@wavehouse/chtypes 1.1.0 → 2.0.0-dev.1

package/dist/ocifetch/channel.js

@@ -0,0 +1,219 @@
+/**
+ * The fetch contract this build speaks. A 2.0.0-dev SDK speaks the ABI v2 dev
+ * channel (`spec/abi-v2/docs.md`, rules r5 and r6), which is the v1 fetch
+ * contract (`docs/guides/fetch-v1.md`) narrowed in five ways:
+ *
+ *   - it fetches ONLY from `DEV_CHANNEL_BASE` and trusts ONLY the staging key
+ *     (`DEV_KEY_HEX`, id `DEV_KEY_ID`); the release key is not in its trust
+ *     list;
+ *   - it has no override: `CHTYPES_ARTIFACTS_URL`, `CHTYPES_TRUSTED_KEYS` and
+ *     `CHTYPES_ALLOW_UNSIGNED`, and the options that set a base, a trust list
+ *     or an unsigned fetch (`bases`, `trustedKeys`, `allowUnsigned`, and
+ *     `fetchSigned`'s repository), are ignored, each with one loud warning per
+ *     process;
+ *   - it refuses `frozen`, `lockWrite`, `lockPath` and `update` (`--frozen`,
+ *     `--lock`, `--update`) before any network call: a dev build is
+ *     replaceable and a superseded one expires, so nothing may pin one;
+ *   - its cache is one no released 1.x reader ever reads: `verified.json`
+ *     records are schema 2, the default root is
+ *     `${XDG_CACHE_HOME:-~/.cache}/chtypes/v2-dev`, and an explicit cache
+ *     (`CHTYPES_CACHE`, `--cache`, the `cacheDir` option) is used through its
+ *     subroot `<cache>/v2-dev`, never as a whole layout;
+ *   - a signed predicate must say abi 2.
+ *
+ * The v1 contract itself stays in this module, unchanged, because the
+ * fetch-v1 conformance cases (`tests/fixtures/fetch-v1`) are its
+ * specification and the dev channel shares every other rule with it. Only a
+ * test reaches it: `useFetchV1ForTests` and `allowOverridesForTests` throw
+ * anywhere but inside a vitest worker, and neither is exported from the
+ * package's entry point, so neither is an override a user can reach.
+ */
+import { ABI_GENERATION, DEFAULT_BASES, ENV_ALLOW_UNSIGNED_NAME, ENV_BASES_NAME, ENV_TRUSTED_KEYS_NAME, RELEASE_KEYS, SCHEMA_VERSION, SYSTEM_CACHE_DIRS, } from './constants.gen.js';
+/** The only base a 2.0.0-dev SDK fetches from (rule r6). */
+export const DEV_CHANNEL_BASE = 'https://registry-staging.wavehouse.dev/chtypes/v2-dev';
+/** The staging key's id (`sha256-first16hex` over `DEV_KEY_HEX`). */
+export const DEV_KEY_ID = '824345f9bcf8e5bf';
+/** The staging key, the only key a 2.0.0-dev SDK trusts: an ed25519 public key, raw 32 bytes as lowercase hex. */
+export const DEV_KEY_HEX = '5cd30c53c65a1ebc2d85836a41deb06661bb0ae7b658adb9eb116ec2db8e9b1c';
+/** The dev channel's cache directory name: the default root's last element and an explicit cache's subroot (rule r5). */
+export const DEV_CACHE_DIR = 'v2-dev';
+/** The `verified.json` schema the dev channel writes, and the only one it reads (rule r5). */
+export const DEV_RECORD_SCHEMA = 2;
+/** The abi a dev predicate must carry. */
+export const DEV_ABI_GENERATION = 2;
+/** What every lock, frozen or update request gets from a 2.0.0-dev SDK, before any network call (rule r6). */
+export const PINNING_REFUSED = '--lock, --frozen and --update are refused by a 2.0.0-dev SDK: a dev build is replaceable, ' +
+    'and a superseded one expires after 14 days, so nothing may pin one (spec/abi-v2/docs.md, rule r6)';
+/** What a 2.0.0-dev SDK speaks, and what every process speaks unless a test selected another contract. */
+const DEV_CHANNEL = {
+    name: DEV_CACHE_DIR,
+    abi: DEV_ABI_GENERATION,
+    recordSchema: DEV_RECORD_SCHEMA,
+    rootLeaf: DEV_CACHE_DIR,
+    subroot: DEV_CACHE_DIR,
+    systemDirs: [`/usr/local/share/chtypes/${DEV_CACHE_DIR}`, `/opt/chtypes/${DEV_CACHE_DIR}`],
+    bases: [DEV_CHANNEL_BASE],
+    keys: [{ keyid: DEV_KEY_ID, ed25519Hex: DEV_KEY_HEX }],
+    overridable: false,
+    pinnable: false,
+};
+/** The v1 contract the fetch-v1 conformance cases specify, from the generated constants. Only `useFetchV1ForTests` selects it. */
+const FETCH_V1_CHANNEL = {
+    name: 'v1',
+    abi: ABI_GENERATION,
+    recordSchema: SCHEMA_VERSION,
+    rootLeaf: 'v1',
+    subroot: '',
+    systemDirs: SYSTEM_CACHE_DIRS,
+    bases: DEFAULT_BASES,
+    keys: RELEASE_KEYS.map((k) => ({ keyid: k.keyid, ed25519Hex: k.ed25519Hex })),
+    overridable: true,
+    pinnable: true,
+};
+let current;
+/** The contract this process fetches under: the dev channel, unless a test selected another. */
+export function activeChannel() {
+    return current ?? DEV_CHANNEL;
+}
+/** The fetch contract this process speaks: `v2-dev` in every process but a test that selected another. */
+export function channelName() {
+    return activeChannel().name;
+}
+/** Whether this process is a vitest worker: the only place a test seam may run. */
+function inTestRunner() {
+    return process.env['VITEST'] === 'true' && process.env['VITEST_WORKER_ID'] !== undefined;
+}
+function testOnly(what) {
+    if (!inTestRunner()) {
+        throw new Error(`chtypes: ${what} is test-only; a 2.0.0-dev SDK has no override (spec/abi-v2/docs.md, rule r6)`);
+    }
+}
+function use(c) {
+    const prev = current;
+    current = c;
+    return () => {
+        current = prev;
+    };
+}
+/**
+ * Makes this TEST process speak the v1 fetch contract (`docs/guides/fetch-v1.md`):
+ * overrides, locks, schema-1 records and abi-1 predicates. The fetch-v1
+ * conformance cases and the v1-protocol tests run under it; every case names
+ * its own fixture registry and the test key. Returns the function that
+ * restores the previous contract; throws outside a vitest worker.
+ */
+export function useFetchV1ForTests() {
+    testOnly('useFetchV1ForTests');
+    return use(FETCH_V1_CHANNEL);
+}
+/**
+ * Makes this TEST process's dev channel honor the base, trust and unsigned
+ * overrides, so a test can reach a fixture registry signed with the test key;
+ * everything else stays the dev channel's (abi 2, schema-2 records, the
+ * v2-dev cache, no pinning). Returns the restore function; throws outside a
+ * vitest worker.
+ */
+export function allowOverridesForTests() {
+    testOnly('allowOverridesForTests');
+    return use({ ...DEV_CHANNEL, overridable: true });
+}
+/** Makes this TEST process speak the dev channel exactly as every other process does (undoing either function above). Returns the restore function. */
+export function useDevChannelForTests() {
+    testOnly('useDevChannelForTests');
+    return use(DEV_CHANNEL);
+}
+// ------------------------------------------------------------ the warnings
+const warned = new Set();
+let warnSink = (text) => {
+    process.stderr.write(text);
+};
+/** Prints, once per process per setting, that a dev SDK ignores it (rule r6: "a dev SDK says so, once and loudly"). */
+export function warnIgnored(setting) {
+    if (warned.has(setting))
+        return;
+    warned.add(setting);
+    warnSink(`chtypes: WARNING: ${setting} is set and IGNORED: this is a 2.0.0-dev SDK, which fetches only from ${DEV_CHANNEL_BASE} ` +
+        `and trusts only the staging key ${DEV_KEY_ID} (spec/abi-v2/docs.md, rule r6)\n`);
+}
+/** The settings warned about so far, sorted. */
+export function ignoredSettingsWarned() {
+    return [...warned].sort();
+}
+/** Test-only: sends the warnings to `sink` and forgets which were given, so a test sees exactly its own. Returns the restore function. */
+export function captureIgnoredForTests(sink) {
+    testOnly('captureIgnoredForTests');
+    const prevSink = warnSink;
+    const prevWarned = [...warned];
+    warnSink = sink;
+    warned.clear();
+    return () => {
+        warnSink = prevSink;
+        warned.clear();
+        for (const s of prevWarned)
+            warned.add(s);
+    };
+}
+function envSet(name, trim) {
+    const v = process.env[name];
+    return v !== undefined && (trim ? v.trim() : v) !== '';
+}
+/**
+ * Names, once each and loudly, every base, trust and unsigned override
+ * `options` or the environment sets, when the active contract has none (rule
+ * r6). Every seam entry point calls it first, so an ignored setting is named
+ * whatever the command does with the network.
+ */
+export function noteIgnoredOverrides(options) {
+    if (activeChannel().overridable)
+        return;
+    if (options.bases !== undefined && options.bases.length > 0)
+        warnIgnored('the bases option');
+    if (envSet(ENV_BASES_NAME, true))
+        warnIgnored(ENV_BASES_NAME);
+    if (options.trustedKeys !== undefined)
+        warnIgnored('the trustedKeys option');
+    if (envSet(ENV_TRUSTED_KEYS_NAME, true))
+        warnIgnored(ENV_TRUSTED_KEYS_NAME);
+    if (options.allowUnsigned === true)
+        warnIgnored('the allowUnsigned option');
+    if (envSet(ENV_ALLOW_UNSIGNED_NAME, false))
+        warnIgnored(ENV_ALLOW_UNSIGNED_NAME);
+}
+/** Whether an unsigned fetch was asked for and the active contract honors it. */
+export function allowUnsigned(options) {
+    return activeChannel().overridable && options.allowUnsigned === true;
+}
+// ------------------------------------------------------------ the pinning
+/** The pinning requests `options` makes, by name. */
+export function pinningRequested(options) {
+    const set = [];
+    if (options.frozen === true)
+        set.push('frozen');
+    if (options.lockWrite === true)
+        set.push('lock');
+    if (options.update === true)
+        set.push('update');
+    if (options.lockPath !== undefined && options.lockPath !== '')
+        set.push('a lock path');
+    if (options.lockAllPlatforms === true)
+        set.push('lock all platforms');
+    return set;
+}
+/** A lock, frozen or update request refused by a 2.0.0-dev SDK. It is the caller's misuse, never an artifact failure: the CLI exits with the usage status. */
+export class PinningRefusedError extends Error {
+    requested;
+    constructor(requested) {
+        super(`chtypes: ${PINNING_REFUSED} (requested: ${requested.join(', ')})`);
+        this.name = new.target.name;
+        this.requested = requested;
+    }
+}
+/** Throws `PinningRefusedError` when the active contract refuses the pinning `options` asks for: before anything else, the network above all (rule r6). */
+export function refusePinning(options) {
+    if (activeChannel().pinnable)
+        return;
+    const set = pinningRequested(options);
+    if (set.length > 0)
+        throw new PinningRefusedError(set);
+}
+//# sourceMappingURL=channel.js.map

package/dist/ocifetch/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/ocifetch/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AACxF,qEAAqE;AACrE,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C,kHAAkH;AAClH,MAAM,CAAC,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAC9F,yHAAyH;AACzH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AACtC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,8GAA8G;AAC9G,MAAM,CAAC,MAAM,eAAe,GAC1B,4FAA4F;IAC5F,mGAAmG,CAAC;AAyBtG,0GAA0G;AAC1G,MAAM,WAAW,GAAY;IAC3B,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,kBAAkB;IACvB,YAAY,EAAE,iBAAiB;IAC/B,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,aAAa;IACtB,UAAU,EAAE,CAAC,4BAA4B,aAAa,EAAE,EAAE,gBAAgB,aAAa,EAAE,CAAC;IAC1F,KAAK,EAAE,CAAC,gBAAgB,CAAC;IACzB,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IACtD,WAAW,EAAE,KAAK;IAClB,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF,kIAAkI;AAClI,MAAM,gBAAgB,GAAY;IAChC,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,cAAc;IACnB,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE;IACX,UAAU,EAAE,iBAAiB;IAC7B,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,IAAI,OAA4B,CAAC;AAEjC,gGAAgG;AAChG,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,IAAI,WAAW,CAAC;AAChC,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,EAAE,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,+EAA+E,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,qBAAqB;IACnC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAE5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AACjC,IAAI,QAAQ,GAA2B,CAAC,IAAI,EAAE,EAAE;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,uHAAuH;AACvH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,QAAQ,CACN,qBAAqB,OAAO,yEAAyE,gBAAgB,GAAG;QACtH,mCAAmC,UAAU,mCAAmC,CACnF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IACjE,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/B,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,OAAO,GAAG,EAAE;QACV,QAAQ,GAAG,QAAQ,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,IAAa;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,IAAI,aAAa,EAAE,CAAC,WAAW;QAAE,OAAO;IACxC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC;QAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC;QAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI;QAAE,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC;QAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC;AACnF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,OAAO,aAAa,EAAE,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC;AACvE,CAAC;AAED,2EAA2E;AAE3E,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8JAA8J;AAC9J,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,SAAS,CAAoB;IAEtC,YAAY,SAA4B;QACtC,KAAK,CAAC,YAAY,eAAe,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,2JAA2J;AAC3J,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,aAAa,EAAE,CAAC,QAAQ;QAAE,OAAO;IACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/ocifetch/dsse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../src/ocifetch/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI5D;AAkCD,8FAA8F;AAC9F,wKAAwK;AACxK,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAiB/F;AAqDD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAarE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAmCzD;AAID,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAQ9F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,qBAAqB,EAAE,MAAM,EAC7B,mBAAmB,EAAE,MAAM,EAC3B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CA+BnB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAU5H;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0HAA0H;IAC1H,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,EAC5C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAkBlC"}
+{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../src/ocifetch/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI5D;AAkCD,8FAA8F;AAC9F,wKAAwK;AACxK,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAiB/F;AAqDD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAarE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAmCzD;AAID,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAQ9F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,qBAAqB,EAAE,MAAM,EAC7B,mBAAmB,EAAE,MAAM,EAC3B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAkCnB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAU5H;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0HAA0H;IAC1H,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,EAC5C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAkBlC"}

package/dist/ocifetch/dsse.js

@@ -17,7 +17,8 @@
  */
 import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
 import { items, parseJsonValue } from '../json.js';
-import { ABI_GENERATION, DSSE_MAX_SIGNATURES, DSSE_PAYLOAD_TYPE, SPELLING_REGEX } from './constants.gen.js';
+import { activeChannel } from './channel.js';
+import { DSSE_MAX_SIGNATURES, DSSE_PAYLOAD_TYPE, SPELLING_REGEX } from './constants.gen.js';
 import { ArtifactCorruptError } from './errors.js';
 import { fetchBlobBytesByDigest, fetchManifestByDigest } from './oci.js';
 import { discoverSignatureCandidates } from './referrers.js';
@@ -255,8 +256,11 @@ export function checkArtifactStatement(statement, expectedPredicateType, expecte
         throw new ArtifactCorruptError(`chtypes: statement subject digest does not match the manifest's own layer digest`);
     }
     const p = statement.predicate;
-    if (p['abi'] !== ABI_GENERATION) {
-        throw new ArtifactCorruptError(`chtypes: statement predicate.abi is ${JSON.stringify(p['abi'])}, not ${ABI_GENERATION}`);
+    // The active contract's generation: 2 on the ABI v2 dev channel (rule r6),
+    // so a 1.x build's abi-1 predicate is refused there.
+    const abi = activeChannel().abi;
+    if (p['abi'] !== abi) {
+        throw new ArtifactCorruptError(`chtypes: statement predicate.abi is ${JSON.stringify(p['abi'])}, not ${abi}`);
     }
     if (p['os'] !== check.os || p['arch'] !== check.arch) {
         throw new ArtifactCorruptError(`chtypes: statement predicate is for ${JSON.stringify(p['os'])}-${JSON.stringify(p['arch'])}, not ${check.os}-${check.arch}`);

package/dist/ocifetch/dsse.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/ocifetch/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,KAAK,EAAa,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAqB,MAAM,UAAU,CAAC;AAE5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,6EAA6E;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,IAAU;IACzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC9B,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,8FAA8F;AAC9F,wKAAwK;AACxK,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,WAAmB,EAAE,OAAe;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,SAAS;QACT,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,OAAe,EAAE,SAAiB;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;YACtE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAI,MAAkC,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpH,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAiD,EAAE,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,MAAM,GAAI,GAA+B,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,KAAK,GAAI,GAA+B,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACzC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmB,EACnB,WAAkC;IAElC,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAAC,0DAA0D,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,CAAC,CAAC;QACzH,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;QACtH,MAAM,MAAM,GAAI,MAAkC,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,IAAI;QACX,aAAa;QACb,SAAS,EAAE,SAAoC;QAC/C,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE,iBAAyB;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAoB,EACpB,qBAA6B,EAC7B,mBAA2B,EAC3B,KAA6B;IAE7B,IAAI,SAAS,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;IAC9B,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,oBAAoB,CAC5B,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAC7H,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACjK,MAAM,IAAI,oBAAoB,CAC5B,mDAAmD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,CAAiC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,qBAA6B,EAAE,mBAA2B;IACpH,IAAI,SAAS,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,wFAAwF,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,aAAqB,EACrB,kBAA0B,EAC1B,WAAkC,EAClC,YAA4C,EAC5C,OAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,WAAmB,CAAC;QACxB,IAAI,gBAA8B,CAAC;QACnC,IAAI,CAAC;YACH,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5F,WAAW,GAAG,MAAM,sBAAsB,CAAC,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC;IAChJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/ocifetch/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,KAAK,EAAa,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAqB,MAAM,UAAU,CAAC;AAE5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,6EAA6E;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,IAAU;IACzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC9B,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,8FAA8F;AAC9F,wKAAwK;AACxK,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,WAAmB,EAAE,OAAe;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,SAAS;QACT,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,OAAe,EAAE,SAAiB;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,SAA6C,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;YACtE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAI,MAAkC,CAAC,cAAc,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpH,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAiD,EAAE,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,MAAM,GAAI,GAA+B,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,KAAK,GAAI,GAA+B,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACzC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmB,EACnB,WAAkC;IAElC,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAAC,0DAA0D,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,CAAC,CAAC;QACzH,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;QACtH,MAAM,MAAM,GAAI,MAAkC,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,IAAI;QACX,aAAa;QACb,SAAS,EAAE,SAAoC;QAC/C,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE,iBAAyB;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAoB,EACpB,qBAA6B,EAC7B,mBAA2B,EAC3B,KAA6B;IAE7B,IAAI,SAAS,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;IAC9B,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC,GAAG,CAAC;IAChC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,oBAAoB,CAC5B,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAC7H,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACjK,MAAM,IAAI,oBAAoB,CAC5B,mDAAmD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,CAAiC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,qBAA6B,EAAE,mBAA2B;IACpH,IAAI,SAAS,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,wFAAwF,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,aAAqB,EACrB,kBAA0B,EAC1B,WAAkC,EAClC,YAA4C,EAC5C,OAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,WAAmB,CAAC;QACxB,IAAI,gBAA8B,CAAC;QACnC,IAAI,CAAC;YACH,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5F,WAAW,GAAG,MAAM,sBAAsB,CAAC,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC;IAChJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/ocifetch/ensure.d.ts

@@ -5,7 +5,18 @@
  * cache (`layout.ts`) and the lock (`lock.ts`) together; nothing outside
  * `index.ts` calls into those modules directly.
  */
-import type { FetchV1Options, PlatformKey, Resolved, VerifyResult } from './types.js';
+import type { FetchV1Options, PlatformKey, Resolved, TrustedKey, VerifyResult } from './types.js';
+/**
+ * The bases, the trust list and the unsigned decision a call with `options`
+ * reads under the active contract: exactly what `ensure`, `fetchSigned` and
+ * `listTags` use. Not part of the package's entry point; the dev channel's
+ * rule r6 tests read it, so they test the derivation rather than restate it.
+ */
+export declare function effectiveFetchOptions(options: FetchV1Options): {
+    readonly bases: readonly string[];
+    readonly trustedKeys: readonly TrustedKey[];
+    readonly allowUnsigned: boolean;
+};
 /**
  * Never touches the network (guide §9). The source of truth is the
  * immutable `unpacked/sha256/*\/verified.json` records (guide §6) — never
@@ -44,7 +55,10 @@ export declare function verifyInstalled(options?: FetchV1Options): Promise<reado
 /**
  * `ensure(request, options)`: resolve unless `frozen` or `offline`, verify
  * trust, download and unpack bytes, install into the cache, optionally write
- * a lock entry. See `docs/guides/fetch-v1.md` §9 for the full contract.
+ * a lock entry. See `docs/guides/fetch-v1.md` §9 for the full contract. On the
+ * dev channel (`./channel.ts`) every pinning option is refused first, before
+ * any request, and every base, trust or unsigned override is ignored with one
+ * warning (spec/abi-v2/docs.md, rule r6).
  */
 export declare function ensure(request: string, options?: FetchV1Options): Promise<Resolved>;
 export interface FetchSignedResult {
@@ -72,7 +86,7 @@ export interface FetchSignedResult {
  * goldens set is a second goldens referrer of it, and the result is the
  * highest-`revision` verified one (`goldens.ts`, guide §9).
  */
-export declare function fetchSigned(repository: string, ref: string, predicateType: string, options?: FetchV1Options): Promise<FetchSignedResult>;
+export declare function fetchSigned(callerRepository: string, ref: string, predicateType: string, options?: FetchV1Options): Promise<FetchSignedResult>;
 /**
  * The version spellings a repository publishes: `GET tags/list` from the first
  * base that has the repository, every tag that is not a version spelling

package/dist/ocifetch/ensure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../src/ocifetch/ensure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2DH,OAAO,KAAK,EAAqB,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAc,YAAY,EAAE,MAAM,YAAY,CAAC;AA6ErH;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA4B/B;AAkBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO3F;AAED,uLAAuL;AACvL,wBAAsB,UAAU,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKzF;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE3E;AAoCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AA0DD,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAU9F;AAID,mGAAmG;AACnG,wBAAsB,eAAe,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAepG;AAID;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ7F;AAkaD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AA4HD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA2CvF"}
+{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../src/ocifetch/ensure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyDH,OAAO,KAAK,EAAqB,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyBrH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC,CAEA;AA2DD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6B/B;AAkBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAO3F;AAED,uLAAuL;AACvL,wBAAsB,UAAU,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAKzF;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE3E;AAoCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AA0DD,wBAAsB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAW9F;AAID,mGAAmG;AACnG,wBAAsB,eAAe,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAgBpG;AAID;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU7F;AAoaD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAiC5B;AA0ID;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA4CvF"}

package/dist/ocifetch/ensure.js

@@ -10,7 +10,8 @@ import { unlink } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { asString, field, items, parseJsonValue } from '../json.js';
-import { ABI_GENERATION, BASE_SEPARATOR, CACHE_ANNOTATION_PREFIX, DEFAULT_BASES, ENV_BASES_NAME, GOLDENS_ARTIFACT_TYPE, MEDIA_TYPE_BUNDLE, MEDIA_TYPE_MANIFEST, PREDICATE_TYPE_ARTIFACT, PREDICATE_TYPE_GOLDENS, RELEASE_KEYS, SPELLING_REGEX, TAGS_LIST_MAX_BYTES, } from './constants.gen.js';
+import { activeChannel, allowUnsigned, noteIgnoredOverrides, refusePinning, warnIgnored } from './channel.js';
+import { BASE_SEPARATOR, CACHE_ANNOTATION_PREFIX, ENV_BASES_NAME, GOLDENS_ARTIFACT_TYPE, MEDIA_TYPE_BUNDLE, MEDIA_TYPE_MANIFEST, PREDICATE_TYPE_ARTIFACT, PREDICATE_TYPE_GOLDENS, SPELLING_REGEX, TAGS_LIST_MAX_BYTES, } from './constants.gen.js';
 import { checkArtifactStatement, checkGenericStatement, parseStatement, verifyAnyReferrerBundle, verifyBundleSignature } from './dsse.js';
 import { ArtifactCorruptError, ArtifactMissingError, ArtifactPinnedError, ArtifactUnpublishedError, ArtifactUntrustedError, FetchV1Error, SourceUnreachableError, } from './errors.js';
 import { readFileUrl, requestBuffered } from './http.js';
@@ -23,12 +24,18 @@ import { fetchBlobBytesByDigest, fetchManifestByDigest, resolveTag } from './oci
 import { emptyLock, getPin, readLock, withPin, writeLock } from './lock.js';
 import { digestOfHex, endpointUrl, hexOfDigest, platformInfo, realClock, resolvePlatformOption } from './types.js';
 import { fetchVerifyAndUnpackLayer, measureLibrary, verifyInstalledLibrary } from './unpack.js';
+/** The trust list: the caller's when the active contract honors one, else the contract's own (the staging key alone on the dev channel, rule r6). */
 function defaultTrustedKeys(options) {
-    if (options.trustedKeys !== undefined)
+    const channel = activeChannel();
+    if (channel.overridable && options.trustedKeys !== undefined)
         return options.trustedKeys;
-    return RELEASE_KEYS.map((k) => ({ keyid: k.keyid, ed25519Hex: k.ed25519Hex }));
+    return channel.keys;
 }
+/** The bases: the caller's or `CHTYPES_ARTIFACTS_URL` when the active contract honors them, else the contract's own (the staging dev channel alone, rule r6). */
 function resolveBases(options) {
+    const channel = activeChannel();
+    if (!channel.overridable)
+        return channel.bases;
     if (options.bases !== undefined && options.bases.length > 0)
         return options.bases;
     const env = process.env[ENV_BASES_NAME];
@@ -38,7 +45,16 @@ function resolveBases(options) {
             .map((b) => b.trim())
             .filter((b) => b !== '');
     }
-    return DEFAULT_BASES;
+    return channel.bases;
+}
+/**
+ * The bases, the trust list and the unsigned decision a call with `options`
+ * reads under the active contract: exactly what `ensure`, `fetchSigned` and
+ * `listTags` use. Not part of the package's entry point; the dev channel's
+ * rule r6 tests read it, so they test the derivation rather than restate it.
+ */
+export function effectiveFetchOptions(options) {
+    return { bases: resolveBases(options), trustedKeys: defaultTrustedKeys(options), allowUnsigned: allowUnsigned(options) };
 }
 function tokenHostsFor(bases) {
     const hosts = [];
@@ -64,7 +80,7 @@ function requestOptionsFor(options, bases) {
 /** Builds the `Resolved` the seam promises, from a `verified.json` record plus where it came from. */
 function resolvedFromRecord(record, platform, request, dir, source, alreadyInstalled, warnings) {
     return {
-        abiGeneration: ABI_GENERATION,
+        abiGeneration: activeChannel().abi,
         platform,
         request,
         version: record.version,
@@ -99,6 +115,7 @@ function resolvedFromRecord(record, platform, request, dir, source, alreadyInsta
  * `clickhouse_version` lies within `request`.
  */
 export async function resolveInstalled(request, platform, options = {}) {
+    noteIgnoredOverrides(options);
     const root = cacheRoot(options.cacheDir);
     const warnings = await probeRoots(searchRoots(options).map((r) => r.root), strictMode(options.strictCache));
     const trustedKeys = defaultTrustedKeys(options);
@@ -262,6 +279,7 @@ async function checkMonotonic(root, platform, request, incoming) {
 }
 // ------------------------------------------------------------------ listInstalled
 export async function listInstalled(options = {}) {
+    noteIgnoredOverrides(options);
     const warnings = await probeCache(options);
     const out = [];
     for (const r of searchRoots(options)) {
@@ -275,6 +293,7 @@ export async function listInstalled(options = {}) {
 // ----------------------------------------------------------------- verifyInstalled
 /** Re-checks every installed library's bytes against its own `verified.json` record (guide §9). */
 export async function verifyInstalled(options = {}) {
+    noteIgnoredOverrides(options);
     await probeCache(options);
     const out = [];
     for (const r of searchRoots(options)) {
@@ -295,9 +314,14 @@ export async function verifyInstalled(options = {}) {
 /**
  * `ensure(request, options)`: resolve unless `frozen` or `offline`, verify
  * trust, download and unpack bytes, install into the cache, optionally write
- * a lock entry. See `docs/guides/fetch-v1.md` §9 for the full contract.
+ * a lock entry. See `docs/guides/fetch-v1.md` §9 for the full contract. On the
+ * dev channel (`./channel.ts`) every pinning option is refused first, before
+ * any request, and every base, trust or unsigned override is ignored with one
+ * warning (spec/abi-v2/docs.md, rule r6).
  */
 export async function ensure(request, options = {}) {
+    refusePinning(options);
+    noteIgnoredOverrides(options);
     try {
         return await ensureIn(request, options);
     }
@@ -364,8 +388,10 @@ async function ensureIn(request, options) {
         let predicate;
         let signedBy;
         if (trust === undefined) {
-            if (options.allowUnsigned !== true) {
-                throw new ArtifactUntrustedError(`chtypes: no referrer of ${resolveResult.manifest.digest} verified under a trusted key (CHTYPES_ALLOW_UNSIGNED=1 to proceed anyway)`);
+            if (!allowUnsigned(options)) {
+                throw new ArtifactUntrustedError(activeChannel().overridable
+                    ? `chtypes: no referrer of ${resolveResult.manifest.digest} verified under a trusted key (CHTYPES_ALLOW_UNSIGNED=1 to proceed anyway)`
+                    : `chtypes: no referrer of ${resolveResult.manifest.digest} verified under the staging key ${activeChannel().keys.map((k) => k.keyid).join(', ')}`);
             }
             predicate = await unsignedPredicateFallback(resolveResult.repositoryRoot, resolveResult.manifest, request, info, baseReqOptions);
             signedBy = '';
@@ -452,7 +478,7 @@ async function ensureIn(request, options) {
 async function unsignedPredicateFallback(repositoryRoot, manifest, request, info, baseReqOptions) {
     const fallbackLibrary = info.os === 'darwin' ? 'libchtypes.dylib' : 'libchtypes.so';
     const fallback = {
-        abi: ABI_GENERATION,
+        abi: activeChannel().abi,
         abi_fingerprint: '',
         clickhouse_version: request,
         channel: '',
@@ -522,7 +548,7 @@ async function ensureFrozen(request, platform, options) {
     let signedBy;
     let warnings = [];
     if (verified === undefined) {
-        if (options.allowUnsigned !== true) {
+        if (!allowUnsigned(options)) {
             throw new ArtifactUntrustedError(`chtypes: the locked bundle ${pin.bundle} does not verify under a trusted key`);
         }
         predicate = await unsignedPredicateFallback(bases[0], manifest, request, info, baseReqOptions);
@@ -677,18 +703,20 @@ function isLikelyPlatformKey(key) {
  * goldens set is a second goldens referrer of it, and the result is the
  * highest-`revision` verified one (`goldens.ts`, guide §9).
  */
-export async function fetchSigned(repository, ref, predicateType, options = {}) {
+export async function fetchSigned(callerRepository, ref, predicateType, options = {}) {
+    noteIgnoredOverrides(options);
+    const repository = channelRepository(callerRepository);
     const root = cacheRoot(options.cacheDir);
     await ensureLayout(root);
     const baseReqOptions = requestOptionsFor(options, [repository]);
     const trustedKeys = defaultTrustedKeys(options);
     if (predicateType === PREDICATE_TYPE_GOLDENS) {
-        return fetchGoldens(repository, ref, root, trustedKeys, options.allowUnsigned === true, { ...baseReqOptions, maxBytes: 0 });
+        return fetchGoldens(repository, ref, root, trustedKeys, allowUnsigned(options), { ...baseReqOptions, maxBytes: 0 });
     }
     const manifest = await fetchManifestByDigest([repository], ref, { ...baseReqOptions, maxBytes: 0 });
     const layerBytes = await fetchBlobBytesByDigest([repository], manifest.layer, { ...baseReqOptions, maxBytes: 0 });
     const trust = await verifyAnyReferrerBundle(repository, manifest.digest, MEDIA_TYPE_BUNDLE, trustedKeys, (statement) => checkGenericStatement(statement, predicateType, manifest.layer.digest), { ...baseReqOptions, maxBytes: 0 });
-    if (trust === undefined && options.allowUnsigned !== true) {
+    if (trust === undefined && !allowUnsigned(options)) {
         throw new ArtifactUntrustedError(`chtypes: no referrer of ${manifest.digest} verified under a trusted key`);
     }
     const dest = await installBlob(root, hexOfDigest(manifest.layer.digest), layerBytes);
@@ -698,6 +726,21 @@ export async function fetchSigned(repository, ref, predicateType, options = {})
         digests: { manifest: manifest.digest, layer: manifest.layer.digest },
     };
 }
+/**
+ * The repository `fetchSigned` reads: the caller's when the active contract
+ * honors a base, else the contract's own, with one warning when the caller
+ * named another (the dev channel's goldens are its own release's referrers,
+ * signed with the staging key; rule r6).
+ */
+function channelRepository(callerRepository) {
+    const channel = activeChannel();
+    if (channel.overridable)
+        return callerRepository;
+    const own = channel.bases[0];
+    if (callerRepository !== '' && callerRepository !== own)
+        warnIgnored("fetchSigned's repository argument");
+    return own;
+}
 /**
  * `fetchSigned` for the goldens predicate type: the highest-revision verified
  * goldens referrer of the platform manifest `subject`.
@@ -825,6 +868,7 @@ function compareSpellings(a, b) {
  * resolve reads. A next page is followed through the `Link` header.
  */
 export async function listTags(options = {}) {
+    noteIgnoredOverrides(options);
     const bases = resolveBases(options);
     const reqOptions = { ...requestOptionsFor(options, bases), maxBytes: TAGS_LIST_MAX_BYTES };
     const spelling = new RegExp(SPELLING_REGEX);