@xemahq/contracts 0.74.0 → 0.76.0

package/dist/distribution/lib/image-producer-evidence.d.ts

@@ -7,7 +7,7 @@ export declare const InTotoSubjectSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const ImageProducerPlatformSchema: z.ZodObject<{
-    manifestDigest: z.ZodString;
+    manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     os: z.ZodString;
     architecture: z.ZodString;
     variant: z.ZodOptional<z.ZodString>;
@@ -19,17 +19,17 @@ export declare const ImageProducerSourceSchema: z.ZodObject<{
     repo: z.ZodString;
     path: z.ZodString;
     sourceCommit: z.ZodString;
-    sourceManifestHash: z.ZodString;
+    sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
     sourceHashAlgorithm: z.ZodUnion<readonly [z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV1>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV2>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV3>]>;
     sourceTreeHash: z.ZodString;
 }, z.core.$strict>;
 export declare const ImageProducerBuildSchema: z.ZodObject<{
     builderId: z.ZodString;
     buildType: z.ZodString;
-    buildDefinitionDigest: z.ZodString;
-    parametersDigest: z.ZodString;
+    buildDefinitionDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+    parametersDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
-        manifestDigest: z.ZodString;
+        manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         os: z.ZodString;
         architecture: z.ZodString;
         variant: z.ZodOptional<z.ZodString>;
@@ -37,15 +37,15 @@ export declare const ImageProducerBuildSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const ImageProducerArtifactSchema: z.ZodObject<{
     imageRepository: z.ZodString;
-    manifestDigest: z.ZodString;
+    manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     manifestMediaType: z.ZodString;
     sbom: z.ZodObject<{
         predicateType: z.ZodLiteral<"https://spdx.dev/Document">;
-        digest: z.ZodString;
+        digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     }, z.core.$strict>;
     provenance: z.ZodObject<{
         predicateType: z.ZodLiteral<"https://slsa.dev/provenance/v1">;
-        digest: z.ZodString;
+        digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const ImageProducerRunSchema: z.ZodObject<{
@@ -63,7 +63,7 @@ export declare const ImageProducerPredicateSchema: z.ZodObject<{
         generatorIdentity: z.ZodLiteral<"xema-distributions/build-runtime-image-source-index.mjs@v1">;
         repositoryUrl: z.ZodLiteral<"https://github.com/xema-dev/xema-kernel-contracts.git">;
         sourceCommit: z.ZodString;
-        sourcePaths: z.ZodReadonly<z.ZodTuple<[z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/index.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts">], null>>;
+        sourcePaths: z.ZodReadonly<z.ZodArray<z.ZodString>>;
         contentHashAlgorithm: z.ZodLiteral<import("./kernel-contract-authority").KernelContractContentHashAlgorithm>;
         contentDigest: z.ZodString;
     }, z.core.$strict>;
@@ -74,17 +74,17 @@ export declare const ImageProducerPredicateSchema: z.ZodObject<{
         repo: z.ZodString;
         path: z.ZodString;
         sourceCommit: z.ZodString;
-        sourceManifestHash: z.ZodString;
+        sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
         sourceHashAlgorithm: z.ZodUnion<readonly [z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV1>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV2>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV3>]>;
         sourceTreeHash: z.ZodString;
     }, z.core.$strict>;
     build: z.ZodObject<{
         builderId: z.ZodString;
         buildType: z.ZodString;
-        buildDefinitionDigest: z.ZodString;
-        parametersDigest: z.ZodString;
+        buildDefinitionDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        parametersDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
-            manifestDigest: z.ZodString;
+            manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             os: z.ZodString;
             architecture: z.ZodString;
             variant: z.ZodOptional<z.ZodString>;
@@ -92,15 +92,15 @@ export declare const ImageProducerPredicateSchema: z.ZodObject<{
     }, z.core.$strict>;
     artifact: z.ZodObject<{
         imageRepository: z.ZodString;
-        manifestDigest: z.ZodString;
+        manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         manifestMediaType: z.ZodString;
         sbom: z.ZodObject<{
             predicateType: z.ZodLiteral<"https://spdx.dev/Document">;
-            digest: z.ZodString;
+            digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         }, z.core.$strict>;
         provenance: z.ZodObject<{
             predicateType: z.ZodLiteral<"https://slsa.dev/provenance/v1">;
-            digest: z.ZodString;
+            digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         }, z.core.$strict>;
     }, z.core.$strict>;
     producerRun: z.ZodObject<{
@@ -129,7 +129,7 @@ export declare const ImageProducerStatementSchema: z.ZodObject<{
             generatorIdentity: z.ZodLiteral<"xema-distributions/build-runtime-image-source-index.mjs@v1">;
             repositoryUrl: z.ZodLiteral<"https://github.com/xema-dev/xema-kernel-contracts.git">;
             sourceCommit: z.ZodString;
-            sourcePaths: z.ZodReadonly<z.ZodTuple<[z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/index.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts">], null>>;
+            sourcePaths: z.ZodReadonly<z.ZodArray<z.ZodString>>;
             contentHashAlgorithm: z.ZodLiteral<import("./kernel-contract-authority").KernelContractContentHashAlgorithm>;
             contentDigest: z.ZodString;
         }, z.core.$strict>;
@@ -140,17 +140,17 @@ export declare const ImageProducerStatementSchema: z.ZodObject<{
             repo: z.ZodString;
             path: z.ZodString;
             sourceCommit: z.ZodString;
-            sourceManifestHash: z.ZodString;
+            sourceManifestHash: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").BiomeSourceManifestHash, string>>;
             sourceHashAlgorithm: z.ZodUnion<readonly [z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV1>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV2>, z.ZodLiteral<ImageSourceHashAlgorithm.ImageInputV3>]>;
             sourceTreeHash: z.ZodString;
         }, z.core.$strict>;
         build: z.ZodObject<{
             builderId: z.ZodString;
             buildType: z.ZodString;
-            buildDefinitionDigest: z.ZodString;
-            parametersDigest: z.ZodString;
+            buildDefinitionDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+            parametersDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             platforms: z.ZodReadonly<z.ZodArray<z.ZodObject<{
-                manifestDigest: z.ZodString;
+                manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
                 os: z.ZodString;
                 architecture: z.ZodString;
                 variant: z.ZodOptional<z.ZodString>;
@@ -158,15 +158,15 @@ export declare const ImageProducerStatementSchema: z.ZodObject<{
         }, z.core.$strict>;
         artifact: z.ZodObject<{
             imageRepository: z.ZodString;
-            manifestDigest: z.ZodString;
+            manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             manifestMediaType: z.ZodString;
             sbom: z.ZodObject<{
                 predicateType: z.ZodLiteral<"https://spdx.dev/Document">;
-                digest: z.ZodString;
+                digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             }, z.core.$strict>;
             provenance: z.ZodObject<{
                 predicateType: z.ZodLiteral<"https://slsa.dev/provenance/v1">;
-                digest: z.ZodString;
+                digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             }, z.core.$strict>;
         }, z.core.$strict>;
         producerRun: z.ZodObject<{
@@ -185,7 +185,7 @@ export declare const DistributionImagesPredicateSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     distributionId: z.ZodString;
     distributionInputHash: z.ZodString;
-    normalizedImageLockDigest: z.ZodString;
+    normalizedImageLockDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     releaseSequence: z.ZodNumber;
     releaseSourceCommit: z.ZodString;
     runId: z.ZodString;
@@ -197,9 +197,9 @@ export declare const DistributionImagesPredicateSchema: z.ZodObject<{
         subjectKind: z.ZodEnum<typeof RuntimeImageSubjectKind>;
         subjectId: z.ZodString;
         imageRepository: z.ZodString;
-        manifestDigest: z.ZodString;
-        producerStatementDigest: z.ZodString;
-        producerBundleDigest: z.ZodString;
+        manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        producerStatementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+        producerBundleDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const DistributionImagesStatementSchema: z.ZodObject<{
@@ -215,7 +215,7 @@ export declare const DistributionImagesStatementSchema: z.ZodObject<{
         schemaVersion: z.ZodLiteral<1>;
         distributionId: z.ZodString;
         distributionInputHash: z.ZodString;
-        normalizedImageLockDigest: z.ZodString;
+        normalizedImageLockDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         releaseSequence: z.ZodNumber;
         releaseSourceCommit: z.ZodString;
         runId: z.ZodString;
@@ -227,9 +227,9 @@ export declare const DistributionImagesStatementSchema: z.ZodObject<{
             subjectKind: z.ZodEnum<typeof RuntimeImageSubjectKind>;
             subjectId: z.ZodString;
             imageRepository: z.ZodString;
-            manifestDigest: z.ZodString;
-            producerStatementDigest: z.ZodString;
-            producerBundleDigest: z.ZodString;
+            manifestDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+            producerStatementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
+            producerBundleDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
@@ -244,7 +244,7 @@ export declare const ImageDeliveryEntitlementPredicateSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     customerId: z.ZodString;
     distributionId: z.ZodString;
-    distributionStatementDigest: z.ZodString;
+    distributionStatementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     mode: z.ZodEnum<typeof ImageDeliveryMode>;
     targetRegistry: z.ZodNullable<z.ZodString>;
     nonce: z.ZodString;
@@ -265,7 +265,7 @@ export declare const ImageDeliveryEntitlementStatementSchema: z.ZodObject<{
         schemaVersion: z.ZodLiteral<1>;
         customerId: z.ZodString;
         distributionId: z.ZodString;
-        distributionStatementDigest: z.ZodString;
+        distributionStatementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         mode: z.ZodEnum<typeof ImageDeliveryMode>;
         targetRegistry: z.ZodNullable<z.ZodString>;
         nonce: z.ZodString;
@@ -277,9 +277,9 @@ export declare const ImageDeliveryEntitlementStatementSchema: z.ZodObject<{
 export type ImageDeliveryEntitlementStatement = z.infer<typeof ImageDeliveryEntitlementStatementSchema>;
 export declare const SigstoreEvidenceDescriptorSchema: z.ZodObject<{
     statementPath: z.ZodString;
-    statementDigest: z.ZodString;
+    statementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     bundlePath: z.ZodString;
-    bundleDigest: z.ZodString;
+    bundleDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     bundleMediaType: z.ZodLiteral<"application/vnd.dev.sigstore.bundle.v0.3+json">;
 }, z.core.$strict>;
 export declare const DistributionImageEvidenceSetSchema: z.ZodObject<{
@@ -290,83 +290,97 @@ export declare const DistributionImageEvidenceSetSchema: z.ZodObject<{
         subjectId: z.ZodString;
         evidence: z.ZodObject<{
             statementPath: z.ZodString;
-            statementDigest: z.ZodString;
+            statementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             bundlePath: z.ZodString;
-            bundleDigest: z.ZodString;
+            bundleDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
             bundleMediaType: z.ZodLiteral<"application/vnd.dev.sigstore.bundle.v0.3+json">;
         }, z.core.$strict>;
     }, z.core.$strict>>>;
     completeness: z.ZodObject<{
         statementPath: z.ZodString;
-        statementDigest: z.ZodString;
+        statementDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         bundlePath: z.ZodString;
-        bundleDigest: z.ZodString;
+        bundleDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
         bundleMediaType: z.ZodLiteral<"application/vnd.dev.sigstore.bundle.v0.3+json">;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type DistributionImageEvidenceSet = z.infer<typeof DistributionImageEvidenceSetSchema>;
+export declare const EVIDENCE_CHANNELS: readonly ["release", "develop"];
+export type EvidenceChannel = (typeof EVIDENCE_CHANNELS)[number];
+export declare const EVIDENCE_CHANNEL_REFS: {
+    readonly release: "refs/heads/main";
+    readonly develop: "refs/heads/develop";
+};
 export declare const SigstoreIdentityPolicySchema: z.ZodObject<{
     policyId: z.ZodString;
+    channel: z.ZodEnum<{
+        release: "release";
+        develop: "develop";
+    }>;
     predicateTypes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
     certificateIdentity: z.ZodString;
     oidcIssuer: z.ZodString;
-    githubWorkflow: z.ZodOptional<z.ZodObject<{
+    githubWorkflow: z.ZodObject<{
         repository: z.ZodString;
         ref: z.ZodString;
         path: z.ZodString;
-    }, z.core.$strict>>;
+    }, z.core.$strict>;
     imageProducer: z.ZodOptional<z.ZodObject<{
         builderIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
         buildTypes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-        buildDefinitionDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-        parametersDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        buildDefinitionDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>>;
+        parametersDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>>;
         manifestMediaTypes: z.ZodReadonly<z.ZodArray<z.ZodEnum<{
             "application/vnd.oci.image.index.v1+json": "application/vnd.oci.image.index.v1+json";
             "application/vnd.oci.image.manifest.v1+json": "application/vnd.oci.image.manifest.v1+json";
         }>>>;
     }, z.core.$strict>>;
-    allowedImageRepositoryPrefixes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    imageRepositories: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
 }, z.core.$strict>;
 export declare const SigstoreOfflineTrustPolicySchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     trustedRootPath: z.ZodString;
-    trustedRootDigest: z.ZodString;
+    trustedRootDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     cosignVersion: z.ZodString;
-    trustedCosignBinaryDigests: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    trustedCosignBinaryDigests: z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>;
     gitVersion: z.ZodString;
-    trustedGitBinaryDigests: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    trustedGitBinaryDigests: z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>;
     maxProducerTtlSeconds: z.ZodNumber;
     maxCompletenessTtlSeconds: z.ZodNumber;
     maxEntitlementTtlSeconds: z.ZodNumber;
     policies: z.ZodReadonly<z.ZodArray<z.ZodObject<{
         policyId: z.ZodString;
+        channel: z.ZodEnum<{
+            release: "release";
+            develop: "develop";
+        }>;
         predicateTypes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
         certificateIdentity: z.ZodString;
         oidcIssuer: z.ZodString;
-        githubWorkflow: z.ZodOptional<z.ZodObject<{
+        githubWorkflow: z.ZodObject<{
             repository: z.ZodString;
             ref: z.ZodString;
             path: z.ZodString;
-        }, z.core.$strict>>;
+        }, z.core.$strict>;
         imageProducer: z.ZodOptional<z.ZodObject<{
             builderIds: z.ZodReadonly<z.ZodArray<z.ZodString>>;
             buildTypes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-            buildDefinitionDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-            parametersDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            buildDefinitionDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>>;
+            parametersDigests: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>>>;
             manifestMediaTypes: z.ZodReadonly<z.ZodArray<z.ZodEnum<{
                 "application/vnd.oci.image.index.v1+json": "application/vnd.oci.image.index.v1+json";
                 "application/vnd.oci.image.manifest.v1+json": "application/vnd.oci.image.manifest.v1+json";
             }>>>;
         }, z.core.$strict>>;
-        allowedImageRepositoryPrefixes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        imageRepositories: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const DistributionImageReplayStateSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     distributionId: z.ZodString;
-    trustPolicyDigest: z.ZodString;
+    trustPolicyDigest: z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>;
     lastReleaseSequence: z.ZodNumber;
-    lastCompletenessStatementDigest: z.ZodNullable<z.ZodString>;
+    lastCompletenessStatementDigest: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<import("./kernel-contract-authority").OciDigest, string>>>;
     lastCompletenessNonce: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
 export type DistributionImageReplayState = z.infer<typeof DistributionImageReplayStateSchema>;

package/dist/distribution/lib/image-producer-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-producer-evidence.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/image-producer-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EAExB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AA0BtB,eAAO,MAAM,mBAAmB;;;;;kBASrB,CAAC;AAEZ,eAAO,MAAM,2BAA2B;;;;;kBAK7B,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;kBA8B3B,CAAC;AAEZ,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAQ1B,CAAC;AAEZ,eAAO,MAAM,2BAA2B;;;;;;;;;;;;kBAkB7B,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;kBASxB,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B,EACxC,+CAAwD,CAAC;AAE3D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAO9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAC7C,sDAA+D,CAAC;AAElE,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;kBA6BnC,CAAC;AAEZ,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AAEZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAEF,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAsCD,eAAO,MAAM,yCAAyC,EACpD,6DAAsE,CAAC;AAEzE,eAAO,MAAM,uCAAuC;;;;;;;;;;;kBAmChD,CAAC;AAEL,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;kBAOzC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;kBAQlC,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;kBA0D3C,CAAC;AAEL,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;kBAgHrC,CAAC;AAEL,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6BzC,CAAC;AAEL,eAAO,MAAM,kCAAkC;;;;;;;kBA0B3C,CAAC;AAEL,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAkBF,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,sBAAsB,CAMxB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,OAAO,GACX,2BAA2B,CAM7B;AAED,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,OAAO,GACX,iCAAiC,CAMnC;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,0BAA0B,CAM5B;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAM9B;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAM9B"}
+{"version":3,"file":"image-producer-evidence.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/image-producer-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EAExB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AA6BtB,eAAO,MAAM,mBAAmB;;;;;kBASrB,CAAC;AAEZ,eAAO,MAAM,2BAA2B;;;;;kBAK7B,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;kBA8B3B,CAAC;AAEZ,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAQ1B,CAAC;AAEZ,eAAO,MAAM,2BAA2B;;;;;;;;;;;;kBAkB7B,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;kBASxB,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B,EACxC,+CAAwD,CAAC;AAE3D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAO9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,kCAAkC,EAC7C,sDAA+D,CAAC;AAElE,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;kBA6BnC,CAAC;AAEZ,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AAEZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAEF,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAsCD,eAAO,MAAM,yCAAyC,EACpD,6DAAsE,CAAC;AAEzE,eAAO,MAAM,uCAAuC;;;;;;;;;;;kBAmChD,CAAC;AAEL,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;kBAOzC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;kBAQlC,CAAC;AAEZ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;kBA0D3C,CAAC;AAEL,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,iBAAiB,iCAAkC,CAAC;AAEjE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;CAGkB,CAAC;AAErD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;kBA8HrC,CAAC;AAEL,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6BzC,CAAC;AAEL,eAAO,MAAM,kCAAkC;;;;;;;kBA0B3C,CAAC;AAEL,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAkBF,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,sBAAsB,CAMxB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,OAAO,GACX,2BAA2B,CAM7B;AAED,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,OAAO,GACX,iCAAiC,CAMnC;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,0BAA0B,CAM5B;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAM9B;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAM9B"}

package/dist/distribution/lib/image-producer-evidence.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DistributionImageReplayStateSchema = exports.SigstoreOfflineTrustPolicySchema = exports.SigstoreIdentityPolicySchema = exports.DistributionImageEvidenceSetSchema = exports.SigstoreEvidenceDescriptorSchema = exports.ImageDeliveryEntitlementStatementSchema = exports.ImageDeliveryEntitlementPredicateSchema = exports.IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE = exports.ImageDeliveryMode = exports.DistributionImagesStatementSchema = exports.DistributionImagesPredicateSchema = exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE = exports.ImageProducerStatementSchema = exports.IMAGE_PRODUCER_PREDICATE_TYPE = exports.ImageProducerPredicateSchema = exports.ImageProducerRunSchema = exports.ImageProducerArtifactSchema = exports.ImageProducerBuildSchema = exports.ImageProducerSourceSchema = exports.ImageProducerPlatformSchema = exports.InTotoSubjectSchema = void 0;
+exports.DistributionImageReplayStateSchema = exports.SigstoreOfflineTrustPolicySchema = exports.SigstoreIdentityPolicySchema = exports.EVIDENCE_CHANNEL_REFS = exports.EVIDENCE_CHANNELS = exports.DistributionImageEvidenceSetSchema = exports.SigstoreEvidenceDescriptorSchema = exports.ImageDeliveryEntitlementStatementSchema = exports.ImageDeliveryEntitlementPredicateSchema = exports.IMAGE_DELIVERY_ENTITLEMENT_PREDICATE_TYPE = exports.ImageDeliveryMode = exports.DistributionImagesStatementSchema = exports.DistributionImagesPredicateSchema = exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE = exports.ImageProducerStatementSchema = exports.IMAGE_PRODUCER_PREDICATE_TYPE = exports.ImageProducerPredicateSchema = exports.ImageProducerRunSchema = exports.ImageProducerArtifactSchema = exports.ImageProducerBuildSchema = exports.ImageProducerSourceSchema = exports.ImageProducerPlatformSchema = exports.InTotoSubjectSchema = void 0;
 exports.parseImageProducerStatement = parseImageProducerStatement;
 exports.parseDistributionImagesStatement = parseDistributionImagesStatement;
 exports.parseImageDeliveryEntitlementStatement = parseImageDeliveryEntitlementStatement;
@@ -10,8 +10,7 @@ exports.parseDistributionImageReplayState = parseDistributionImageReplayState;
 const zod_1 = require("zod");
 const image_lock_1 = require("./image-lock");
 const kernel_contract_authority_1 = require("./kernel-contract-authority");
-const Sha256HexSchema = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
-const Sha256DigestSchema = zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const content_address_1 = require("../../content-address");
 const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
 const Rfc3339Schema = zod_1.z.string().datetime({ offset: true });
 const CanonicalIdentifierSchema = zod_1.z
@@ -31,7 +30,7 @@ exports.InTotoSubjectSchema = zod_1.z
     name: zod_1.z.string().min(1),
     digest: zod_1.z
         .object({
-        sha256: Sha256HexSchema,
+        sha256: content_address_1.Sha256HexSchema,
     })
         .strict(),
 })
@@ -39,7 +38,7 @@ exports.InTotoSubjectSchema = zod_1.z
 exports.ImageProducerPlatformSchema = zod_1.z
     .object({
     ...image_lock_1.RuntimeImagePlatformSchema.shape,
-    manifestDigest: Sha256DigestSchema,
+    manifestDigest: kernel_contract_authority_1.OciDigestSchema,
 })
     .strict();
 exports.ImageProducerSourceSchema = zod_1.z
@@ -50,39 +49,39 @@ exports.ImageProducerSourceSchema = zod_1.z
     repo: CanonicalRelativePathSchema,
     path: CanonicalRelativePathSchema,
     sourceCommit: GitCommitSchema,
-    sourceManifestHash: Sha256HexSchema,
+    sourceManifestHash: kernel_contract_authority_1.BiomeSourceManifestHashSchema,
     sourceHashAlgorithm: zod_1.z.union([
         zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV1),
         zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV2),
         zod_1.z.literal(image_lock_1.ImageSourceHashAlgorithm.ImageInputV3),
     ]),
-    sourceTreeHash: Sha256HexSchema,
+    sourceTreeHash: content_address_1.Sha256HexSchema,
 })
     .strict();
 exports.ImageProducerBuildSchema = zod_1.z
     .object({
     builderId: zod_1.z.string().url(),
     buildType: zod_1.z.string().url(),
-    buildDefinitionDigest: Sha256DigestSchema,
-    parametersDigest: Sha256DigestSchema,
+    buildDefinitionDigest: kernel_contract_authority_1.OciDigestSchema,
+    parametersDigest: kernel_contract_authority_1.OciDigestSchema,
     platforms: zod_1.z.array(exports.ImageProducerPlatformSchema).min(1).readonly(),
 })
     .strict();
 exports.ImageProducerArtifactSchema = zod_1.z
     .object({
     imageRepository: zod_1.z.string().min(1),
-    manifestDigest: Sha256DigestSchema,
+    manifestDigest: kernel_contract_authority_1.OciDigestSchema,
     manifestMediaType: zod_1.z.string().min(1),
     sbom: zod_1.z
         .object({
         predicateType: zod_1.z.literal('https://spdx.dev/Document'),
-        digest: Sha256DigestSchema,
+        digest: kernel_contract_authority_1.OciDigestSchema,
     })
         .strict(),
     provenance: zod_1.z
         .object({
         predicateType: zod_1.z.literal('https://slsa.dev/provenance/v1'),
-        digest: Sha256DigestSchema,
+        digest: kernel_contract_authority_1.OciDigestSchema,
     })
         .strict(),
 })
@@ -121,8 +120,8 @@ exports.DistributionImagesPredicateSchema = zod_1.z
     .object({
     schemaVersion: zod_1.z.literal(1),
     distributionId: CanonicalIdentifierSchema,
-    distributionInputHash: Sha256HexSchema,
-    normalizedImageLockDigest: Sha256DigestSchema,
+    distributionInputHash: content_address_1.Sha256HexSchema,
+    normalizedImageLockDigest: kernel_contract_authority_1.OciDigestSchema,
     releaseSequence: zod_1.z.number().int().nonnegative(),
     releaseSourceCommit: GitCommitSchema,
     runId: CanonicalIdentifierSchema,
@@ -136,9 +135,9 @@ exports.DistributionImagesPredicateSchema = zod_1.z
         subjectKind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
         subjectId: CanonicalIdentifierSchema,
         imageRepository: zod_1.z.string().min(1),
-        manifestDigest: Sha256DigestSchema,
-        producerStatementDigest: Sha256DigestSchema,
-        producerBundleDigest: Sha256DigestSchema,
+        manifestDigest: kernel_contract_authority_1.OciDigestSchema,
+        producerStatementDigest: kernel_contract_authority_1.OciDigestSchema,
+        producerBundleDigest: kernel_contract_authority_1.OciDigestSchema,
     })
         .strict())
         .min(1)
@@ -196,7 +195,7 @@ exports.ImageDeliveryEntitlementPredicateSchema = zod_1.z
     schemaVersion: zod_1.z.literal(1),
     customerId: CanonicalIdentifierSchema,
     distributionId: CanonicalIdentifierSchema,
-    distributionStatementDigest: Sha256DigestSchema,
+    distributionStatementDigest: kernel_contract_authority_1.OciDigestSchema,
     mode: zod_1.z.nativeEnum(ImageDeliveryMode),
     targetRegistry: CanonicalRegistryAuthoritySchema.nullable(),
     nonce: zod_1.z.string().regex(/^[a-zA-Z0-9_-]{22,128}$/),
@@ -234,9 +233,9 @@ exports.ImageDeliveryEntitlementStatementSchema = zod_1.z
 exports.SigstoreEvidenceDescriptorSchema = zod_1.z
     .object({
     statementPath: CanonicalRelativePathSchema,
-    statementDigest: Sha256DigestSchema,
+    statementDigest: kernel_contract_authority_1.OciDigestSchema,
     bundlePath: CanonicalRelativePathSchema,
-    bundleDigest: Sha256DigestSchema,
+    bundleDigest: kernel_contract_authority_1.OciDigestSchema,
     bundleMediaType: zod_1.z.literal('application/vnd.dev.sigstore.bundle.v0.3+json'),
 })
     .strict();
@@ -298,9 +297,15 @@ exports.DistributionImageEvidenceSetSchema = zod_1.z
         }
     }
 });
+exports.EVIDENCE_CHANNELS = ['release', 'develop'];
+exports.EVIDENCE_CHANNEL_REFS = {
+    release: 'refs/heads/main',
+    develop: 'refs/heads/develop',
+};
 exports.SigstoreIdentityPolicySchema = zod_1.z
     .object({
     policyId: CanonicalIdentifierSchema,
+    channel: zod_1.z.enum(exports.EVIDENCE_CHANNELS),
     predicateTypes: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
     certificateIdentity: zod_1.z.string().url(),
     oidcIssuer: zod_1.z.string().url(),
@@ -310,19 +315,18 @@ exports.SigstoreIdentityPolicySchema = zod_1.z
         ref: zod_1.z.string().regex(/^refs\/(?:heads|tags)\/.+$/),
         path: CanonicalRelativePathSchema,
     })
-        .strict()
-        .optional(),
+        .strict(),
     imageProducer: zod_1.z
         .object({
         builderIds: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
         buildTypes: zod_1.z.array(zod_1.z.string().url()).min(1).readonly(),
         buildDefinitionDigests: zod_1.z
-            .array(Sha256DigestSchema)
+            .array(kernel_contract_authority_1.OciDigestSchema)
             .min(1)
             .readonly()
             .optional(),
         parametersDigests: zod_1.z
-            .array(Sha256DigestSchema)
+            .array(kernel_contract_authority_1.OciDigestSchema)
             .min(1)
             .readonly()
             .optional(),
@@ -336,25 +340,31 @@ exports.SigstoreIdentityPolicySchema = zod_1.z
     })
         .strict()
         .optional(),
-    allowedImageRepositoryPrefixes: zod_1.z
+    imageRepositories: zod_1.z
         .array(zod_1.z
         .string()
-        .regex(/^[a-z0-9.-]+(?::[1-9]\d{0,4})?\/(?:[a-z0-9._-]+\/)*$/, 'must be a canonical lowercase OCI repository namespace ending in "/"'))
+        .regex(/^[a-z0-9.-]+(?::[1-9]\d{0,4})?\/(?:[a-z0-9._-]+\/)*[a-z0-9._-]+$/, 'must be an exact canonical lowercase OCI repository without a trailing "/"'))
         .min(1)
-        .readonly(),
+        .readonly()
+        .optional(),
 })
     .strict()
     .superRefine((value, context) => {
-    if (value.githubWorkflow) {
-        const expectedIdentity = `https://github.com/${value.githubWorkflow.repository}/` +
-            `${value.githubWorkflow.path}@${value.githubWorkflow.ref}`;
-        if (value.certificateIdentity !== expectedIdentity) {
-            context.addIssue({
-                code: zod_1.z.ZodIssueCode.custom,
-                path: ['certificateIdentity'],
-                message: 'must exactly match githubWorkflow repository, path, and ref',
-            });
-        }
+    const expectedIdentity = `https://github.com/${value.githubWorkflow.repository}/` +
+        `${value.githubWorkflow.path}@${value.githubWorkflow.ref}`;
+    if (value.certificateIdentity !== expectedIdentity) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['certificateIdentity'],
+            message: 'must exactly match githubWorkflow repository, path, and ref',
+        });
+    }
+    if (value.githubWorkflow.ref !== exports.EVIDENCE_CHANNEL_REFS[value.channel]) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['githubWorkflow', 'ref'],
+            message: `must equal ${exports.EVIDENCE_CHANNEL_REFS[value.channel]} for channel "${value.channel}"`,
+        });
     }
     const signsProducerEvidence = value.predicateTypes.includes(exports.IMAGE_PRODUCER_PREDICATE_TYPE);
     if (signsProducerEvidence !== (value.imageProducer !== undefined)) {
@@ -364,25 +374,39 @@ exports.SigstoreIdentityPolicySchema = zod_1.z
             message: 'is required exactly when predicateTypes includes image-producer evidence',
         });
     }
-    const signsDistributionCompleteness = value.predicateTypes.includes(exports.DISTRIBUTION_IMAGES_PREDICATE_TYPE);
-    if ((signsProducerEvidence || signsDistributionCompleteness) &&
-        value.githubWorkflow === undefined) {
+    if (signsProducerEvidence !== (value.imageRepositories !== undefined)) {
         context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            path: ['githubWorkflow'],
-            message: 'is required for producer or distribution-completeness evidence to bind the exact workflow commit',
+            path: ['imageRepositories'],
+            message: 'is required exactly when predicateTypes includes image-producer evidence',
         });
     }
+    if (value.imageRepositories !== undefined) {
+        const seen = new Map();
+        for (const [index, repository] of value.imageRepositories.entries()) {
+            const incumbent = seen.get(repository);
+            if (incumbent !== undefined) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['imageRepositories', index],
+                    message: `duplicates imageRepositories[${incumbent}] "${repository}"`,
+                });
+            }
+            else {
+                seen.set(repository, index);
+            }
+        }
+    }
 });
 exports.SigstoreOfflineTrustPolicySchema = zod_1.z
     .object({
     schemaVersion: zod_1.z.literal(1),
     trustedRootPath: CanonicalRelativePathSchema,
-    trustedRootDigest: Sha256DigestSchema,
+    trustedRootDigest: kernel_contract_authority_1.OciDigestSchema,
     cosignVersion: zod_1.z.string().regex(/^v\d+\.\d+\.\d+$/),
-    trustedCosignBinaryDigests: zod_1.z.array(Sha256DigestSchema).readonly(),
+    trustedCosignBinaryDigests: zod_1.z.array(kernel_contract_authority_1.OciDigestSchema).readonly(),
     gitVersion: zod_1.z.string().regex(/^\d+\.\d+\.\d+$/),
-    trustedGitBinaryDigests: zod_1.z.array(Sha256DigestSchema).readonly(),
+    trustedGitBinaryDigests: zod_1.z.array(kernel_contract_authority_1.OciDigestSchema).readonly(),
     maxProducerTtlSeconds: zod_1.z.number().int().positive(),
     maxCompletenessTtlSeconds: zod_1.z.number().int().positive(),
     maxEntitlementTtlSeconds: zod_1.z.number().int().positive(),
@@ -409,9 +433,9 @@ exports.DistributionImageReplayStateSchema = zod_1.z
     .object({
     schemaVersion: zod_1.z.literal(1),
     distributionId: CanonicalIdentifierSchema,
-    trustPolicyDigest: Sha256DigestSchema,
+    trustPolicyDigest: kernel_contract_authority_1.OciDigestSchema,
     lastReleaseSequence: zod_1.z.number().int().min(-1),
-    lastCompletenessStatementDigest: Sha256DigestSchema.nullable(),
+    lastCompletenessStatementDigest: kernel_contract_authority_1.OciDigestSchema.nullable(),
     lastCompletenessNonce: zod_1.z
         .string()
         .regex(/^[a-zA-Z0-9_-]{22,128}$/)