@xemahq/xema 0.27.0 → 0.28.0

package/dist/dev/env-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-defaults.d.ts","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAYrF,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmDpD,CAAC;AAwBH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D,CAAC;AAuCL,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMtE,CAAC;AAML,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvE,CAAC;AAeJ,wBAAgB,0BAA0B,IAAI,0BAA0B,EAAE,CAazE;AAoBD,eAAO,MAAM,0BAA0B,QAEtC,CAAC;AAiBF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3D,CAAC;AAkBL,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4I3D,CAAC;AAOL,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,CAAC,MAAM,CAAC,CAoEvB"}
+{"version":3,"file":"env-defaults.d.ts","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAYrF,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmDpD,CAAC;AAwBH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D,CAAC;AAuCL,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMtE,CAAC;AAML,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvE,CAAC;AAeJ,wBAAgB,0BAA0B,IAAI,0BAA0B,EAAE,CAazE;AAoBD,eAAO,MAAM,0BAA0B,QAEtC,CAAC;AAiBF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3D,CAAC;AAkBL,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwI3D,CAAC;AAOL,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,CAAC,MAAM,CAAC,CAoEvB"}

package/dist/dev/env-defaults.js

@@ -136,7 +136,6 @@ exports.MISC_ENV_DEFAULTS = Object.freeze({
     GITHUB_APP_FRONTEND_ALLOWLIST: 'http://127.0.0.1:3000',
     SCM_WEBHOOK_SECRET: 'dev-scm-webhook-secret',
     K8S_ALLOWED_IMAGE_REGISTRIES: 'ghcr.io,docker.io,registry.k8s.io,quay.io,127.0.0.1:5000',
-    MAILOPS_OAUTH_REDIRECT_URI: 'http://127.0.0.1:3000/mailops/oauth/callback',
     LLM_GATEWAY_API_URL: backingUrl('llm-gateway-api'),
 });
 function applyDevEnvDefaults(env = process.env) {

package/dist/dev/env-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-defaults.js","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":";;;AAsOA,gEAaC;AAuND,kDAsEC;AA7eD,6CAAkD;AAElD,gEAAmE;AACnE,wFAKoD;AAcvC,QAAA,QAAQ,GAAqC,MAAM,CAAC,MAAM,CAAC;IAEtE,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,IAAI;IAE9B,qBAAqB,EAAE,IAAI;IAC3B,oBAAoB,EAAE,IAAI;IAC1B,eAAe,EAAE,IAAI;IAErB,mBAAmB,EAAE,IAAI;IACzB,yBAAyB,EAAE,IAAI;IAC/B,cAAc,EAAE,IAAI;IACpB,4BAA4B,EAAE,IAAI;IAClC,qBAAqB,EAAE,IAAI;IAC3B,mBAAmB,EAAE,IAAI;IAIzB,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,sBAAsB,EAAE,IAAI;IAC5B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;IAKtB,kBAAkB,EAAE,IAAI;IACxB,mBAAmB,EAAE,IAAI;IACzB,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,4BAA4B,EAAE,IAAI;IAClC,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,IAAI;IACxB,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAO9B,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAwBU,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,0DAA0D;IACxE,SAAS,EAAE,wBAAwB;IAKnC,WAAW,EAAE,gCAAgC;IAC7C,gBAAgB,EAAE,gBAAgB;CAInC,CAAC,CAAC;AAkDQ,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;IAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACjC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CAChC,CAAC,CAAC;AAMQ,QAAA,4BAA4B,GACvC,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI;IACJ,IAAI,CAAC,IAAI;CACV,CAAC,CACH,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,oBAAoB,MAAM,CAAC,0BAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAY9D,SAAgB,0BAA0B;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,GAAG;YAGH,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI;gBACpC,UAAU,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE;aACxC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAoBY,QAAA,0BAA0B,GAAG,IAAI,CAAC,SAAS,CACtD,0BAA0B,EAAE,CAC7B,CAAC;AAeF,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAEzD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAChB,iEAAiE;IAInE,2BAA2B,EAAE,+BAA+B;IAC5D,mBAAmB,EAAE,+BAA+B;IACpD,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAOL,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAUxD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IAGZ,sBAAsB,EAAE,MAAM;IAC9B,qBAAqB,EAAE,OAAO;IAU9B,oBAAoB,EAAE,uCAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;IAErD,eAAe,EAAE,uBAAuB;IAExC,0BAA0B,EAAE,OAAO;IAKnC,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,UAAU;IACjC,WAAW,EAAE,uBAAuB;IACpC,gBAAgB,EAAE,YAAY;IAC9B,oBAAoB,EAAE,YAAY;IAClC,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,MAAM;IAK3B,kBAAkB,EAAE,uBAAuB;IAC3C,kBAAkB,EAAE,uBAAuB;IAI3C,qBAAqB,EAAE,gBAAgB;IAIvC,uBAAuB,EAAE,sBAAsB;IAC/C,2BAA2B,EAAE,sBAAsB;IACnD,qBAAqB,EAAE,sBAAsB;IAG7C,qBAAqB,EAAE,uBAAuB;IAE9C,sBAAsB,EAAE,uCAAuC;IAC/D,uBAAuB,EAAE,uBAAuB;IAGhD,eAAe,EAAE,cAAc;IAG/B,4BAA4B,EAAE,gBAAgB;IAM9C,iCAAiC,EAAE,8BAA8B;IACjE,gCAAgC,EAAE,8BAA8B;IAGhE,mCAAmC,EAAE,wBAAwB;IAC7D,kCAAkC,EAAE,uBAAuB;IAC3D,mCAAmC,EAAE,qBAAqB;IAC1D,gCAAgC,EAAE,8BAA8B;IAIhE,wBAAwB,EAAE,wBAAwB;IAGlD,sBAAsB,EAAE,mBAAmB;IAK3C,oBAAoB,EAAE,4CAAkB,CAAC,OAAO;IAChD,eAAe,EAAE,IAAA,6CAAmB,EAAC,KAAK,CAAC;IAC3C,mBAAmB,EAAE,2CAAiB,CAAC,KAAK;IAC5C,kBAAkB,EAAE,kDAAwB;IAE5C,qBAAqB,EAAE,SAAS;IAGhC,uBAAuB,EAAE,OAAO;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,8BAA8B,EAAE,mBAAmB;IAGnD,qBAAqB,EAAE,WAAW;IAIlC,yBAAyB,EAAE,MAAM;IACjC,sBAAsB,EAAE,uBAAuB;IAC/C,YAAY,EAAE,uBAAuB;IACrC,QAAQ,EAAE,WAAW;IACrB,gBAAgB,EAAE,8BAA8B;IAIhD,qBAAqB,EAAE,mBAAmB;IAC1C,sBAAsB,EAAE,mBAAmB;IAC3C,6BAA6B,EAAE,WAAW;IAQ1C,aAAa,EAAE,QAAQ;IACvB,cAAc,EAAE,kCAAkC;IAElD,SAAS,EAAE,uBAAuB;IAElC,6BAA6B,EAAE,uBAAuB;IAEtD,kBAAkB,EAAE,wBAAwB;IAK5C,4BAA4B,EAC1B,0DAA0D;IAI5D,0BAA0B,EAAE,8CAA8C;IAI1E,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC;CACnD,CAAC,CAAC;AAOL,SAAgB,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAKF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAAE,CAAC;QACjE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAID,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,oBAAoB,MAAM,CAAC,gBAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAG9C,YAAY,CAAC,wBAAwB,EAAE,kCAA0B,CAAC,CAAC;IACnE,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzE,YAAY,CACV,iBAAiB,EACjB,GAAG,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CACxD,CAAC;IAEF,YAAY,CACV,iCAAiC,EACjC,MAAM,CAAC,wBAAwB,CAAC,CACjC,CAAC;IACF,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElE,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtE,YAAY,CACV,yBAAyB,EACzB,GAAG,MAAM,CAAC,uBAAuB,CAAC,wBAAwB,CAC3D,CAAC;IAMF,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,iCAAmB,EAAC,KAAK,EAAE;gBAChD,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBACxC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAClE,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"env-defaults.js","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":";;;AAsOA,gEAaC;AAmND,kDAsEC;AAzeD,6CAAkD;AAElD,gEAAmE;AACnE,wFAKoD;AAcvC,QAAA,QAAQ,GAAqC,MAAM,CAAC,MAAM,CAAC;IAEtE,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,IAAI;IAE9B,qBAAqB,EAAE,IAAI;IAC3B,oBAAoB,EAAE,IAAI;IAC1B,eAAe,EAAE,IAAI;IAErB,mBAAmB,EAAE,IAAI;IACzB,yBAAyB,EAAE,IAAI;IAC/B,cAAc,EAAE,IAAI;IACpB,4BAA4B,EAAE,IAAI;IAClC,qBAAqB,EAAE,IAAI;IAC3B,mBAAmB,EAAE,IAAI;IAIzB,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,sBAAsB,EAAE,IAAI;IAC5B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;IAKtB,kBAAkB,EAAE,IAAI;IACxB,mBAAmB,EAAE,IAAI;IACzB,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,4BAA4B,EAAE,IAAI;IAClC,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,IAAI;IACxB,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAO9B,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAwBU,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,0DAA0D;IACxE,SAAS,EAAE,wBAAwB;IAKnC,WAAW,EAAE,gCAAgC;IAC7C,gBAAgB,EAAE,gBAAgB;CAInC,CAAC,CAAC;AAkDQ,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;IAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACjC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CAChC,CAAC,CAAC;AAMQ,QAAA,4BAA4B,GACvC,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI;IACJ,IAAI,CAAC,IAAI;CACV,CAAC,CACH,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,oBAAoB,MAAM,CAAC,0BAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAY9D,SAAgB,0BAA0B;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,GAAG;YAGH,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI;gBACpC,UAAU,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE;aACxC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAoBY,QAAA,0BAA0B,GAAG,IAAI,CAAC,SAAS,CACtD,0BAA0B,EAAE,CAC7B,CAAC;AAeF,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAEzD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAChB,iEAAiE;IAInE,2BAA2B,EAAE,+BAA+B;IAC5D,mBAAmB,EAAE,+BAA+B;IACpD,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAOL,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAUxD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IAGZ,sBAAsB,EAAE,MAAM;IAC9B,qBAAqB,EAAE,OAAO;IAU9B,oBAAoB,EAAE,uCAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;IAErD,eAAe,EAAE,uBAAuB;IAExC,0BAA0B,EAAE,OAAO;IAKnC,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,UAAU;IACjC,WAAW,EAAE,uBAAuB;IACpC,gBAAgB,EAAE,YAAY;IAC9B,oBAAoB,EAAE,YAAY;IAClC,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,MAAM;IAK3B,kBAAkB,EAAE,uBAAuB;IAC3C,kBAAkB,EAAE,uBAAuB;IAI3C,qBAAqB,EAAE,gBAAgB;IAIvC,uBAAuB,EAAE,sBAAsB;IAC/C,2BAA2B,EAAE,sBAAsB;IACnD,qBAAqB,EAAE,sBAAsB;IAG7C,qBAAqB,EAAE,uBAAuB;IAE9C,sBAAsB,EAAE,uCAAuC;IAC/D,uBAAuB,EAAE,uBAAuB;IAGhD,eAAe,EAAE,cAAc;IAG/B,4BAA4B,EAAE,gBAAgB;IAM9C,iCAAiC,EAAE,8BAA8B;IACjE,gCAAgC,EAAE,8BAA8B;IAGhE,mCAAmC,EAAE,wBAAwB;IAC7D,kCAAkC,EAAE,uBAAuB;IAC3D,mCAAmC,EAAE,qBAAqB;IAC1D,gCAAgC,EAAE,8BAA8B;IAIhE,wBAAwB,EAAE,wBAAwB;IAGlD,sBAAsB,EAAE,mBAAmB;IAK3C,oBAAoB,EAAE,4CAAkB,CAAC,OAAO;IAChD,eAAe,EAAE,IAAA,6CAAmB,EAAC,KAAK,CAAC;IAC3C,mBAAmB,EAAE,2CAAiB,CAAC,KAAK;IAC5C,kBAAkB,EAAE,kDAAwB;IAE5C,qBAAqB,EAAE,SAAS;IAGhC,uBAAuB,EAAE,OAAO;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,8BAA8B,EAAE,mBAAmB;IAGnD,qBAAqB,EAAE,WAAW;IAIlC,yBAAyB,EAAE,MAAM;IACjC,sBAAsB,EAAE,uBAAuB;IAC/C,YAAY,EAAE,uBAAuB;IACrC,QAAQ,EAAE,WAAW;IACrB,gBAAgB,EAAE,8BAA8B;IAIhD,qBAAqB,EAAE,mBAAmB;IAC1C,sBAAsB,EAAE,mBAAmB;IAC3C,6BAA6B,EAAE,WAAW;IAQ1C,aAAa,EAAE,QAAQ;IACvB,cAAc,EAAE,kCAAkC;IAElD,SAAS,EAAE,uBAAuB;IAElC,6BAA6B,EAAE,uBAAuB;IAEtD,kBAAkB,EAAE,wBAAwB;IAK5C,4BAA4B,EAC1B,0DAA0D;IAI5D,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC;CACnD,CAAC,CAAC;AAOL,SAAgB,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAKF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAAE,CAAC;QACjE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAID,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,oBAAoB,MAAM,CAAC,gBAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAG9C,YAAY,CAAC,wBAAwB,EAAE,kCAA0B,CAAC,CAAC;IACnE,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzE,YAAY,CACV,iBAAiB,EACjB,GAAG,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CACxD,CAAC;IAEF,YAAY,CACV,iCAAiC,EACjC,MAAM,CAAC,wBAAwB,CAAC,CACjC,CAAC;IACF,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElE,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtE,YAAY,CACV,yBAAyB,EACzB,GAAG,MAAM,CAAC,uBAAuB,CAAC,wBAAwB,CAC3D,CAAC;IAMF,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,iCAAmB,EAAC,KAAK,EAAE;gBAChD,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBACxC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAClE,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -51116,8 +51116,15 @@ var edition_contract_default = {
   repositoryPrefix: "xema-edition-",
   descriptorFile: "xema-edition.json",
   descriptorSchema: "xema.edition/v1",
-  locks: ["distribution.lock.json", "images.lock.json", "authorization.lock.json", "chart-set.lock.json"],
-  offeringLayers: { catalogue: "catalogue.json" },
+  locks: [
+    "distribution.lock.json",
+    "images.lock.json",
+    "authorization.lock.json",
+    "chart-set.lock.json"
+  ],
+  offeringLayers: {
+    catalogue: "catalogue.json"
+  },
   provenancePins: {
     catalogue: "the sha256 digest (sha256:<64 hex>) of the offering artifact a customer edition was resolved against; every other pin is a 40-hex commit"
   },
@@ -51125,11 +51132,11 @@ var edition_contract_default = {
   evidenceTrust: {
     states: {
       armed: "the data root declares an evidence trust policy that is pinned and ARMED on the channel of the edition",
-      "not-armed": "a release edition: exactly, the data root's evidenceTrustPolicy.required is false and it has no policy armed on the release channel; a develop edition: its policy is not armed on the develop channel, whatever required says"
+      "not-armed": "a develop edition only: its data root declares no policy, or one that is not armed on the develop channel. A release edition never records not-armed"
     },
     refusal: {
       code: "EVIDENCE_TRUST_REQUIRED_UNARMED",
-      when: "evidenceTrustPolicy.required is true while the policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there): `xema edition check` fails, no release edition is sealed and no release artifact is written, so a release descriptor never records not-armed for a required data root. Arming is judged per channel: a develop edition admits not-armed"
+      when: "a release edition is written while the data root's evidence trust policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there): no release descriptor or artifact is written, and no configuration key admits one. Arming is judged per channel: a develop edition admits not-armed"
     }
   }
 };
@@ -51726,35 +51733,35 @@ function requirePublishers(config) {
     })
   );
 }
-var EVIDENCE_TRUST_POLICY_KEYS = Object.freeze(["pin", "policy", "required"]);
+var EVIDENCE_TRUST_POLICY_KEYS = Object.freeze(["pin", "policy"]);
 function isDataRootRelativePath(value) {
   return typeof value === "string" && DATA_ROOT_RELATIVE_PATH.test(value) && value.split("/").every((segment) => segment !== "." && segment !== "..");
 }
 function requireEvidenceTrustPolicy(config) {
   if (!Object.hasOwn(config, "evidenceTrustPolicy")) {
     throw new EditionWorkspaceConfigError(
-      `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is required: {"required": true, "policy": ..., "pin": ...} or {"required": false} (no default: say whether this data root's editions must be evidence-gated)`
+      `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is required: {"policy": ..., "pin": ...}, or null to state that this data root declares no policy (no release edition can then be sealed from it)`
     );
   }
   const value = config.evidenceTrustPolicy;
-  const shapeError = () => new EditionWorkspaceConfigError(
-    `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is exactly {required: boolean} or {required, policy, pin} with both paths data-root-relative`
+  if (value === null) {
+    return Object.freeze({ policy: null, pin: null });
+  }
+  const shapeError = (detail) => new EditionWorkspaceConfigError(
+    `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is exactly null or {policy, pin} with both paths data-root-relative${detail}`
   );
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw shapeError();
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw shapeError("");
   }
   const keys = Object.keys(value).sort();
-  if (!keys.every((key) => EVIDENCE_TRUST_POLICY_KEYS.includes(key)) || typeof value.required !== "boolean") {
-    throw shapeError();
+  const unknown = keys.filter((key) => !EVIDENCE_TRUST_POLICY_KEYS.includes(key));
+  if (unknown.length > 0) {
+    throw shapeError(`; unknown key ${unknown.map((key) => `"${key}"`).join(", ")}`);
   }
-  const declared = keys.length > 1;
-  if (declared && keys.join() !== EVIDENCE_TRUST_POLICY_KEYS.join()) {
-    throw shapeError();
+  if (keys.join() !== EVIDENCE_TRUST_POLICY_KEYS.join()) {
+    throw shapeError("");
   }
-  if (!declared) {
-    return Object.freeze({ required: value.required, policy: null, pin: null });
-  }
-  for (const key of ["policy", "pin"]) {
+  for (const key of EVIDENCE_TRUST_POLICY_KEYS) {
     if (!isDataRootRelativePath(value[key])) {
       throw new EditionWorkspaceConfigError(
         `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy.${key}" must be a data-root-relative POSIX path without "." or ".." segments; got ${JSON.stringify(value[key])}`
@@ -51764,7 +51771,7 @@ function requireEvidenceTrustPolicy(config) {
   if (value.policy === value.pin) {
     throw new EditionWorkspaceConfigError(`${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy.policy" and ".pin" must be different files`);
   }
-  return Object.freeze({ required: value.required, policy: value.policy, pin: value.pin });
+  return Object.freeze({ policy: value.policy, pin: value.pin });
 }
 function parseEditionWorkspaceConfig(document) {
   if (document === null || typeof document !== "object" || Array.isArray(document)) {
@@ -52015,6 +52022,11 @@ function parseEditionDescriptor(value) {
   if (!Object.values(EvidenceTrustState).includes(value.evidenceTrustPolicy)) {
     throw new Error(`${EDITION_DESCRIPTOR_FILE}: evidenceTrustPolicy must be one of ${Object.values(EvidenceTrustState).join(" | ")}`);
   }
+  if (value.provenance.channel === EditionChannel.Release && value.evidenceTrustPolicy !== EvidenceTrustState.Armed) {
+    throw new Error(
+      `${EDITION_DESCRIPTOR_FILE}: a release edition requires an armed evidence trust policy; "${value.distributionId}" records ${JSON.stringify(value.evidenceTrustPolicy)}`
+    );
+  }
   exactKeys(value.engine, ["image"], `${EDITION_DESCRIPTOR_FILE} engine`);
   assertEngineImage(value.engine.image);
   return value;
@@ -52453,6 +52465,21 @@ function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
     group.requirements.push({ root: canonicalRoot, label, requiredPaths });
     byRepository.set(location.repositoryRoot, group);
   }
+  if (expected !== void 0) {
+    const regraded = new Set(
+      [...byRepository.values()].flatMap((group) => group.requirements.map(({ root: root2 }) => root2))
+    );
+    for (const root2 of regraded) {
+      if (typeof expected.get(root2)?.commit !== "string") {
+        throw new Error(`${root2} was not graded first, so its HEAD cannot be held unchanged`);
+      }
+    }
+    for (const root2 of expected.keys()) {
+      if (!regraded.has(root2)) {
+        throw new Error(`${root2} was graded first and is missing from the re-grade`);
+      }
+    }
+  }
   const result = /* @__PURE__ */ new Map();
   for (const [repositoryRoot, group] of byRepository) {
     assertTrustedCheckoutLocation(group.location, group.labels.join(" + "));
@@ -52460,9 +52487,12 @@ function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
       repositoryRoot,
       requirements: group.requirements,
       trustedGit,
-      expectedCommit: expected?.get(group.requirements[0].root)?.commit
+      expectedCommit: expected?.get(group.requirements[0].root).commit
     });
     for (const { root: root2 } of group.requirements) {
+      if (expected !== void 0 && expected.get(root2).commit !== graded.commit) {
+        throw new Error(`${repositoryRoot} HEAD changed during verification`);
+      }
       result.set(root2, graded);
     }
   }
@@ -53553,6 +53583,59 @@ function assertPinnedVerifier({ pin, actual }) {
   }
 }
 
+// edition/image-delivery-entitlement-descriptor.mjs
+import { dirname as dirname4, join as join6 } from "node:path";
+var ENTITLEMENT_DESCRIPTOR_FILE = "entitlement.json";
+var ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION = 2;
+var ENTITLEMENT_DESCRIPTOR_KEYS = Object.freeze([
+  "schemaVersion",
+  "distributionId",
+  "customerId",
+  "mode",
+  "targetRegistry",
+  "idempotencyKey",
+  "distributionStatementDigest",
+  "evidence"
+]);
+function parseEntitlementDescriptorDocument(raw, schemas2) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} must be a JSON object`);
+  }
+  if (raw.schemaVersion !== ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION) {
+    throw new Error(
+      `${ENTITLEMENT_DESCRIPTOR_FILE} has schemaVersion ${JSON.stringify(raw.schemaVersion)}; this verifier reads schemaVersion ${ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION} only (accept the entitlement again with this CLI)`
+    );
+  }
+  const keys = Object.keys(raw).sort();
+  const expected = [...ENTITLEMENT_DESCRIPTOR_KEYS].sort();
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {
+    throw new Error(
+      `${ENTITLEMENT_DESCRIPTOR_FILE} must hold exactly the keys ${ENTITLEMENT_DESCRIPTOR_KEYS.join(", ")}; it holds ${keys.join(", ")}`
+    );
+  }
+  for (const key of ["distributionId", "customerId", "mode", "idempotencyKey", "distributionStatementDigest"]) {
+    if (typeof raw[key] !== "string" || raw[key] === "") {
+      throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} "${key}" must be a non-empty string`);
+    }
+  }
+  if (raw.targetRegistry !== null && (typeof raw.targetRegistry !== "string" || raw.targetRegistry === "")) {
+    throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} "targetRegistry" must be null or a non-empty string`);
+  }
+  return { ...raw, evidence: schemas2.SigstoreEvidenceDescriptorSchema.parse(raw.evidence) };
+}
+function assertEntitlementDescriptorStates(document, expected) {
+  for (const key of ["distributionId", "customerId", "mode", "targetRegistry", "distributionStatementDigest"]) {
+    if (document[key] !== expected[key]) {
+      throw new Error(
+        `${ENTITLEMENT_DESCRIPTOR_FILE} states ${key} ${JSON.stringify(document[key])}, not the ${JSON.stringify(expected[key])} this verification was asked for`
+      );
+    }
+  }
+}
+function entitlementEvidenceRoot(evidenceRoot, entitlementDescriptorPath) {
+  return dirname4(join6(evidenceRoot, entitlementDescriptorPath));
+}
+
 // edition/image-evidence-replay-state.mjs
 import { randomUUID } from "node:crypto";
 import {
@@ -53567,7 +53650,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute5, join as join6 } from "node:path";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute5, join as join7 } from "node:path";
 var MAX_REPLAY_STATE_BYTES = 64 * 1024;
 function openRegularFileNoFollow(path) {
   const descriptor = openSync3(
@@ -53614,8 +53697,8 @@ function assertTrustedStateDirectory(path) {
   }
 }
 function writeDurableReplacement(path, value) {
-  const directory = realpathSync5(dirname4(path));
-  const temporaryPath = join6(
+  const directory = realpathSync5(dirname5(path));
+  const temporaryPath = join7(
     directory,
     `.${basename3(path)}.${randomUUID()}.tmp`
   );
@@ -53663,12 +53746,12 @@ async function verifyAndAdvanceReplayState({
   if (!isAbsolute5(statePath)) {
     throw new Error("replay state path must be absolute");
   }
-  const stateDirectory = realpathSync5(dirname4(statePath));
-  if (stateDirectory !== dirname4(statePath)) {
+  const stateDirectory = realpathSync5(dirname5(statePath));
+  if (stateDirectory !== dirname5(statePath)) {
     throw new Error("replay state parent path must be canonical");
   }
   assertTrustedStateDirectory(stateDirectory);
-  const canonicalStatePath = join6(stateDirectory, basename3(statePath));
+  const canonicalStatePath = join7(stateDirectory, basename3(statePath));
   const lockPath = `${canonicalStatePath}.lock`;
   let lockDescriptor;
   try {
@@ -53772,7 +53855,7 @@ async function verifyAndAdvanceReplayState({
 
 // edition/verifier-binding.mjs
 import { readFileSync as readFileSync5, realpathSync as realpathSync6 } from "node:fs";
-import { dirname as dirname5, join as join7 } from "node:path";
+import { dirname as dirname6, join as join8 } from "node:path";
 
 // edition/verifier-files.mjs
 var VERIFIER_PROVENANCE_FILE = "verify-image-evidence.bundle.provenance.json";
@@ -53823,7 +53906,7 @@ function readRunningVerifier(bundlePath) {
   assertProtectedPathAncestry(realBundle, "the evidence verifier install");
   const bundleBytes = readFileSync5(realBundle);
   const provenanceBytes = readFileSync5(
-    join7(dirname5(realBundle), VERIFIER_PROVENANCE_FILE)
+    join8(dirname6(realBundle), VERIFIER_PROVENANCE_FILE)
   );
   parseVerifierProvenance({ provenanceBytes, bundleBytes });
   return { bundleBytes, provenanceBytes };
@@ -53841,11 +53924,12 @@ async function loadVerifierKernelSchemas() {
 }
 
 // edition/verify-image-evidence.mjs
-var USAGE = "usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path> [--evidence-set <relative-path>] [--json] [--entitlement <relative-path> --customer <id> --mode <mode> [--target-registry <registry>]] --data-root <dir> --editions-root <dir> --kernel <dir>";
+var USAGE = "usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path> [--evidence-set <relative-path>] [--json] [--entitlement <relative-path> --entitlement-workflow-sha <40-hex git sha> --customer <id> --mode <mode> [--target-registry <registry>]] --data-root <dir> --editions-root <dir> --kernel <dir>";
 var EVIDENCE_CHANNEL_OF_EDITION_CHANNEL = Object.freeze({
   [EditionChannel.Release]: "release",
   [EditionChannel.Develop]: "develop"
 });
+var GIT_COMMIT_SHA = /^[a-f0-9]{40}$/;
 var DATA_ROOT_FILES = Object.freeze(["edition-workspace.json", "runtime-image-source-index.json"]);
 function requireOptionValue(args, index, flag) {
   const value = args[index + 1];
@@ -53876,6 +53960,7 @@ function parseArgs(args) {
     cosignBinary: null,
     gitBinary: null,
     entitlementDescriptorPath: null,
+    entitlementWorkflowSha: null,
     customerId: null,
     mode: null,
     targetRegistry: null
@@ -53902,6 +53987,8 @@ function parseArgs(args) {
       options.gitBinary = value;
     } else if (flag === "--entitlement") {
       options.entitlementDescriptorPath = value;
+    } else if (flag === "--entitlement-workflow-sha") {
+      options.entitlementWorkflowSha = value;
     } else if (flag === "--customer") {
       options.customerId = value;
     } else if (flag === "--mode") {
@@ -53927,6 +54014,7 @@ function parseArgs(args) {
   }
   const entitlementFlags = [
     ["--entitlement", options.entitlementDescriptorPath],
+    ["--entitlement-workflow-sha", options.entitlementWorkflowSha],
     ["--customer", options.customerId],
     ["--mode", options.mode]
   ];
@@ -53937,7 +54025,10 @@ function parseArgs(args) {
     );
   }
   if (stated.length === 0 && options.targetRegistry !== null) {
-    throw new Error("--target-registry needs --entitlement, --customer and --mode");
+    throw new Error("--target-registry needs --entitlement, --entitlement-workflow-sha, --customer and --mode");
+  }
+  if (options.entitlementWorkflowSha !== null && !GIT_COMMIT_SHA.test(options.entitlementWorkflowSha)) {
+    throw new Error("--entitlement-workflow-sha must be a 40-character lowercase hexadecimal git commit SHA");
   }
   if (options.entitlementDescriptorPath !== null && isAbsolute6(options.entitlementDescriptorPath)) {
     throw new Error("--entitlement must be an evidence-root-relative path");
@@ -54105,13 +54196,26 @@ async function verifyEvidence({ argv, env, bundlePath }) {
           cosignBinary: options.cosignBinary,
           schemas: schemas2
         });
-        const entitlementDescriptor = options.entitlementDescriptorPath === null ? null : readCanonicalJsonFromRoot(
-          evidenceRoot,
-          options.entitlementDescriptorPath,
-          "delivery entitlement evidence descriptor"
+        const entitlement = options.entitlementDescriptorPath === null ? null : parseEntitlementDescriptorDocument(
+          readCanonicalJsonFromRoot(
+            evidenceRoot,
+            options.entitlementDescriptorPath,
+            "delivery entitlement descriptor"
+          ),
+          schemas2
         );
+        if (entitlement !== null) {
+          assertEntitlementDescriptorStates(entitlement, {
+            distributionId: options.distributionId,
+            customerId: options.customerId,
+            mode: options.mode,
+            targetRegistry: options.targetRegistry,
+            distributionStatementDigest: result.completenessStatementDigest
+          });
+        }
+        const entitlementDescriptor = entitlement === null ? null : entitlement.evidence;
         const entitlementStatement = entitlementDescriptor === null ? null : await verifyImageDeliveryEntitlement({
-          evidenceRoot,
+          evidenceRoot: entitlementEvidenceRoot(evidenceRoot, options.entitlementDescriptorPath),
           descriptor: entitlementDescriptor,
           policy: anchors.policy,
           policyRoot: dataRoot(),
@@ -54122,9 +54226,9 @@ async function verifyEvidence({ argv, env, bundlePath }) {
           mode: options.mode,
           targetRegistry: options.targetRegistry,
           now: /* @__PURE__ */ new Date(),
-          // The entitlement predicate carries no producer run, so there
-          // is no workflow SHA to demand and none is invented.
-          expectedWorkflowSha: void 0,
+          // The entitlement predicate carries no producer run: the commit
+          // its certificate is held to is the caller's statement.
+          expectedWorkflowSha: options.entitlementWorkflowSha,
           // A nonce spent by a producer or completeness statement of
           // this release cannot be reused by its entitlement.
           consumedNonces: result.verifiedNonces,

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:669f555ec2e2a0c260e2cd6523a95464888db2a0beb1ba52941c7b4d43d4b88f",
+  "artifactSha256": "sha256:a50fae555a6b55791afbec256bf41745d0dc849eb9d964369a41e8a0d4f58a8b",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2119,181 +2119,187 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:7ded47eadc194ebf11583f77c695bf1708e502c654420564d55be3b599ff770f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-artifact.mjs",
-      "sha256": "sha256:e2aa610e41d4e0f83a0e6983e1ed986899e77ba850d67030c49c9dd2f88c05fe"
+      "sha256": "sha256:b27a039f3e93c0caadc6562d89fd7b1843140da291e183137ec4eb6966cdf468"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:9dcd7b09d4fee8c4d43338e4e418619aa3003a612823455310cad6f6c48a19c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:382e4eb4dbcf9fe88a01a4bf52480ebf6594a35e6abe235db637892c3cba595c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-config.mjs",
-      "sha256": "sha256:7728d4d1eaf9b85521d207509ee8647a47e3eb830192abfe4a1995042a444e47"
+      "sha256": "sha256:5a9019079b04ffa4394405e05fc18e870171fa9da7405f37e1e608f1456bd43e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:e923fac9753d3203b3e27c708f9a9a4f3b2ce1337b2eda03be415ee27796f479"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-contract.json",
-      "sha256": "sha256:b10e60fe6af58aa8d1792270ff5c3761f1e3a76ce35493eb8568e4fb9bb51e84"
+      "sha256": "sha256:83e0b986a9a8a2f8d5c1fe06dea852f7893ee1188b51fe75816f2e58cfe8bb15"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:3a0d53d18718790ac32c92164e373f7f038675a3e9410e5ef3c139affcf42892"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/edition-workspace.mjs",
-      "sha256": "sha256:6b48769858287162afcb07bd8d9ab0a39bf8c40749a7144d022b37cb44a102ea"
+      "sha256": "sha256:fdd681e8f7b8da5da53664c45173cd042606d3dfc36567398909fd8d24a10eea"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/evidence-checkout.mjs",
-      "sha256": "sha256:06c8d95d8f771434fb8ec5556fe00aa4ed6c9152ec9e6f3a4177ac09928e54ae"
+      "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
+      "path": "edition/image-delivery-entitlement-descriptor.mjs",
+      "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.28.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/image-evidence.mjs",
-      "sha256": "sha256:8d3749138d610b355c4d54120589c2aa3d6985e3a94e904bc2658bcc19a12926"
+      "sha256": "sha256:342e8209c5c0ead5dbfbea573afdfab9e53bbf181eb7918b85d2982fb4942992"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:d486db676ff029706d5e53d07c76c2e61d1010b8a45a39d75cd10aaa8c429855"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:b0c94e6cbf20848923940eae0ac5cffa4ce4097608ac0ca737b7be353bafbe5e"
+      "sha256": "sha256:5b668b4495f31cb884b25dd5edad6a1205bb7f0ff4155bd4a708815fa60bef97"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:f55b290fd45a8c2612d9dcbc02244d8db3142af0345459df015de194d45611d8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:2351d47a32ee865720a675f1ecd336b00cdce4aa34713219a1aa23920ac7b60f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/verify-image-evidence.mjs",
-      "sha256": "sha256:a716751a40d038c879338d6056a45b79424c75574214f442cbb6e7ded871b6c2"
+      "sha256": "sha256:b7412ea4609c32cecf8992a4d2db4bf27fbad95b2d26ab1eee10ddbf044d1a0e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:decfa7ca6c340e51ddc06f4d30caac8e8e3c060c843c211586efc313dd9ace8e"
     },