = Object.getPrototypeOf(value);
+      if (prototype !== Object.prototype && prototype !== null) return false;
+      return Object.values(value).every(isJsonValue);
+    }
+    __name(isJsonObject, "isJsonObject");
+    function isJsonValue(value) {
+      if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+      if (typeof value === "number") return Number.isFinite(value);
+      if (Array.isArray(value)) return value.every(isJsonValue);
+      return isJsonObject(value);
+    }
+    __name(isJsonValue, "isJsonValue");
+  }
+});
+
+// ../contracts/dist/action-signing.js
+var require_action_signing = __commonJS({
+  "../contracts/dist/action-signing.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.ACTION_SIGNATURE_REPOSITORY = exports.IMAGE_REVISION_LABEL = exports.IMAGE_SOURCE_LABEL = exports.COSIGN_SIGN_PREDICATE_TYPE = exports.IN_TOTO_STATEMENT_TYPE = exports.DSSE_IN_TOTO_PAYLOAD_TYPE = exports.SIGSTORE_BUNDLE_MEDIA_TYPE = void 0;
+    exports.SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
+    exports.DSSE_IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+    exports.IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+    exports.COSIGN_SIGN_PREDICATE_TYPE = "https://sigstore.dev/cosign/sign/v1";
+    exports.IMAGE_SOURCE_LABEL = "org.opencontainers.image.source";
+    exports.IMAGE_REVISION_LABEL = "org.opencontainers.image.revision";
+    exports.ACTION_SIGNATURE_REPOSITORY = "ghcr.io/runveric/action-signatures";
+  }
+});
+
+// ../contracts/dist/oci-media-types.js
+var require_oci_media_types = __commonJS({
+  "../contracts/dist/oci-media-types.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.IMAGE_MANIFEST_MEDIA_TYPES = exports.MANIFEST_MEDIA_TYPES = exports.DOCKER_MANIFEST_LIST = exports.OCI_IMAGE_INDEX = exports.DOCKER_IMAGE_MANIFEST = exports.OCI_IMAGE_MANIFEST = void 0;
+    exports.OCI_IMAGE_MANIFEST = "application/vnd.oci.image.manifest.v1+json";
+    exports.DOCKER_IMAGE_MANIFEST = "application/vnd.docker.distribution.manifest.v2+json";
+    exports.OCI_IMAGE_INDEX = "application/vnd.oci.image.index.v1+json";
+    exports.DOCKER_MANIFEST_LIST = "application/vnd.docker.distribution.manifest.list.v2+json";
+    exports.MANIFEST_MEDIA_TYPES = [
+      exports.OCI_IMAGE_MANIFEST,
+      exports.DOCKER_IMAGE_MANIFEST,
+      exports.OCI_IMAGE_INDEX,
+      exports.DOCKER_MANIFEST_LIST
+    ];
+    exports.IMAGE_MANIFEST_MEDIA_TYPES = [
+      exports.OCI_IMAGE_MANIFEST,
+      exports.DOCKER_IMAGE_MANIFEST
+    ];
+  }
+});
+
+// ../contracts/dist/action-image.js
+var require_action_image = __commonJS({
+  "../contracts/dist/action-image.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.MAX_IMAGE_MANIFEST_BYTES = exports.ACTION_RUNTIME_IMAGE = exports.ACTION_RUNTIME_REPOSITORY = void 0;
+    exports.imageConfigDescriptor = imageConfigDescriptor2;
+    exports.actionImageRefusal = actionImageRefusal2;
+    var action_repository_1 = require_action_repository();
+    var action_signing_1 = require_action_signing();
+    var oci_media_types_1 = require_oci_media_types();
+    exports.ACTION_RUNTIME_REPOSITORY = "ghcr.io/runveric/action-runtime";
+    exports.ACTION_RUNTIME_IMAGE = `${exports.ACTION_RUNTIME_REPOSITORY}@sha256:55126390dc54a79668e8475757f6de6dabc8c052242079d48d888eca4fdd5963`;
+    exports.MAX_IMAGE_MANIFEST_BYTES = 64 * 1024;
+    var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+    function imageConfigDescriptor2(manifest) {
+      if (!isRecord(manifest) || typeof manifest.mediaType !== "string") return null;
+      if (!oci_media_types_1.IMAGE_MANIFEST_MEDIA_TYPES.includes(manifest.mediaType) || manifest.schemaVersion !== 2) return null;
+      const config = manifest.config;
+      if (!isRecord(config) || typeof config.digest !== "string") return null;
+      if (typeof config.size !== "number" || !Number.isInteger(config.size) || config.size < 0) return null;
+      return {
+        digest: config.digest,
+        size: config.size
+      };
+    }
+    __name(imageConfigDescriptor2, "imageConfigDescriptor");
+    function actionImageRefusal2(input) {
+      const { key, image, manifest, config, provenance: provenance2 } = input;
+      const mediaType = isRecord(manifest) ? manifest.mediaType : void 0;
+      if (typeof mediaType !== "string" || !oci_media_types_1.IMAGE_MANIFEST_MEDIA_TYPES.includes(mediaType)) {
+        return `${image} is ${typeof mediaType === "string" ? `a ${mediaType}` : "a manifest of no declared type"}, not one image. An engine action's digest names exactly one linux/amd64 image manifest \u2014 never an index of several.`;
+      }
+      if (imageConfigDescriptor2(manifest) === null) {
+        return `${image} is not an image manifest \u2014 it names no config descriptor (schemaVersion 2, a digest and a size).`;
+      }
+      if (!isRecord(config)) {
+        return `${image}'s config is not a JSON object, so it cannot say what it was built for.`;
+      }
+      const platform = `${String(config.os)}/${String(config.architecture)}`;
+      if (platform !== "linux/amd64") {
+        return `${image} is built for ${platform}; an engine action runs on linux/amd64, which is what Container Apps Jobs run.`;
+      }
+      const labels = isRecord(config.config) && isRecord(config.config.Labels) ? config.config.Labels : {};
+      const expected = (0, action_repository_1.actionSourceRepository)(key);
+      const source = labels[action_signing_1.IMAGE_SOURCE_LABEL];
+      if (source !== expected) {
+        return `the image of action "${key}" says it was built in ${source === void 0 ? "no repository (it carries no " + action_signing_1.IMAGE_SOURCE_LABEL + " label)" : JSON.stringify(source)}, not ${expected}. A signature binds a digest and never a name, so an image built for another action cannot run under this one's manifest.`;
+      }
+      if (provenance2.repository !== expected) {
+        return `the artifact of action "${key}" says it was authored in ${JSON.stringify(provenance2.repository)}, not ${expected}, which its image names.`;
+      }
+      const revision = labels[action_signing_1.IMAGE_REVISION_LABEL];
+      if (revision !== provenance2.commit) {
+        return `the image of action "${key}" says it was built at ${revision === void 0 ? "no commit (it carries no " + action_signing_1.IMAGE_REVISION_LABEL + " label)" : JSON.stringify(revision)}, not ${provenance2.commit}, the commit its artifact was published from. An image and the manifest it runs under come from one commit, so neither can be swapped for another's.`;
+      }
+      return null;
+    }
+    __name(actionImageRefusal2, "actionImageRefusal");
+  }
+});
+
 // ../contracts/dist/runner-pool-presence.js
 var require_runner_pool_presence = __commonJS({
   "../contracts/dist/runner-pool-presence.js"(exports) {
@@ -4190,6 +5332,11 @@ var require_dist = __commonJS({
     __exportStar(require_runner_install(), exports);
     __exportStar(require_authoring_cli(), exports);
     __exportStar(require_runners(), exports);
+    __exportStar(require_scoped_credential(), exports);
+    __exportStar(require_action_protocol(), exports);
+    __exportStar(require_action_signing(), exports);
+    __exportStar(require_oci_media_types(), exports);
+    __exportStar(require_action_image(), exports);
     __exportStar(require_runner_pool_presence(), exports);
     __exportStar(require_routable_target(), exports);
     __exportStar(require_runner_pool_routing(), exports);
@@ -4427,6 +5574,7 @@ var require_manifest_validator = __commonJS({
     exports.canonicalJson = canonicalJson;
     exports.sha256Hex = sha256Hex;
     exports.isSafeRelativePath = isSafeRelativePath;
+    exports.isEgressDestination = isEgressDestination;
     var node_crypto_1 = __require("crypto");
     var node_net_1 = __require("net");
     var contracts_1 = require_dist();
@@ -5838,7 +6986,7 @@ var require_parameters_location = __commonJS({
     });
     exports.resolveParametersFile = resolveParametersFile;
     exports.resolveParametersFileOf = resolveParametersFileOf;
-    exports.readManifest = readManifest;
+    exports.readManifest = readManifest2;
     var yaml_1 = __require("yaml");
     var manifest_validator_1 = require_manifest_validator();
     var package_validation_1 = require_package_validation();
@@ -5849,7 +6997,7 @@ var require_parameters_location = __commonJS({
           reason: "manifest_missing"
         };
       }
-      const manifest = readManifest(manifestSource);
+      const manifest = readManifest2(manifestSource);
       if (!manifest) return {
         resolved: false,
         reason: "manifest_unparseable"
@@ -5877,7 +7025,7 @@ var require_parameters_location = __commonJS({
       return resolveParametersFile(files.get(package_validation_1.MANIFEST_FILE));
     }
     __name(resolveParametersFileOf, "resolveParametersFileOf");
-    function readManifest(source) {
+    function readManifest2(source) {
       try {
         const document = (0, yaml_1.parseDocument)(source);
         if (document.errors.length > 0) return void 0;
@@ -5887,7 +7035,7 @@ var require_parameters_location = __commonJS({
         return void 0;
       }
     }
-    __name(readManifest, "readManifest");
+    __name(readManifest2, "readManifest");
   }
 });
 
@@ -7219,7 +8367,8 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.scaffoldActionPackage = exports.reservedImportPaths = exports.generateImportedPackage = exports.authoredEntrypointOf = exports.authoredBodyPath = exports.powerShellDetection = exports.parseProbeOutput = exports.mapDeclaredParameters = exports.POWERSHELL_PARAM_PROBE = exports.pathSegments = exports.offsetToLocation = exports.locate = exports.interpreterForPath = exports.interpreterEntryFileList = exports.PACKAGE_INTERPRETER_EXTENSIONS = exports.PACKAGE_INTERPRETER_LAUNCH = exports.lintActionPackage = exports.sortFindings = exports.mergeFindings = exports.findingFromValidation = exports.resolveParametersFileOf = exports.resolveParametersFile = exports.readManifest = exports.checkActionPackage = exports.validateActionPackage = exports.REQUIRED_PACKAGE_FILES = exports.MANIFEST_FILE = exports.validatePackageResult = exports.PackageProtocolError = exports.normalizePackageRuntime = exports.checkOciImageReference = exports.PackageRuntimeDeclarationError = exports.PARAMETER_CONTROLS = exports.PARAMETER_PROPERTY_FIELDS = exports.PARAMETER_SCHEMA_FIELDS = exports.CREDENTIAL_SCOPE_PATTERN = exports.SPDX_ID_PATTERN = exports.DURATION_PATTERN = exports.SEMVER_PATTERN = exports.PACKAGE_ID_PATTERN = exports.MANIFEST_FIELDS = exports.RISK_LEVELS = exports.PROVIDERS = exports.ACTION_CATEGORIES = exports.isSafeRelativePath = exports.sha256Hex = exports.canonicalJson = exports.validateParameterSchema = exports.validateManifest = exports.parseAndValidateManifest = void 0;
+    exports.reservedImportPaths = exports.generateImportedPackage = exports.authoredEntrypointOf = exports.authoredBodyPath = exports.powerShellDetection = exports.parseProbeOutput = exports.mapDeclaredParameters = exports.POWERSHELL_PARAM_PROBE = exports.pathSegments = exports.offsetToLocation = exports.locate = exports.interpreterForPath = exports.interpreterEntryFileList = exports.PACKAGE_INTERPRETER_EXTENSIONS = exports.PACKAGE_INTERPRETER_LAUNCH = exports.lintActionPackage = exports.sortFindings = exports.mergeFindings = exports.findingFromValidation = exports.resolveParametersFileOf = exports.resolveParametersFile = exports.readManifest = exports.checkActionPackage = exports.validateActionPackage = exports.REQUIRED_PACKAGE_FILES = exports.MANIFEST_FILE = exports.validatePackageResult = exports.PackageProtocolError = exports.normalizePackageRuntime = exports.checkOciImageReference = exports.PackageRuntimeDeclarationError = exports.PARAMETER_CONTROLS = exports.PARAMETER_PROPERTY_FIELDS = exports.PARAMETER_SCHEMA_FIELDS = exports.CREDENTIAL_SCOPE_PATTERN = exports.SPDX_ID_PATTERN = exports.DURATION_PATTERN = exports.SEMVER_PATTERN = exports.PACKAGE_ID_PATTERN = exports.MANIFEST_FIELDS = exports.RISK_LEVELS = exports.PROVIDERS = exports.ACTION_CATEGORIES = exports.isEgressDestination = exports.isSafeRelativePath = exports.sha256Hex = exports.canonicalJson = exports.validateParameterSchema = exports.validateManifest = exports.parseAndValidateManifest = void 0;
+    exports.scaffoldActionPackage = void 0;
     var manifest_validator_1 = require_manifest_validator();
     Object.defineProperty(exports, "parseAndValidateManifest", {
       enumerable: true,
@@ -7257,6 +8406,12 @@ var require_dist2 = __commonJS({
         return manifest_validator_1.isSafeRelativePath;
       }, "get")
     });
+    Object.defineProperty(exports, "isEgressDestination", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return manifest_validator_1.isEgressDestination;
+      }, "get")
+    });
     var manifest_schema_1 = require_manifest_schema();
     Object.defineProperty(exports, "ACTION_CATEGORIES", {
       enumerable: true,
@@ -7537,7 +8692,7 @@ var require_dist2 = __commonJS({
 });
 
 // package.json
-var version = "0.2.0";
+var version = "0.4.0";
 
 // src/report.ts
 var useColour = process.stdout.isTTY === true && !process.env.NO_COLOR;
@@ -7647,7 +8802,7 @@ function printResult(result) {
 __name(printResult, "printResult");
 
 // src/catalog/publish-action.ts
-var import_contracts2 = __toESM(require_dist());
+var import_contracts3 = __toESM(require_dist());
 import { readFileSync } from "fs";
 import { dirname, resolve } from "path";
 import { parse as parseYaml } from "yaml";
@@ -7686,7 +8841,7 @@ var EMPTY_CONFIG_DESCRIPTOR = {
   digest: sha256(EMPTY_CONFIG),
   size: EMPTY_CONFIG.length
 };
-var OCI_MANIFEST = "application/vnd.oci.image.manifest.v1+json";
+var MANIFEST_ACCEPT = import_contracts.MANIFEST_MEDIA_TYPES.join(", ");
 function provenance(flags, dir) {
   const git = /* @__PURE__ */ __name((...args) => {
     try {
@@ -7724,7 +8879,7 @@ function buildArtifact(document) {
 `);
   const manifest = {
     schemaVersion: 2,
-    mediaType: OCI_MANIFEST,
+    mediaType: import_contracts.OCI_IMAGE_MANIFEST,
     artifactType: import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE,
     config: EMPTY_CONFIG_DESCRIPTOR,
     layers: [
@@ -7764,14 +8919,14 @@ function basicCredential() {
 }
 __name(basicCredential, "basicCredential");
 var tokens = /* @__PURE__ */ new Map();
-async function token(repository, challenge) {
+async function token(repository, challenge, access) {
   const field = /* @__PURE__ */ __name((name) => new RegExp(`${name}="([^"]*)"`).exec(challenge ?? "")?.[1], "field");
   const realm = field("realm");
   if (!realm) throw new Error(`${repository.host} asked for credentials without a Bearer challenge.`);
   const url = new URL(realm);
   const service = field("service");
   if (service) url.searchParams.set("service", service);
-  url.searchParams.set("scope", `repository:${repository.path}:pull,push`);
+  url.searchParams.set("scope", `repository:${repository.path}:${access}`);
   const credential = basicCredential();
   const answer = await fetch(url, {
     headers: credential ? {
@@ -7779,15 +8934,15 @@ async function token(repository, challenge) {
     } : {}
   });
   if (!answer.ok) {
-    throw new Error(`${repository.host} refused a push token for ${repository.path}: HTTP ${answer.status}` + (credential ? "." : " \u2014 set GHCR_TOKEN to a token with write:packages, or in a workflow GITHUB_TOKEN with packages: write."));
+    throw new Error(`${repository.host} refused a ${access === "pull" ? "pull" : "push"} token for ${repository.path}: HTTP ${answer.status}` + (credential || access === "pull" ? "." : " \u2014 set GHCR_TOKEN to a token with write:packages, or in a workflow GITHUB_TOKEN with packages: write."));
   }
   const body = await answer.json();
   const value = body.token ?? body.access_token ?? "";
-  tokens.set(repository.path, value);
+  tokens.set(`${repository.path} ${access}`, value);
   return value;
 }
 __name(token, "token");
-async function call(repository, method, path, { headers = {}, body } = {}) {
+async function call(repository, method, path, { headers = {}, body, access = "pull,push" } = {}) {
   const url = path.startsWith("http") ? path : `${origin(repository.host)}/v2/${repository.path}/${path}`;
   const send = /* @__PURE__ */ __name((bearer) => fetch(url, {
     method,
@@ -7800,8 +8955,8 @@ async function call(repository, method, path, { headers = {}, body } = {}) {
       } : {}
     }
   }), "send");
-  let answer = await send(tokens.get(repository.path));
-  if (answer.status === 401) answer = await send(await token(repository, answer.headers.get("www-authenticate")));
+  let answer = await send(tokens.get(`${repository.path} ${access}`));
+  if (answer.status === 401) answer = await send(await token(repository, answer.headers.get("www-authenticate"), access));
   return answer;
 }
 __name(call, "call");
@@ -7826,12 +8981,54 @@ __name(pushBlob, "pushBlob");
 async function manifestExists(repository, digest) {
   const answer = await call(repository, "HEAD", `manifests/${digest}`, {
     headers: {
-      Accept: OCI_MANIFEST
+      Accept: import_contracts.OCI_IMAGE_MANIFEST
     }
   });
   return answer.ok;
 }
 __name(manifestExists, "manifestExists");
+async function readVerified(repository, kind, digest, size = null) {
+  if (!isDigest(digest)) throw new Error(`"${digest}" is not a digest, so ${repository.ref} cannot be asked for it.`);
+  const answer = await call(repository, "GET", `${kind}/${digest}`, {
+    access: "pull",
+    headers: kind === "manifests" ? {
+      Accept: MANIFEST_ACCEPT
+    } : {}
+  });
+  if (!answer.ok) {
+    throw new Error(`${repository.ref}@${digest} could not be read: HTTP ${answer.status}${answer.status === 404 ? " \u2014 it is not in the registry" : ""}.`);
+  }
+  const bytes = Buffer.from(await answer.arrayBuffer());
+  const served = sha256(bytes);
+  if (served !== digest || size !== null && bytes.length !== size) {
+    throw new Error(`${repository.host} served ${bytes.length} bytes hashing to ${served} for ${repository.ref}@${digest}${size === null ? "" : ` (${size} bytes named)`}. Refused: a digest this command did not compute is not a pin.`);
+  }
+  return bytes;
+}
+__name(readVerified, "readVerified");
+var readManifest = /* @__PURE__ */ __name((repository, digest) => readVerified(repository, "manifests", digest), "readManifest");
+var readBlob = /* @__PURE__ */ __name((repository, digest, size) => readVerified(repository, "blobs", digest, size), "readBlob");
+function parseJsonBytes(bytes, what) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", {
+      fatal: true
+    }).decode(bytes));
+  } catch (cause) {
+    throw new Error(`${what} is not UTF-8 JSON. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+}
+__name(parseJsonBytes, "parseJsonBytes");
+async function readArtifactDocument(repository, digest) {
+  const what = `${repository.ref}@${digest}`;
+  const manifest = parseJsonBytes(await readManifest(repository, digest), `the manifest of ${what}`);
+  const layers = Array.isArray(manifest?.layers) ? manifest.layers : [];
+  const layer = layers[0];
+  if (manifest?.mediaType !== import_contracts.OCI_IMAGE_MANIFEST || layers.length !== 1 || layer?.mediaType !== import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE || typeof layer.digest !== "string" || typeof layer.size !== "number") {
+    throw new Error(`${what} is not a catalog artifact: expected one OCI manifest with exactly one ${import_contracts.CATALOG_ARTIFACT_MEDIA_TYPE} layer.`);
+  }
+  return parseJsonBytes(await readBlob(repository, layer.digest, layer.size), `the document of ${what}`);
+}
+__name(readArtifactDocument, "readArtifactDocument");
 async function pushArtifact(repository, artifact, tag) {
   await pushBlob(repository, EMPTY_CONFIG);
   await pushBlob(repository, artifact.documentBytes);
@@ -7841,7 +9038,7 @@ async function pushArtifact(repository, artifact, tag) {
   ]) {
     const put = await call(repository, "PUT", `manifests/${reference}`, {
       headers: {
-        "Content-Type": OCI_MANIFEST
+        "Content-Type": import_contracts.OCI_IMAGE_MANIFEST
       },
       body: artifact.manifestBytes
     });
@@ -7851,7 +9048,7 @@ async function pushArtifact(repository, artifact, tag) {
   }
   const asked = await call(repository, "HEAD", `manifests/${tag}`, {
     headers: {
-      Accept: OCI_MANIFEST
+      Accept: import_contracts.OCI_IMAGE_MANIFEST
     }
   });
   const reported = asked.headers.get("docker-content-digest");
@@ -7868,7 +9065,7 @@ var defaultTag = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISO
 
 // src/catalog/flags.ts
 function parseCatalogFlags(argv, known, repeated = []) {
-  const single = {};
+  const single2 = {};
   const many = {};
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index];
@@ -7884,28 +9081,67 @@ function parseCatalogFlags(argv, known, repeated = []) {
     }
     if (value === void 0 || value === "" || value.startsWith("--")) throw new Error(`--${name} needs a value.`);
     if (repeated.includes(name)) (many[name] ??= []).push(value);
-    else single[name] = value;
+    else single2[name] = value;
   }
   return {
-    single,
+    single: single2,
     many
   };
 }
 __name(parseCatalogFlags, "parseCatalogFlags");
 
+// src/catalog/image.ts
+var import_contracts2 = __toESM(require_dist());
+function parseImageReference(value, origin2) {
+  const at = value.lastIndexOf("@");
+  const digest = at === -1 ? "" : value.slice(at + 1);
+  if (at === -1 || !isDigest(digest)) {
+    throw new Error(`${origin2} "${value}" is not <repository>@<digest>. An engine action's image is named by its digest \u2014 sha256: and 64 lowercase hex \u2014 never by a tag, which a registry can repoint.`);
+  }
+  const repository = parseRepository(value.slice(0, at), origin2);
+  return {
+    repository,
+    digest,
+    ref: `${repository.ref}@${digest}`
+  };
+}
+__name(parseImageReference, "parseImageReference");
+async function imageRefusal(image, key, provenance2) {
+  const manifestBytes = await readManifest(image.repository, image.digest);
+  if (manifestBytes.length > import_contracts2.MAX_IMAGE_MANIFEST_BYTES) {
+    return `the image manifest of ${image.ref} is ${manifestBytes.length} bytes; the limit is ${import_contracts2.MAX_IMAGE_MANIFEST_BYTES}.`;
+  }
+  const manifest = parseJsonBytes(manifestBytes, `the image manifest of ${image.ref}`);
+  const descriptor = (0, import_contracts2.imageConfigDescriptor)(manifest);
+  const config = descriptor === null ? null : parseJsonBytes(await readBlob(image.repository, descriptor.digest, descriptor.size), `the image config of ${image.ref}`);
+  return (0, import_contracts2.actionImageRefusal)({
+    key,
+    image: image.ref,
+    manifest,
+    config,
+    provenance: provenance2
+  });
+}
+__name(imageRefusal, "imageRefusal");
+
 // src/catalog/publish-action.ts
-var PUBLISH_ACTION_USAGE = "runveric catalog publish-action --manifest <file.yaml> --to <registry>/<namespace>/<repository>\n                                [--tag <tag>] [--repository <source url>] [--commit <sha>]";
+var PUBLISH_ACTION_USAGE = "runveric catalog publish-action --manifest <file.yaml> --to <registry>/<namespace>/<repository>\n                                [--image <repository>@<digest>] [--tag <tag>]\n                                [--repository <source url>] [--commit <sha>]";
 var isMapping = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
 async function runPublishAction(argv) {
   const { single: flags } = parseCatalogFlags(argv, [
     "manifest",
     "to",
+    "image",
     "tag",
     "repository",
     "commit"
   ]);
   if (!flags.manifest || !flags.to) throw new Error("--manifest and --to are required.");
   const repository = parseRepository(flags.to, "--to");
+  const image = flags.image === void 0 ? null : parseImageReference(flags.image, "--image");
+  if (image !== null && image.repository.ref !== repository.ref) {
+    throw new Error(`--image ${image.ref} is outside the artifact's repository ${repository.ref}. An engine action's image lives in its own package, so its artifact names it by digest alone (docs/128 \xA717.2 D2) \u2014 push the image to ${repository.ref}.`);
+  }
   const path = resolve(flags.manifest);
   const manifest = readFileSync(path, "utf8");
   let parsed;
@@ -7917,8 +9153,15 @@ async function runPublishAction(argv) {
   const fields = isMapping(parsed) ? parsed : {};
   const key = typeof fields.key === "string" && fields.key.length > 0 ? fields.key : null;
   if (key === null) throw new Error(`${flags.manifest} declares no top-level \`key:\` \u2014 is it a catalog manifest?`);
-  const misnamed = (0, import_contracts2.actionPackageRefusal)(key, repository.ref);
+  const misnamed = (0, import_contracts3.actionPackageRefusal)(key, repository.ref);
   if (misnamed !== null) throw new Error(`--to: ${misnamed}`);
+  const executes = isMapping(fields.execution);
+  if (executes && image === null) {
+    throw new Error(`${flags.manifest} declares execution, so it is an engine action: publish it with --image <repository>@<digest>, the image its workflow built. Without one the server refuses it at plan.`);
+  }
+  if (!executes && image !== null) {
+    throw new Error(`${flags.manifest} declares no execution, so nothing would ever run --image ${image.ref}. A built-in action is published without one.`);
+  }
   let tag;
   if (fields.declares === "definition+version") {
     const version2 = typeof fields.version === "string" ? fields.version : null;
@@ -7931,13 +9174,25 @@ async function runPublishAction(argv) {
     tag = flags.tag ?? defaultTag();
   }
   requireTag(tag, flags.tag !== void 0 ? "--tag" : `${flags.manifest}'s version`);
-  const artifact = buildArtifact({
-    schemaVersion: import_contracts2.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+  const recorded = provenance(flags, dirname(path));
+  if (image !== null) {
+    const refusal = await imageRefusal(image, key, recorded);
+    if (refusal !== null) throw new Error(`--image: ${refusal}`);
+  }
+  const artifact = buildArtifact(image === null ? {
+    schemaVersion: import_contracts3.CATALOG_ACTION_ARTIFACT_SCHEMA_V1,
+    manifest,
+    provenance: recorded
+  } : {
+    schemaVersion: import_contracts3.CATALOG_ACTION_ARTIFACT_SCHEMA_V2,
     manifest,
-    provenance: provenance(flags, dirname(path))
+    provenance: recorded,
+    image: {
+      digest: image.digest
+    }
   });
   const digest = await pushArtifact(repository, artifact, tag);
-  process.stderr.write(`\u2713 ${key} published to ${repository.ref}:${tag}
+  process.stderr.write(`\u2713 ${key} published to ${repository.ref}:${tag}${image === null ? "" : `, naming the image ${image.digest}`}
 `);
   process.stderr.write(`  the registry reports ${digest} \u2014 the digest a release must name.
 `);
@@ -7947,7 +9202,7 @@ async function runPublishAction(argv) {
 __name(runPublishAction, "runPublishAction");
 
 // src/catalog/publish-release.ts
-var import_contracts3 = __toESM(require_dist());
+var import_contracts4 = __toESM(require_dist());
 import { readFileSync as readFileSync2 } from "fs";
 import { parse as parseYaml2 } from "yaml";
 var PUBLISH_RELEASE_USAGE = "runveric catalog publish-release (--from <release.yaml> | --action <key>=<repository>@<digest> \u2026)\n                                 --to <registry>/<namespace>/<repository> [--version <label>]\n                                 [--tag <tag>] [--repository <source url>] [--commit <sha>]";
@@ -7972,7 +9227,7 @@ function specFromFile(path) {
   } catch (cause) {
     throw new Error(`--from ${path} could not be read as YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
   }
-  const spec = (0, import_contracts3.parseCatalogReleaseSpec)(value);
+  const spec = (0, import_contracts4.parseCatalogReleaseSpec)(value);
   return {
     version: spec.version,
     entries: spec.actions.map((action) => ({
@@ -8022,7 +9277,7 @@ async function runPublishRelease(argv) {
     if (!isDigest(entry.digest)) {
       throw new Error(`${entry.label}: "${entry.digest}" is not a digest. A release names artifacts by digest only.`);
     }
-    const misnamed = (0, import_contracts3.actionPackageRefusal)(entry.key, entry.artifactRef);
+    const misnamed = (0, import_contracts4.actionPackageRefusal)(entry.key, entry.artifactRef);
     if (misnamed !== null) throw new Error(`${entry.label}: ${misnamed}`);
     return {
       ...entry,
@@ -8035,7 +9290,7 @@ async function runPublishRelease(argv) {
     }
   }
   const artifact = buildArtifact({
-    schemaVersion: import_contracts3.CATALOG_RELEASE_SCHEMA_V1,
+    schemaVersion: import_contracts4.CATALOG_RELEASE_SCHEMA_V1,
     version: version2,
     provenance: provenance(flags, process.cwd()),
     actions: actions.map(({ key, artifactRef, digest: digest2 }) => ({
@@ -8054,20 +9309,124 @@ async function runPublishRelease(argv) {
 }
 __name(runPublishRelease, "runPublishRelease");
 
+// src/catalog/verify-image.ts
+var import_contracts5 = __toESM(require_dist());
+import { readFileSync as readFileSync3 } from "fs";
+import { parse as parseYaml3 } from "yaml";
+var VERIFY_IMAGE_USAGE = "runveric catalog verify-image (<repository>@<digest> --key <action key> --commit <sha> | --from <release.yaml>)";
+var COMMIT = /^[0-9a-f]{40}$/;
+var isMapping2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isMapping");
+function single(value, flags) {
+  if (!flags.key || !flags.commit) throw new Error(`verify-image ${value} needs --key <action key> and --commit <sha>.`);
+  if (!COMMIT.test(flags.commit)) throw new Error(`--commit "${flags.commit}" is not a 40-hex commit.`);
+  const image = parseImageReference(value, "verify-image");
+  const misnamed = (0, import_contracts5.actionPackageRefusal)(flags.key, image.repository.ref);
+  if (misnamed !== null) throw new Error(misnamed);
+  return {
+    key: flags.key,
+    image,
+    provenance: {
+      repository: (0, import_contracts5.actionSourceRepository)(flags.key),
+      commit: flags.commit
+    },
+    label: `--key ${flags.key}`
+  };
+}
+__name(single, "single");
+async function fromRelease(path) {
+  let value;
+  try {
+    value = parseYaml3(readFileSync3(path, "utf8"));
+  } catch (cause) {
+    throw new Error(`--from ${path} could not be read as YAML. (${cause instanceof Error ? cause.message : String(cause)})`);
+  }
+  const candidates = [];
+  for (const action of (0, import_contracts5.parseCatalogReleaseSpec)(value).actions) {
+    const label = `${path}'s ${action.key}`;
+    const misnamed = (0, import_contracts5.actionPackageRefusal)(action.key, action.artifactRef);
+    if (misnamed !== null) throw new Error(`${label}: ${misnamed}`);
+    if (!isDigest(action.digest)) throw new Error(`${label}: "${action.digest}" is not a digest.`);
+    const repository = parseRepository(action.artifactRef, label);
+    const read = await readArtifactDocument(repository, action.digest);
+    const document = isMapping2(read) ? read : {};
+    const schemaVersion = document.schemaVersion;
+    if (schemaVersion === import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V1) continue;
+    if (schemaVersion !== import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2) {
+      throw new Error(`${label}: ${repository.ref}@${action.digest} declares schemaVersion ${JSON.stringify(schemaVersion)}; this CLI reads ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V1} and ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2}.`);
+    }
+    const image = isMapping2(document.image) ? document.image.digest : void 0;
+    const recorded = isMapping2(document.provenance) ? document.provenance : {};
+    if (typeof image !== "string" || typeof recorded.repository !== "string" || typeof recorded.commit !== "string") {
+      throw new Error(`${label}: its ${import_contracts5.CATALOG_ACTION_ARTIFACT_SCHEMA_V2} artifact carries no image digest or no provenance.`);
+    }
+    candidates.push({
+      key: action.key,
+      // ★ The image lives in the artifact's own package (D2) — the artifact names a digest, never a place.
+      image: parseImageReference(`${repository.ref}@${image}`, label),
+      provenance: {
+        repository: recorded.repository,
+        commit: recorded.commit
+      },
+      label
+    });
+  }
+  return candidates;
+}
+__name(fromRelease, "fromRelease");
+async function runVerifyImage(argv) {
+  const image = argv[0] !== void 0 && !argv[0].startsWith("--") ? argv[0] : void 0;
+  const { single: flags } = parseCatalogFlags(image === void 0 ? argv : argv.slice(1), [
+    "key",
+    "commit",
+    "from"
+  ]);
+  if (image !== void 0 && flags.from !== void 0) {
+    throw new Error("An image and --from are alternatives: verify one image, or every engine action release.yaml names.");
+  }
+  if (image === void 0 && flags.from === void 0) {
+    throw new Error(`Name an image or a release. Usage: ${VERIFY_IMAGE_USAGE}`);
+  }
+  if (flags.from !== void 0 && (flags.key !== void 0 || flags.commit !== void 0)) {
+    throw new Error("--key and --commit are read from each artifact when --from is given; pass one or the other.");
+  }
+  const candidates = image !== void 0 ? [
+    single(image, flags)
+  ] : await fromRelease(flags.from);
+  for (const candidate of candidates) {
+    const refusal = await imageRefusal(candidate.image, candidate.key, candidate.provenance);
+    if (refusal !== null) throw new Error(`${candidate.label}: ${refusal} Nothing was signed.`);
+  }
+  for (const candidate of candidates) {
+    process.stderr.write(`\u2713 ${candidate.key}: ${candidate.image.ref} \u2014 built in ${candidate.provenance.repository} at ${candidate.provenance.commit}
+`);
+    process.stdout.write(`${candidate.image.ref}
+`);
+  }
+  if (candidates.length === 0) process.stderr.write(`\u2713 ${flags.from} names no engine action \u2014 no image to sign.
+`);
+}
+__name(runVerifyImage, "runVerifyImage");
+
 // src/catalog/index.ts
 var CATALOG_USAGE = `runveric catalog \u2014 publish first-party catalog artifacts (docs/127)
 
   ${PUBLISH_ACTION_USAGE}
-      Publish one action's manifest, verbatim, as an artifact. stdout: <key>=<repository>@<digest>
+      Publish one action's manifest, verbatim, as an artifact \u2014 with --image, an engine action's
+      artifact naming its image by digest. stdout: <key>=<repository>@<digest>
 
   ${PUBLISH_RELEASE_USAGE}
       Publish a release naming each action artifact by digest. stdout: <repository>@<digest>
 
+  ${VERIFY_IMAGE_USAGE}
+      Judge an engine action's image by the server's rule before it is signed.
+      stdout: one <repository>@<digest> per image that passed
+
   Credentials: GHCR_TOKEN (write:packages), or in a workflow GITHUB_TOKEN with packages: write.
   Provenance: --repository/--commit, else GITHUB_SERVER_URL/GITHUB_REPOSITORY and GITHUB_SHA, else git.`;
 var SUBCOMMANDS = {
   "publish-action": runPublishAction,
-  "publish-release": runPublishRelease
+  "publish-release": runPublishRelease,
+  "verify-image": runVerifyImage
 };
 async function runCatalog(argv) {
   const [subcommand, ...rest] = argv;
@@ -8078,7 +9437,7 @@ async function runCatalog(argv) {
   }
   const run3 = SUBCOMMANDS[subcommand];
   if (run3 === void 0) {
-    printError(`\u2717 "catalog ${subcommand}" is not a command. There are two: ${Object.keys(SUBCOMMANDS).join(", ")}.`);
+    printError(`\u2717 "catalog ${subcommand}" is not a command. There are ${Object.keys(SUBCOMMANDS).length}: ${Object.keys(SUBCOMMANDS).join(", ")}.`);
     return 1;
   }
   try {
@@ -8152,7 +9511,7 @@ function toPackagePath(root, full) {
 __name(toPackagePath, "toPackagePath");
 
 // src/check.ts
-var import_contracts4 = __toESM(require_dist());
+var import_contracts6 = __toESM(require_dist());
 async function runCheck(options) {
   const directory = resolve2(options.directory ?? ".");
   let files;
@@ -8176,7 +9535,7 @@ async function runCheck(options) {
     print(style.red("This package would be REFUSED at import."));
   } else if (report.lintBlocked) {
     print();
-    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts4.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
+    print(style.red("This package would be ACCEPTED at import \u2014 and then misbehave.") + ` The errors above are not things ${import_contracts6.BRAND_SHORT_NAME} checks; they are things that go wrong at run time, silently.`);
   }
   if (report.advisoryCount > 0) {
     print();
@@ -8196,7 +9555,7 @@ async function runCheck(options) {
 __name(runCheck, "runCheck");
 
 // src/init.ts
-var import_contracts5 = __toESM(require_dist());
+var import_contracts7 = __toESM(require_dist());
 var import_action_manifest2 = __toESM(require_dist2());
 import { mkdir, writeFile } from "fs/promises";
 import { createInterface } from "readline/promises";
@@ -8265,9 +9624,9 @@ async function resolveId(supplied, ask) {
 }
 __name(resolveId, "resolveId");
 async function resolveInterpreter(supplied, ask) {
-  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts5.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
+  const value = supplied?.trim() || await ask?.(`Interpreter (${import_contracts7.PACKAGE_INTERPRETERS.join(" / ")})`, "bash") || "bash";
   if (!isInterpreter(value)) {
-    printError(style.red(`"${value}" is not an interpreter ${import_contracts5.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts5.PACKAGE_INTERPRETERS.join(", ")}.`);
+    printError(style.red(`"${value}" is not an interpreter ${import_contracts7.BRAND_SHORT_NAME} runs.`) + ` The runner image ships ${import_contracts7.PACKAGE_INTERPRETERS.join(", ")}.`);
     return null;
   }
   return value;
@@ -8288,7 +9647,7 @@ function prompter() {
 }
 __name(prompter, "prompter");
 function isInterpreter(value) {
-  return import_contracts5.PACKAGE_INTERPRETERS.includes(value);
+  return import_contracts7.PACKAGE_INTERPRETERS.includes(value);
 }
 __name(isInterpreter, "isInterpreter");
 function titleCase(value) {
@@ -8298,7 +9657,7 @@ __name(titleCase, "titleCase");
 
 // src/publish.ts
 var import_action_manifest3 = __toESM(require_dist2());
-var import_contracts6 = __toESM(require_dist());
+var import_contracts8 = __toESM(require_dist());
 import { resolve as resolve4 } from "path";
 
 // src/renamed-variable.ts
@@ -8310,15 +9669,15 @@ function renamedVariableRefusal(current, retired, env = process.env) {
 __name(renamedVariableRefusal, "renamedVariableRefusal");
 
 // src/publish.ts
-var TOKEN_ENV = import_contracts6.AUTHORING_CLI_ENV.token;
-var URL_ENV = import_contracts6.AUTHORING_CLI_ENV.url;
+var TOKEN_ENV = import_contracts8.AUTHORING_CLI_ENV.token;
+var URL_ENV = import_contracts8.AUTHORING_CLI_ENV.url;
 async function runPublish(options) {
   const directory = resolve4(options.directory ?? ".");
   const baseUrl = (options.to ?? process.env[URL_ENV] ?? "").trim().replace(/\/+$/, "");
   const token2 = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
   const stale = [
-    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts6.RETIRED_AUTHORING_CLI_ENV.url) : null,
-    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts6.RETIRED_AUTHORING_CLI_ENV.token) : null
+    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts8.RETIRED_AUTHORING_CLI_ENV.url) : null,
+    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts8.RETIRED_AUTHORING_CLI_ENV.token) : null
   ].filter((sentence) => sentence !== null);
   if (stale.length > 0) {
     for (const sentence of stale) printError(style.red(sentence));
@@ -8329,7 +9688,7 @@ async function runPublish(options) {
     return 1;
   }
   if (!token2) {
-    printError(style.red(`Publishing needs ${import_contracts6.BRAND_ARTICLE} ${import_contracts6.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
+    printError(style.red(`Publishing needs ${import_contracts8.BRAND_ARTICLE} ${import_contracts8.BRAND_SHORT_NAME} access token.`) + ` Set ${TOKEN_ENV}, or pass --token. (init, check and test need no account at all.)`);
     return 1;
   }
   let files;
@@ -8349,7 +9708,7 @@ async function runPublish(options) {
       errors: report.errorCount,
       warnings: report.warningCount
     });
-    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts6.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
+    printError(style.red("\nNot published.") + (report.validation.ok ? ` ${import_contracts8.BRAND_SHORT_NAME} would accept this, but the problems above make it misbehave at run time. Fix them, or pass --force if you disagree.` : " Fix the errors above and publish again."));
     return 1;
   }
   if (report.advisoryCount > 0) {
@@ -8396,7 +9755,7 @@ Publish refused (${response.status}).`));
   try {
     version2 = JSON.parse(text);
   } catch {
-    printError(style.red(`${import_contracts6.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
+    printError(style.red(`${import_contracts8.BRAND_SHORT_NAME} accepted the package but returned a response we cannot read.`));
     return 1;
   }
   print();
@@ -8405,7 +9764,7 @@ Publish refused (${response.status}).`));
   print(`  content digest ${version2.contentDigest}`);
   print(`  tier           ${version2.tier} ${style.grey(`(${version2.provenance})`)}`);
   print();
-  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts6.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
+  print(style.grey(`It is an immutable version now. Adopt it in ${import_contracts8.BRAND_SHORT_NAME} to put it in the catalog \u2014 publishing does not adopt, so nobody can run it until somebody chooses to.`));
   print();
   return 0;
 }
@@ -8417,11 +9776,11 @@ function formatProblem(text) {
   } catch {
     return `  ${text}`;
   }
-  const problem = (0, import_contracts6.parseProblemDocument)(parsed);
+  const problem = (0, import_contracts8.parseProblemDocument)(parsed);
   if (!problem) return `  ${text}`;
   const lines = [];
   if (problem.detail) lines.push(`  ${problem.detail}`);
-  for (const error of (0, import_contracts6.problemFieldErrors)(problem)) {
+  for (const error of (0, import_contracts8.problemFieldErrors)(problem)) {
     lines.push(error.field ? `  ${style.bold(error.field)}: ${error.message}` : `  ${error.message}`);
   }
   return lines.length > 0 ? lines.join("\n") : `  ${text}`;
@@ -8429,12 +9788,12 @@ function formatProblem(text) {
 __name(formatProblem, "formatProblem");
 
 // src/runner-image.ts
-var import_contracts7 = __toESM(require_dist());
+var import_contracts9 = __toESM(require_dist());
 import { execFile } from "child_process";
 import { promisify } from "util";
 var run = promisify(execFile);
 var LOCAL_RUNNER_IMAGE = "runveric-package-runner:local";
-var RUNNER_IMAGE_ENV = import_contracts7.AUTHORING_CLI_ENV.runnerImage;
+var RUNNER_IMAGE_ENV = import_contracts9.AUTHORING_CLI_ENV.runnerImage;
 var RenamedVariableError = class extends Error {
   static {
     __name(this, "RenamedVariableError");
@@ -8451,7 +9810,7 @@ function resolveRunnerImage(flag) {
     reference: configured,
     origin: "environment"
   };
-  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts7.RETIRED_AUTHORING_CLI_ENV.runnerImage);
+  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts9.RETIRED_AUTHORING_CLI_ENV.runnerImage);
   if (stale) throw new RenamedVariableError(stale);
   return {
     reference: LOCAL_RUNNER_IMAGE,
@@ -8466,7 +9825,7 @@ function runnerImageNote(image) {
     case "environment":
       return `from ${RUNNER_IMAGE_ENV}`;
     case "local-build":
-      return `locally built \u2014 NOT the image your ${import_contracts7.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
+      return `locally built \u2014 NOT the image your ${import_contracts9.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
   }
 }
 __name(runnerImageNote, "runnerImageNote");
@@ -8483,7 +9842,7 @@ async function assertDockerAvailable() {
       "{{.Server.Version}}"
     ]);
   } catch {
-    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts7.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
+    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts9.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
   }
 }
 __name(assertDockerAvailable, "assertDockerAvailable");
@@ -8576,7 +9935,7 @@ ${message.trim()}`);
 __name(azJson, "azJson");
 
 // src/test.ts
-var import_contracts8 = __toESM(require_dist());
+var import_contracts10 = __toESM(require_dist());
 var PHASES = [
   "validate",
   "run",
@@ -8593,7 +9952,7 @@ async function runTest(options) {
   const directory = resolve5(options.directory ?? ".");
   const phase = options.phase ?? "run";
   if (!PHASES.includes(phase)) {
-    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts8.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
+    printError(style.red(`"${options.phase}" is not a phase.`) + ` ${import_contracts10.BRAND_SHORT_NAME} runs ${PHASES.join(", ")} \u2014 one at a time, so you can read each one's result.`);
     return 1;
   }
   let files;
@@ -8665,9 +10024,9 @@ async function runTest(options) {
     print(`  runner image   ${image.reference} ${style.grey(`(${runnerImageNote(image)})`)}`);
     print(`  interpreter    ${interpreter}@${manifest.runtime.version}`);
     print(`  entrypoint     ${entrypoint}${import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[interpreter].entryFile}`);
-    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts8.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
+    print(`  identity       ${credential ? `${credential.account.name} ${style.grey(`\u2014 YOUR access, not ${import_contracts10.BRAND_SHORT_NAME}'s brokered least-privilege identity`)}` : style.grey("none (--no-credential)")}`);
     if (manifest.requiresNetwork) {
-      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts8.BRAND_SHORT_NAME} enforces it`)}`);
+      print(`  network        ${style.yellow("open")} ${style.grey(`\u2014 your allowlist (${(manifest.egressAllowlist ?? []).join(", ")}) is NOT enforced here; ${import_contracts10.BRAND_SHORT_NAME} enforces it`)}`);
     } else {
       print(`  network        ${style.grey("none \u2014 this package declares requiresNetwork: false")}`);
     }
@@ -8775,7 +10134,7 @@ async function materialize(workspace, input) {
     await writeFile2(target, contents);
   }
   const context = {
-    protocolVersion: import_contracts8.PACKAGE_EXECUTION_PROTOCOL_VERSION,
+    protocolVersion: import_contracts10.PACKAGE_EXECUTION_PROTOCOL_VERSION,
     // A recognisable id rather than a random uuid: it appears in the package's own log lines,
     // and "local-test" tells the reader instantly that this was not a real run.
     executionId: "local-test",
@@ -8801,7 +10160,7 @@ async function runContainer(options) {
   const launch = import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[options.interpreter];
   const script = `${CONTAINER.packageRoot}/${options.entrypoint}${launch.entryFile}`;
   const environment = {
-    RUNVERIC_PROTOCOL_VERSION: import_contracts8.PACKAGE_RESULT_PROTOCOL_VERSION,
+    RUNVERIC_PROTOCOL_VERSION: import_contracts10.PACKAGE_RESULT_PROTOCOL_VERSION,
     RUNVERIC_PHASE: options.phase,
     RUNVERIC_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
     RUNVERIC_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
@@ -8928,13 +10287,13 @@ function emitLine(line, stderr, onEvent) {
 __name(emitLine, "emitLine");
 async function reportOutcome(options) {
   if (options.exit.timedOut) {
-    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts8.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
+    printError(style.red("\nThe package did not finish within 15 minutes and was killed.") + ` ${import_contracts10.BRAND_SHORT_NAME} enforces the \`executionTimeout\` in your manifest; this is the local ceiling.`);
     return 1;
   }
   const exists = await stat2(options.resultPath).catch(() => null);
   if (!exists?.isFile() || exists.size === 0) {
     printError(style.red("\nThe package wrote no result.") + `
-  result.json is the only channel ${import_contracts8.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
+  result.json is the only channel ${import_contracts10.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
   Write it as the last thing your script does, on every path \u2014 including the ones that fail.`);
     return 1;
   }
@@ -8942,7 +10301,7 @@ async function reportOutcome(options) {
   try {
     parsed = JSON.parse(await readFile2(options.resultPath, "utf8"));
   } catch {
-    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts8.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
+    printError(style.red("\nresult.json is not valid JSON.") + ` ${import_contracts10.BRAND_SHORT_NAME} refuses the run rather than guessing what the package meant.`);
     return 1;
   }
   let result;
@@ -8950,14 +10309,14 @@ async function reportOutcome(options) {
     result = (0, import_action_manifest4.validatePackageResult)(parsed, options.phase);
   } catch (error) {
     printError(style.red(`
-${import_contracts8.BRAND_SHORT_NAME} would REFUSE this result.`) + `
+${import_contracts10.BRAND_SHORT_NAME} would REFUSE this result.`) + `
   ${error instanceof Error ? error.message : String(error)}
   This is the same check the control plane runs, so fixing it here fixes it there.`);
     return 1;
   }
   printResult(result);
   if (options.exit.code !== 0) {
-    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts8.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
+    print(style.yellow(`The package exited ${options.exit.code} but wrote a valid result. ${import_contracts10.BRAND_SHORT_NAME} reads the result, not the exit code \u2014 but a non-zero exit usually means something failed after the result was written.`));
     print();
   }
   return result.status === "succeeded" ? 0 : 1;
@@ -8984,9 +10343,9 @@ async function readJsonFile(path) {
 __name(readJsonFile, "readJsonFile");
 
 // src/main.ts
-var import_contracts9 = __toESM(require_dist());
+var import_contracts11 = __toESM(require_dist());
 var USAGE = `
-${style.bold("runveric")} \u2014 author ${import_contracts9.BRAND_ARTICLE} ${import_contracts9.BRAND_SHORT_NAME} action, without pushing anything.
+${style.bold("runveric")} \u2014 author ${import_contracts11.BRAND_ARTICLE} ${import_contracts11.BRAND_SHORT_NAME} action, without pushing anything.
 
 ${style.bold("USAGE")}
   runveric <command> [options]
@@ -8994,8 +10353,8 @@ ${style.bold("USAGE")}
 ${style.bold("COMMANDS")}
   init [directory]        Scaffold a working action. It passes check and test immediately.
   check                   Validate the package. Offline \u2014 no account, no cloud, no network.
-  test                    Run one phase in the real ${import_contracts9.BRAND_SHORT_NAME} runner image.
-  publish                 Upload it to ${import_contracts9.BRAND_SHORT_NAME} as an authored version. Needs an account.
+  test                    Run one phase in the real ${import_contracts11.BRAND_SHORT_NAME} runner image.
+  publish                 Upload it to ${import_contracts11.BRAND_SHORT_NAME} as an authored version. Needs an account.
   catalog <command>       Publish first-party catalog artifacts. Not for authoring: see \`runveric catalog --help\`.
 
 ${style.bold("init")}
@@ -9019,9 +10378,9 @@ ${style.bold("test")}
   --keep                  Keep the materialized /runveric tree for inspection.
 
 ${style.bold("publish")}
-  --to <url>              Your ${import_contracts9.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
+  --to <url>              Your ${import_contracts11.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
   --token <token>         Access token. Defaults to $${TOKEN_ENV}.
-  --force                 Publish despite lint errors. Never bypasses ${import_contracts9.BRAND_SHORT_NAME}'s validation.
+  --force                 Publish despite lint errors. Never bypasses ${import_contracts11.BRAND_SHORT_NAME}'s validation.
 
 ${style.bold("EVERYWHERE")}
   --dir <path>            The package directory. Defaults to the current directory.