@xemahq/xema 0.27.0 → 0.29.0

package/dist/commands/edition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmCzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiBtD"}
+{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiBtD"}

package/dist/commands/edition.js

@@ -5,12 +5,12 @@ const exit_codes_1 = require("../lib/exit-codes");
 const run_entry_1 = require("../runtime/edition/run-entry");
 const verb_map_1 = require("../runtime/edition/verb-map");
 const VERB_SUMMARY = {
-    [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema edition resolve <id> [--check]; or a customer edition against a catalogue: xema edition resolve --definition <file> --catalogue oci://<repo>@sha256:<digest> --channel <release|develop> --out <dir> [--source-image <source>=<registry>/<prefix>]...',
-    [verb_map_1.EditionVerb.Seal]: 'Seal the image digests of an edition: xema edition seal <id>',
-    [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema edition develop <resolve|target|freeze-graph|freeze-sources|check-existing|check-overrides> ...; or a customer develop edition: xema edition develop resolve --definition <file> --catalogue oci://<repo>@sha256:<digest> --pins <file> --out <dir> --registry <ns> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...',
-    [verb_map_1.EditionVerb.Artifact]: 'Write the OCI artifact files of a release edition from the committed sealed locks: xema edition artifact <id> --channel release --registry <ns> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>',
+    [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema edition resolve <id> [--check]; or a customer edition against the catalogue pinned in catalogue.pin.json beside the definition: xema edition resolve --definition <file> --channel <release|develop> --out <dir> [--source-image <source>=<registry>/<prefix>]...',
+    [verb_map_1.EditionVerb.Seal]: 'Seal the image digests of an edition: xema edition seal <id> [--definition <file>] (a customer edition seals against the release catalogue pinned in catalogue.pin.json beside the definition)',
+    [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema edition develop <resolve|target|freeze-graph|freeze-sources|check-existing|check-overrides> ...; or a customer develop edition (catalogue pinned in catalogue.pin.json beside the definition): xema edition develop <resolve|target|check-existing|freeze-sources|kernel-commit> --definition <file> ... (resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...; kernel-commit prints the contract authority source commit of the catalogue)',
+    [verb_map_1.EditionVerb.Artifact]: 'Write the OCI artifact files of a release edition from the committed sealed locks: xema edition artifact <id> --channel release --registry <root> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>',
     [verb_map_1.EditionVerb.Catalogue]: 'Write the catalogue.json of a release offering from its committed sealed locks: xema edition catalogue <id> --out <dir>',
-    [verb_map_1.EditionVerb.Index]: `Rebuild a catalogue index: xema edition index <${Object.values(verb_map_1.EditionIndexKind).join('|')}> [--check]; xema edition index runtime-image-source --repin-contract-authority replaces only the contract authority of the committed index with the kernel checkout's`,
+    [verb_map_1.EditionVerb.Index]: `Rebuild a catalogue index: xema edition index <${Object.values(verb_map_1.EditionIndexKind).join('|')}> [--check]; xema edition index runtime-image-source --repin-contract-authority --kernel-commit <40-hex> replaces only the contract authority of the committed index with the kernel checkout's at the stated commit (its HEAD must equal it)`,
     [verb_map_1.EditionVerb.Check]: 'Check the committed edition locks and catalogue indices',
     [verb_map_1.EditionVerb.Why]: 'Explain why a biome is in an edition: xema edition why <id> <biome>',
     [verb_map_1.EditionVerb.VerifyPlatforms]: 'Prove the registry serves every required platform of an edition: xema edition verify-platforms <id>',
@@ -21,8 +21,9 @@ const VERB_SUMMARY = {
     [verb_map_1.EditionVerb.List]: 'Print the offering ids of an editions root as JSON: xema edition list --editions-root <dir>',
     [verb_map_1.EditionVerb.Locks]: 'Print the validated locks of an edition as JSON: xema edition locks <id> --data-root <dir> --editions-root <dir> --kernel <dir>',
     [verb_map_1.EditionVerb.ChartSet]: `Pin the chart set of the editions to the charts the registry serves: xema edition chart-set <${Object.values(verb_map_1.EditionChartSetOperation).join('|')}> [--check] --data-root <dir> --editions-root <dir> --deploy-root <dir> --kernel <dir>; source-commit prints the commit each publisher closed its locked set at (--data-root, --kernel)`,
-    [verb_map_1.EditionVerb.BiomeManifests]: 'Print the pinned xema-biome.json of every biome of an edition as JSON: xema edition biome-manifests <id> --json --data-root <dir> --editions-root <dir> --sources-root <dir> --source-hash <dir> --kernel <dir>',
-    [verb_map_1.EditionVerb.SourceClosure]: 'Print the source tree hash and workspace closure of a source directory at a commit as JSON: xema edition source-closure --repo <repo> --path <dir> --commit <sha> --sources-root <dir> --source-hash <dir> --kernel <dir>',
+    [verb_map_1.EditionVerb.BiomeManifests]: 'Print the pinned xema-biome.json of every biome of an edition as JSON: xema edition biome-manifests <id> --json --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
+    [verb_map_1.EditionVerb.Arming]: 'Print whether the data root evidence trust policy is armed on one channel as one JSON line, exiting 0 only when armed: xema edition arming --channel <release|develop> --data-root <dir> --kernel <dir>',
+    [verb_map_1.EditionVerb.SourceClosure]: 'Print the source tree hash and workspace closure of a source directory at a commit as JSON: xema edition source-closure --repo <repo> --path <dir> --commit <sha> --sources-root <dir> --kernel <dir>',
 };
 function registerCommand(program) {
     const edition = program.command('edition').summary('Resolve, seal and check editions');

package/dist/commands/edition.js.map

@@ -1 +1 @@
-{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAuCA,0CAiBC;AAxDD,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,8SAA8S;IAChT,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,8DAA8D;IAClF,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,qYAAqY;IAC5Z,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,sNAAsN;IACxN,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wKAAwK;IACxR,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,yDAAyD;IAC9E,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,iIAAiI;IACtJ,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yLAAyL;IAClW,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,iNAAiN;IACnN,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,2NAA2N;CAC9N,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}
+{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAyCA,0CAiBC;AA1DD,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,gMAAgM;IACpN,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,6iBAA6iB;IACpkB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,+OAA+O;IAC/V,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,yDAAyD;IAC9E,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,iIAAiI;IACtJ,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yLAAyL;IAClW,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;CAC1M,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/dev/env-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-defaults.d.ts","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAYrF,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmDpD,CAAC;AAwBH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D,CAAC;AAuCL,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMtE,CAAC;AAML,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvE,CAAC;AAeJ,wBAAgB,0BAA0B,IAAI,0BAA0B,EAAE,CAazE;AAoBD,eAAO,MAAM,0BAA0B,QAEtC,CAAC;AAiBF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3D,CAAC;AAkBL,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4I3D,CAAC;AAOL,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,CAAC,MAAM,CAAC,CAoEvB"}
+{"version":3,"file":"env-defaults.d.ts","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAYrF,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmDpD,CAAC;AAwBH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D,CAAC;AAuCL,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAMtE,CAAC;AAML,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvE,CAAC;AAeJ,wBAAgB,0BAA0B,IAAI,0BAA0B,EAAE,CAazE;AAoBD,eAAO,MAAM,0BAA0B,QAEtC,CAAC;AAiBF,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3D,CAAC;AAkBL,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwI3D,CAAC;AAOL,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,aAAa,CAAC,MAAM,CAAC,CAoEvB"}

package/dist/dev/env-defaults.js

@@ -136,7 +136,6 @@ exports.MISC_ENV_DEFAULTS = Object.freeze({
     GITHUB_APP_FRONTEND_ALLOWLIST: 'http://127.0.0.1:3000',
     SCM_WEBHOOK_SECRET: 'dev-scm-webhook-secret',
     K8S_ALLOWED_IMAGE_REGISTRIES: 'ghcr.io,docker.io,registry.k8s.io,quay.io,127.0.0.1:5000',
-    MAILOPS_OAUTH_REDIRECT_URI: 'http://127.0.0.1:3000/mailops/oauth/callback',
     LLM_GATEWAY_API_URL: backingUrl('llm-gateway-api'),
 });
 function applyDevEnvDefaults(env = process.env) {

package/dist/dev/env-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-defaults.js","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":";;;AAsOA,gEAaC;AAuND,kDAsEC;AA7eD,6CAAkD;AAElD,gEAAmE;AACnE,wFAKoD;AAcvC,QAAA,QAAQ,GAAqC,MAAM,CAAC,MAAM,CAAC;IAEtE,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,IAAI;IAE9B,qBAAqB,EAAE,IAAI;IAC3B,oBAAoB,EAAE,IAAI;IAC1B,eAAe,EAAE,IAAI;IAErB,mBAAmB,EAAE,IAAI;IACzB,yBAAyB,EAAE,IAAI;IAC/B,cAAc,EAAE,IAAI;IACpB,4BAA4B,EAAE,IAAI;IAClC,qBAAqB,EAAE,IAAI;IAC3B,mBAAmB,EAAE,IAAI;IAIzB,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,sBAAsB,EAAE,IAAI;IAC5B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;IAKtB,kBAAkB,EAAE,IAAI;IACxB,mBAAmB,EAAE,IAAI;IACzB,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,4BAA4B,EAAE,IAAI;IAClC,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,IAAI;IACxB,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAO9B,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAwBU,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,0DAA0D;IACxE,SAAS,EAAE,wBAAwB;IAKnC,WAAW,EAAE,gCAAgC;IAC7C,gBAAgB,EAAE,gBAAgB;CAInC,CAAC,CAAC;AAkDQ,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;IAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACjC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CAChC,CAAC,CAAC;AAMQ,QAAA,4BAA4B,GACvC,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI;IACJ,IAAI,CAAC,IAAI;CACV,CAAC,CACH,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,oBAAoB,MAAM,CAAC,0BAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAY9D,SAAgB,0BAA0B;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,GAAG;YAGH,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI;gBACpC,UAAU,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE;aACxC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAoBY,QAAA,0BAA0B,GAAG,IAAI,CAAC,SAAS,CACtD,0BAA0B,EAAE,CAC7B,CAAC;AAeF,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAEzD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAChB,iEAAiE;IAInE,2BAA2B,EAAE,+BAA+B;IAC5D,mBAAmB,EAAE,+BAA+B;IACpD,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAOL,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAUxD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IAGZ,sBAAsB,EAAE,MAAM;IAC9B,qBAAqB,EAAE,OAAO;IAU9B,oBAAoB,EAAE,uCAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;IAErD,eAAe,EAAE,uBAAuB;IAExC,0BAA0B,EAAE,OAAO;IAKnC,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,UAAU;IACjC,WAAW,EAAE,uBAAuB;IACpC,gBAAgB,EAAE,YAAY;IAC9B,oBAAoB,EAAE,YAAY;IAClC,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,MAAM;IAK3B,kBAAkB,EAAE,uBAAuB;IAC3C,kBAAkB,EAAE,uBAAuB;IAI3C,qBAAqB,EAAE,gBAAgB;IAIvC,uBAAuB,EAAE,sBAAsB;IAC/C,2BAA2B,EAAE,sBAAsB;IACnD,qBAAqB,EAAE,sBAAsB;IAG7C,qBAAqB,EAAE,uBAAuB;IAE9C,sBAAsB,EAAE,uCAAuC;IAC/D,uBAAuB,EAAE,uBAAuB;IAGhD,eAAe,EAAE,cAAc;IAG/B,4BAA4B,EAAE,gBAAgB;IAM9C,iCAAiC,EAAE,8BAA8B;IACjE,gCAAgC,EAAE,8BAA8B;IAGhE,mCAAmC,EAAE,wBAAwB;IAC7D,kCAAkC,EAAE,uBAAuB;IAC3D,mCAAmC,EAAE,qBAAqB;IAC1D,gCAAgC,EAAE,8BAA8B;IAIhE,wBAAwB,EAAE,wBAAwB;IAGlD,sBAAsB,EAAE,mBAAmB;IAK3C,oBAAoB,EAAE,4CAAkB,CAAC,OAAO;IAChD,eAAe,EAAE,IAAA,6CAAmB,EAAC,KAAK,CAAC;IAC3C,mBAAmB,EAAE,2CAAiB,CAAC,KAAK;IAC5C,kBAAkB,EAAE,kDAAwB;IAE5C,qBAAqB,EAAE,SAAS;IAGhC,uBAAuB,EAAE,OAAO;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,8BAA8B,EAAE,mBAAmB;IAGnD,qBAAqB,EAAE,WAAW;IAIlC,yBAAyB,EAAE,MAAM;IACjC,sBAAsB,EAAE,uBAAuB;IAC/C,YAAY,EAAE,uBAAuB;IACrC,QAAQ,EAAE,WAAW;IACrB,gBAAgB,EAAE,8BAA8B;IAIhD,qBAAqB,EAAE,mBAAmB;IAC1C,sBAAsB,EAAE,mBAAmB;IAC3C,6BAA6B,EAAE,WAAW;IAQ1C,aAAa,EAAE,QAAQ;IACvB,cAAc,EAAE,kCAAkC;IAElD,SAAS,EAAE,uBAAuB;IAElC,6BAA6B,EAAE,uBAAuB;IAEtD,kBAAkB,EAAE,wBAAwB;IAK5C,4BAA4B,EAC1B,0DAA0D;IAI5D,0BAA0B,EAAE,8CAA8C;IAI1E,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC;CACnD,CAAC,CAAC;AAOL,SAAgB,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAKF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAAE,CAAC;QACjE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAID,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,oBAAoB,MAAM,CAAC,gBAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAG9C,YAAY,CAAC,wBAAwB,EAAE,kCAA0B,CAAC,CAAC;IACnE,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzE,YAAY,CACV,iBAAiB,EACjB,GAAG,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CACxD,CAAC;IAEF,YAAY,CACV,iCAAiC,EACjC,MAAM,CAAC,wBAAwB,CAAC,CACjC,CAAC;IACF,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElE,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtE,YAAY,CACV,yBAAyB,EACzB,GAAG,MAAM,CAAC,uBAAuB,CAAC,wBAAwB,CAC3D,CAAC;IAMF,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,iCAAmB,EAAC,KAAK,EAAE;gBAChD,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBACxC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAClE,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"env-defaults.js","sourceRoot":"","sources":["../../src/dev/env-defaults.ts"],"names":[],"mappings":";;;AAsOA,gEAaC;AAmND,kDAsEC;AAzeD,6CAAkD;AAElD,gEAAmE;AACnE,wFAKoD;AAcvC,QAAA,QAAQ,GAAqC,MAAM,CAAC,MAAM,CAAC;IAEtE,oBAAoB,EAAE,IAAI;IAC1B,wBAAwB,EAAE,IAAI;IAE9B,qBAAqB,EAAE,IAAI;IAC3B,oBAAoB,EAAE,IAAI;IAC1B,eAAe,EAAE,IAAI;IAErB,mBAAmB,EAAE,IAAI;IACzB,yBAAyB,EAAE,IAAI;IAC/B,cAAc,EAAE,IAAI;IACpB,4BAA4B,EAAE,IAAI;IAClC,qBAAqB,EAAE,IAAI;IAC3B,mBAAmB,EAAE,IAAI;IAIzB,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,sBAAsB,EAAE,IAAI;IAC5B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;IAKtB,kBAAkB,EAAE,IAAI;IACxB,mBAAmB,EAAE,IAAI;IACzB,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,4BAA4B,EAAE,IAAI;IAClC,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,IAAI;IACxB,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAO9B,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAwBU,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,0DAA0D;IACxE,SAAS,EAAE,wBAAwB;IAKnC,WAAW,EAAE,gCAAgC;IAC7C,gBAAgB,EAAE,gBAAgB;CAInC,CAAC,CAAC;AAkDQ,QAAA,kBAAkB,GAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;IAC5D,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACjC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CAChC,CAAC,CAAC;AAMQ,QAAA,4BAA4B,GACvC,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI;IACJ,IAAI,CAAC,IAAI;CACV,CAAC,CACH,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,oBAAoB,MAAM,CAAC,0BAAkB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAY9D,SAAgB,0BAA0B;IACxC,OAAO,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,GAAG;YAGH,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI;gBACpC,UAAU,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE;aACxC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAoBY,QAAA,0BAA0B,GAAG,IAAI,CAAC,SAAS,CACtD,0BAA0B,EAAE,CAC7B,CAAC;AAeF,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAEzD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,UAAU,EAAE,mCAAmC;IAC/C,kBAAkB,EAChB,iEAAiE;IAInE,2BAA2B,EAAE,+BAA+B;IAC5D,mBAAmB,EAAE,+BAA+B;IACpD,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC;AAOL,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAUxD,QAAA,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IAGZ,sBAAsB,EAAE,MAAM;IAC9B,qBAAqB,EAAE,OAAO;IAU9B,oBAAoB,EAAE,uCAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;IAErD,eAAe,EAAE,uBAAuB;IAExC,0BAA0B,EAAE,OAAO;IAKnC,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,UAAU;IACjC,WAAW,EAAE,uBAAuB;IACpC,gBAAgB,EAAE,YAAY;IAC9B,oBAAoB,EAAE,YAAY;IAClC,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,MAAM;IAK3B,kBAAkB,EAAE,uBAAuB;IAC3C,kBAAkB,EAAE,uBAAuB;IAI3C,qBAAqB,EAAE,gBAAgB;IAIvC,uBAAuB,EAAE,sBAAsB;IAC/C,2BAA2B,EAAE,sBAAsB;IACnD,qBAAqB,EAAE,sBAAsB;IAG7C,qBAAqB,EAAE,uBAAuB;IAE9C,sBAAsB,EAAE,uCAAuC;IAC/D,uBAAuB,EAAE,uBAAuB;IAGhD,eAAe,EAAE,cAAc;IAG/B,4BAA4B,EAAE,gBAAgB;IAM9C,iCAAiC,EAAE,8BAA8B;IACjE,gCAAgC,EAAE,8BAA8B;IAGhE,mCAAmC,EAAE,wBAAwB;IAC7D,kCAAkC,EAAE,uBAAuB;IAC3D,mCAAmC,EAAE,qBAAqB;IAC1D,gCAAgC,EAAE,8BAA8B;IAIhE,wBAAwB,EAAE,wBAAwB;IAGlD,sBAAsB,EAAE,mBAAmB;IAK3C,oBAAoB,EAAE,4CAAkB,CAAC,OAAO;IAChD,eAAe,EAAE,IAAA,6CAAmB,EAAC,KAAK,CAAC;IAC3C,mBAAmB,EAAE,2CAAiB,CAAC,KAAK;IAC5C,kBAAkB,EAAE,kDAAwB;IAE5C,qBAAqB,EAAE,SAAS;IAGhC,uBAAuB,EAAE,OAAO;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,8BAA8B,EAAE,mBAAmB;IAGnD,qBAAqB,EAAE,WAAW;IAIlC,yBAAyB,EAAE,MAAM;IACjC,sBAAsB,EAAE,uBAAuB;IAC/C,YAAY,EAAE,uBAAuB;IACrC,QAAQ,EAAE,WAAW;IACrB,gBAAgB,EAAE,8BAA8B;IAIhD,qBAAqB,EAAE,mBAAmB;IAC1C,sBAAsB,EAAE,mBAAmB;IAC3C,6BAA6B,EAAE,WAAW;IAQ1C,aAAa,EAAE,QAAQ;IACvB,cAAc,EAAE,kCAAkC;IAElD,SAAS,EAAE,uBAAuB;IAElC,6BAA6B,EAAE,uBAAuB;IAEtD,kBAAkB,EAAE,wBAAwB;IAK5C,4BAA4B,EAC1B,0DAA0D;IAI5D,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC;CACnD,CAAC,CAAC;AAOL,SAAgB,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAKF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAAE,CAAC;QACjE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAiB,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAID,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,oBAAoB,MAAM,CAAC,gBAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAG9C,YAAY,CAAC,wBAAwB,EAAE,kCAA0B,CAAC,CAAC;IACnE,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACzE,YAAY,CACV,iBAAiB,EACjB,GAAG,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CACxD,CAAC;IAEF,YAAY,CACV,iCAAiC,EACjC,MAAM,CAAC,wBAAwB,CAAC,CACjC,CAAC;IACF,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElE,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACtE,YAAY,CACV,yBAAyB,EACzB,GAAG,MAAM,CAAC,uBAAuB,CAAC,wBAAwB,CAC3D,CAAC;IAMF,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAA,iCAAmB,EAAC,KAAK,EAAE;gBAChD,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBACxC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAClE,2BAA2B,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -51003,8 +51003,7 @@ var WorkspaceRoot = Object.freeze({
   Sources: "sourcesRoot",
   Kernel: "kernelPackageDir",
   Deploy: "deployRoot",
-  Cache: "cacheDir",
-  SourceHash: "sourceHashPackageDir"
+  Cache: "cacheDir"
 });
 var WORKSPACE_FLAGS = Object.freeze({
   [WorkspaceRoot.Data]: "--data-root",
@@ -51012,8 +51011,7 @@ var WORKSPACE_FLAGS = Object.freeze({
   [WorkspaceRoot.Sources]: "--sources-root",
   [WorkspaceRoot.Kernel]: "--kernel",
   [WorkspaceRoot.Deploy]: "--deploy-root",
-  [WorkspaceRoot.Cache]: "--cache-dir",
-  [WorkspaceRoot.SourceHash]: "--source-hash"
+  [WorkspaceRoot.Cache]: "--cache-dir"
 });
 var ROOT_MEANING = Object.freeze({
   [WorkspaceRoot.Data]: "the directory holding the catalogue indices and the trust policy",
@@ -51021,8 +51019,7 @@ var ROOT_MEANING = Object.freeze({
   [WorkspaceRoot.Sources]: "the directory holding source checkouts at repos/<r> and submodules/<r>",
   [WorkspaceRoot.Kernel]: "the BUILT kernel-contracts package directory",
   [WorkspaceRoot.Deploy]: "the deploy (chart tree) checkout",
-  [WorkspaceRoot.Cache]: "a writable directory for fetched artifacts",
-  [WorkspaceRoot.SourceHash]: "the BUILT distribution-source-hash package directory (the source-tree and image-input hash implementation)"
+  [WorkspaceRoot.Cache]: "a writable directory for fetched artifacts"
 });
 var configured = Object.freeze({});
 function assertDirectory(name, value) {
@@ -51062,7 +51059,7 @@ function root(name) {
 var dataRoot = () => root(WorkspaceRoot.Data);
 var editionsRoot = () => root(WorkspaceRoot.Editions);
 var kernelPackageDir = () => root(WorkspaceRoot.Kernel);
-function configureEditionWorkspaceFromArgv(argv, needs) {
+function configureEditionWorkspaceFromArgv(argv, needs, { refuseOthers = false } = {}) {
   const byFlag = new Map(
     Object.entries(WORKSPACE_FLAGS).map(([name, flag]) => [flag, name])
   );
@@ -51077,6 +51074,11 @@ function configureEditionWorkspaceFromArgv(argv, needs) {
       rest.push(arg);
       continue;
     }
+    if (refuseOthers && !needs.includes(name)) {
+      throw new Error(
+        `${flag} is not a root this command takes (it takes: ${needs.length === 0 ? "no root" : needs.map((root2) => WORKSPACE_FLAGS[root2]).join(" ")})`
+      );
+    }
     const value = eq > 0 ? arg.slice(eq + 1) : argv[i += 1];
     if (typeof value !== "string" || value.length === 0 || value.startsWith("--")) {
       throw new Error(`${flag} requires a directory path`);
@@ -51108,16 +51110,80 @@ var CHART_VERSION_COORDINATE = Object.freeze({
   [EditionChannel.Release]: /-h[0-9a-f]{16}$/,
   [EditionChannel.Develop]: /-dev\.[0-9a-f]{12}$/
 });
+var DEVELOP_CHART_VERSION_PREFIX = "0.0.0-dev.";
+var DEVELOP_CHART_SHA_LENGTH = 12;
+var DEVELOP_CHART_VERSION_PATTERN = new RegExp(
+  `^${DEVELOP_CHART_VERSION_PREFIX.replaceAll(".", "\\.")}[0-9a-f]{${DEVELOP_CHART_SHA_LENGTH}}$`
+);
+
+// edition/edition-contract-parse.mjs
+var EDITION_CONTRACT_SCHEMA = "xema.edition-contract/v2";
+var SEGMENT = /^[a-z0-9][a-z0-9.-]*$/;
+function parseEditionContract(contract) {
+  if (contract === null || typeof contract !== "object" || Array.isArray(contract)) {
+    throw new Error("edition-contract.json must be a JSON object");
+  }
+  if (contract.schema !== EDITION_CONTRACT_SCHEMA) {
+    throw new Error(`edition-contract.json: schema is ${JSON.stringify(contract.schema)}, expected ${JSON.stringify(EDITION_CONTRACT_SCHEMA)}`);
+  }
+  if (typeof contract.vendoring !== "string" || contract.vendoring === "") {
+    throw new Error('edition-contract.json: "vendoring" must be the non-empty statement of how a consumer vendors this file');
+  }
+  if (typeof contract.repositoryPrefix !== "string" || contract.repositoryPrefix === "") {
+    throw new Error('edition-contract.json: "repositoryPrefix" must be a non-empty string');
+  }
+  const repositories = contract.repositories;
+  if (repositories === null || typeof repositories !== "object" || Array.isArray(repositories)) {
+    throw new Error('edition-contract.json has no "repositories": the namespace segment of each channel is read from it and nowhere else');
+  }
+  const channels = Object.values(EditionChannel);
+  const keys = Object.keys(repositories);
+  const unknown = keys.filter((key) => !channels.includes(key));
+  if (unknown.length > 0 || keys.length !== channels.length) {
+    throw new Error(
+      `edition-contract.json: "repositories" is exactly one entry per channel (${channels.join(" | ")}); ` + (unknown.length > 0 ? `unknown channel ${unknown.map((key) => JSON.stringify(key)).join(", ")}` : `got ${keys.join(", ") || "none"}`)
+    );
+  }
+  const segments = /* @__PURE__ */ new Set();
+  for (const channel of channels) {
+    const entry = repositories[channel];
+    const entryKeys = entry !== null && typeof entry === "object" && !Array.isArray(entry) ? Object.keys(entry) : [];
+    if (entryKeys.join() !== "namespaceSegment" || typeof entry.namespaceSegment !== "string" || !SEGMENT.test(entry.namespaceSegment)) {
+      throw new Error(`edition-contract.json: repositories.${channel} is exactly {namespaceSegment}, one lowercase path segment`);
+    }
+    segments.add(entry.namespaceSegment);
+  }
+  if (segments.size !== channels.length) {
+    throw new Error("edition-contract.json: the channels' namespace segments must differ");
+  }
+  return contract;
+}
 
 // edition/edition-contract.json
 var edition_contract_default = {
-  schema: "xema.edition-contract/v1",
+  schema: "xema.edition-contract/v2",
+  vendoring: "This file is the single source of the edition artifact coordinates and names. A consumer vendors it BYTE-IDENTICAL from a stated xema-cli commit and never edits it. It reads both repository namespace segments (repositories.<channel>.namespaceSegment) and the repository prefix (repositoryPrefix) only from this file, and refuses a contract that has no `repositories`.",
   artifactType: "application/vnd.xema.edition.v1+json",
   repositoryPrefix: "xema-edition-",
+  repositories: {
+    release: {
+      namespaceSegment: "editions"
+    },
+    develop: {
+      namespaceSegment: "develop-editions"
+    }
+  },
   descriptorFile: "xema-edition.json",
   descriptorSchema: "xema.edition/v1",
-  locks: ["distribution.lock.json", "images.lock.json", "authorization.lock.json", "chart-set.lock.json"],
-  offeringLayers: { catalogue: "catalogue.json" },
+  locks: [
+    "distribution.lock.json",
+    "images.lock.json",
+    "authorization.lock.json",
+    "chart-set.lock.json"
+  ],
+  offeringLayers: {
+    catalogue: "catalogue.json"
+  },
   provenancePins: {
     catalogue: "the sha256 digest (sha256:<64 hex>) of the offering artifact a customer edition was resolved against; every other pin is a 40-hex commit"
   },
@@ -51125,21 +51191,24 @@ var edition_contract_default = {
   evidenceTrust: {
     states: {
       armed: "the data root declares an evidence trust policy that is pinned and ARMED on the channel of the edition",
-      "not-armed": "a release edition: exactly, the data root's evidenceTrustPolicy.required is false and it has no policy armed on the release channel; a develop edition: its policy is not armed on the develop channel, whatever required says"
+      "not-armed": "a develop edition only: its data root declares no policy, or one that is not armed on the develop channel. A release edition never records not-armed"
     },
     refusal: {
       code: "EVIDENCE_TRUST_REQUIRED_UNARMED",
-      when: "evidenceTrustPolicy.required is true while the policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there): `xema edition check` fails, no release edition is sealed and no release artifact is written, so a release descriptor never records not-armed for a required data root. Arming is judged per channel: a develop edition admits not-armed"
+      when: "a release edition is written while the data root's evidence trust policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there): no release descriptor or artifact is written, and no configuration key admits one. Arming is judged per channel: a develop edition admits not-armed"
     }
   }
 };
 
 // edition/edition-constants.mjs
-var EDITION_CONTRACT = Object.freeze(structuredClone(edition_contract_default));
+var EDITION_CONTRACT = Object.freeze(structuredClone(parseEditionContract(edition_contract_default)));
 var EDITION_DESCRIPTOR_FILE = EDITION_CONTRACT.descriptorFile;
 var EDITION_DESCRIPTOR_SCHEMA = EDITION_CONTRACT.descriptorSchema;
 var EDITION_ARTIFACT_TYPE = EDITION_CONTRACT.artifactType;
 var EDITION_REPOSITORY_PREFIX = EDITION_CONTRACT.repositoryPrefix;
+var EDITION_REPOSITORY_SEGMENTS = Object.freeze(
+  Object.fromEntries(Object.values(EditionChannel).map((channel) => [channel, EDITION_CONTRACT.repositories[channel].namespaceSegment]))
+);
 var EvidenceTrustState = Object.freeze({ Armed: "armed", NotArmed: "not-armed" });
 var DEVELOP_IMAGE_NAMESPACE_SEGMENT = EDITION_CONTRACT.imageNamespaceSegment;
 var EDITION_OFFERING_LAYERS = Object.freeze({ ...EDITION_CONTRACT.offeringLayers });
@@ -51706,6 +51775,22 @@ function requireSourceAuthUsername(config) {
   }
   return value;
 }
+function optionalChartSet(document) {
+  const registry = document.chartRegistry !== void 0;
+  const publishers = document.chartPublishers !== void 0;
+  if (registry !== publishers) {
+    throw new EditionWorkspaceConfigError(
+      `${EDITION_WORKSPACE_CONFIG_FILE}: "chartRegistry" and "chartPublishers" are a vendor-only pair, both declared or both absent; only "${registry ? "chartRegistry" : "chartPublishers"}" is`
+    );
+  }
+  if (!registry) {
+    return {};
+  }
+  return {
+    chartRegistry: requireString(document, "chartRegistry", CHART_REGISTRY, "oci://<host>/<path>"),
+    chartPublishers: requirePublishers(document)
+  };
+}
 function requirePublishers(config) {
   const value = config.chartPublishers;
   if (!Array.isArray(value) || value.length === 0) {
@@ -51726,35 +51811,35 @@ function requirePublishers(config) {
     })
   );
 }
-var EVIDENCE_TRUST_POLICY_KEYS = Object.freeze(["pin", "policy", "required"]);
+var EVIDENCE_TRUST_POLICY_KEYS = Object.freeze(["pin", "policy"]);
 function isDataRootRelativePath(value) {
   return typeof value === "string" && DATA_ROOT_RELATIVE_PATH.test(value) && value.split("/").every((segment) => segment !== "." && segment !== "..");
 }
 function requireEvidenceTrustPolicy(config) {
   if (!Object.hasOwn(config, "evidenceTrustPolicy")) {
     throw new EditionWorkspaceConfigError(
-      `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is required: {"required": true, "policy": ..., "pin": ...} or {"required": false} (no default: say whether this data root's editions must be evidence-gated)`
+      `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is required: {"policy": ..., "pin": ...}, or null to state that this data root declares no policy (no release edition can then be sealed from it)`
     );
   }
   const value = config.evidenceTrustPolicy;
-  const shapeError = () => new EditionWorkspaceConfigError(
-    `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is exactly {required: boolean} or {required, policy, pin} with both paths data-root-relative`
+  if (value === null) {
+    return Object.freeze({ policy: null, pin: null });
+  }
+  const shapeError = (detail) => new EditionWorkspaceConfigError(
+    `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy" is exactly null or {policy, pin} with both paths data-root-relative${detail}`
   );
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw shapeError();
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw shapeError("");
   }
   const keys = Object.keys(value).sort();
-  if (!keys.every((key) => EVIDENCE_TRUST_POLICY_KEYS.includes(key)) || typeof value.required !== "boolean") {
-    throw shapeError();
-  }
-  const declared = keys.length > 1;
-  if (declared && keys.join() !== EVIDENCE_TRUST_POLICY_KEYS.join()) {
-    throw shapeError();
+  const unknown = keys.filter((key) => !EVIDENCE_TRUST_POLICY_KEYS.includes(key));
+  if (unknown.length > 0) {
+    throw shapeError(`; unknown key ${unknown.map((key) => `"${key}"`).join(", ")}`);
   }
-  if (!declared) {
-    return Object.freeze({ required: value.required, policy: null, pin: null });
+  if (keys.join() !== EVIDENCE_TRUST_POLICY_KEYS.join()) {
+    throw shapeError("");
   }
-  for (const key of ["policy", "pin"]) {
+  for (const key of EVIDENCE_TRUST_POLICY_KEYS) {
     if (!isDataRootRelativePath(value[key])) {
       throw new EditionWorkspaceConfigError(
         `${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy.${key}" must be a data-root-relative POSIX path without "." or ".." segments; got ${JSON.stringify(value[key])}`
@@ -51764,7 +51849,7 @@ function requireEvidenceTrustPolicy(config) {
   if (value.policy === value.pin) {
     throw new EditionWorkspaceConfigError(`${EDITION_WORKSPACE_CONFIG_FILE}: "evidenceTrustPolicy.policy" and ".pin" must be different files`);
   }
-  return Object.freeze({ required: value.required, policy: value.policy, pin: value.pin });
+  return Object.freeze({ policy: value.policy, pin: value.pin });
 }
 function parseEditionWorkspaceConfig(document) {
   if (document === null || typeof document !== "object" || Array.isArray(document)) {
@@ -51784,8 +51869,7 @@ function parseEditionWorkspaceConfig(document) {
   return Object.freeze({
     ...sections,
     imageRegistry: requireString(document, "imageRegistry", IMAGE_REGISTRY, "<host>/<namespace> with no scheme or trailing slash"),
-    chartRegistry: requireString(document, "chartRegistry", CHART_REGISTRY, "oci://<host>/<path>"),
-    chartPublishers: requirePublishers(document),
+    ...optionalChartSet(document),
     sourceRepositoryUrlPrefix: requireString(document, "sourceRepositoryUrlPrefix", SOURCE_URL_PREFIX, "https://<host>/<organisation>/ with a trailing slash"),
     sourceAuthUsername: requireSourceAuthUsername(document),
     evidenceTrustPolicy: requireEvidenceTrustPolicy(document)
@@ -52015,6 +52099,11 @@ function parseEditionDescriptor(value) {
   if (!Object.values(EvidenceTrustState).includes(value.evidenceTrustPolicy)) {
     throw new Error(`${EDITION_DESCRIPTOR_FILE}: evidenceTrustPolicy must be one of ${Object.values(EvidenceTrustState).join(" | ")}`);
   }
+  if (value.provenance.channel === EditionChannel.Release && value.evidenceTrustPolicy !== EvidenceTrustState.Armed) {
+    throw new Error(
+      `${EDITION_DESCRIPTOR_FILE}: a release edition requires an armed evidence trust policy; "${value.distributionId}" records ${JSON.stringify(value.evidenceTrustPolicy)}`
+    );
+  }
   exactKeys(value.engine, ["image"], `${EDITION_DESCRIPTOR_FILE} engine`);
   assertEngineImage(value.engine.image);
   return value;
@@ -52453,6 +52542,21 @@ function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
     group.requirements.push({ root: canonicalRoot, label, requiredPaths });
     byRepository.set(location.repositoryRoot, group);
   }
+  if (expected !== void 0) {
+    const regraded = new Set(
+      [...byRepository.values()].flatMap((group) => group.requirements.map(({ root: root2 }) => root2))
+    );
+    for (const root2 of regraded) {
+      if (typeof expected.get(root2)?.commit !== "string") {
+        throw new Error(`${root2} was not graded first, so its HEAD cannot be held unchanged`);
+      }
+    }
+    for (const root2 of expected.keys()) {
+      if (!regraded.has(root2)) {
+        throw new Error(`${root2} was graded first and is missing from the re-grade`);
+      }
+    }
+  }
   const result = /* @__PURE__ */ new Map();
   for (const [repositoryRoot, group] of byRepository) {
     assertTrustedCheckoutLocation(group.location, group.labels.join(" + "));
@@ -52460,9 +52564,12 @@ function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
       repositoryRoot,
       requirements: group.requirements,
       trustedGit,
-      expectedCommit: expected?.get(group.requirements[0].root)?.commit
+      expectedCommit: expected?.get(group.requirements[0].root).commit
     });
     for (const { root: root2 } of group.requirements) {
+      if (expected !== void 0 && expected.get(root2).commit !== graded.commit) {
+        throw new Error(`${repositoryRoot} HEAD changed during verification`);
+      }
       result.set(root2, graded);
     }
   }
@@ -53553,6 +53660,59 @@ function assertPinnedVerifier({ pin, actual }) {
   }
 }
 
+// edition/image-delivery-entitlement-descriptor.mjs
+import { dirname as dirname4, join as join6 } from "node:path";
+var ENTITLEMENT_DESCRIPTOR_FILE = "entitlement.json";
+var ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION = 2;
+var ENTITLEMENT_DESCRIPTOR_KEYS = Object.freeze([
+  "schemaVersion",
+  "distributionId",
+  "customerId",
+  "mode",
+  "targetRegistry",
+  "idempotencyKey",
+  "distributionStatementDigest",
+  "evidence"
+]);
+function parseEntitlementDescriptorDocument(raw, schemas2) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} must be a JSON object`);
+  }
+  if (raw.schemaVersion !== ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION) {
+    throw new Error(
+      `${ENTITLEMENT_DESCRIPTOR_FILE} has schemaVersion ${JSON.stringify(raw.schemaVersion)}; this verifier reads schemaVersion ${ENTITLEMENT_DESCRIPTOR_SCHEMA_VERSION} only (accept the entitlement again with this CLI)`
+    );
+  }
+  const keys = Object.keys(raw).sort();
+  const expected = [...ENTITLEMENT_DESCRIPTOR_KEYS].sort();
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {
+    throw new Error(
+      `${ENTITLEMENT_DESCRIPTOR_FILE} must hold exactly the keys ${ENTITLEMENT_DESCRIPTOR_KEYS.join(", ")}; it holds ${keys.join(", ")}`
+    );
+  }
+  for (const key of ["distributionId", "customerId", "mode", "idempotencyKey", "distributionStatementDigest"]) {
+    if (typeof raw[key] !== "string" || raw[key] === "") {
+      throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} "${key}" must be a non-empty string`);
+    }
+  }
+  if (raw.targetRegistry !== null && (typeof raw.targetRegistry !== "string" || raw.targetRegistry === "")) {
+    throw new Error(`${ENTITLEMENT_DESCRIPTOR_FILE} "targetRegistry" must be null or a non-empty string`);
+  }
+  return { ...raw, evidence: schemas2.SigstoreEvidenceDescriptorSchema.parse(raw.evidence) };
+}
+function assertEntitlementDescriptorStates(document, expected) {
+  for (const key of ["distributionId", "customerId", "mode", "targetRegistry", "distributionStatementDigest"]) {
+    if (document[key] !== expected[key]) {
+      throw new Error(
+        `${ENTITLEMENT_DESCRIPTOR_FILE} states ${key} ${JSON.stringify(document[key])}, not the ${JSON.stringify(expected[key])} this verification was asked for`
+      );
+    }
+  }
+}
+function entitlementEvidenceRoot(evidenceRoot, entitlementDescriptorPath) {
+  return dirname4(join6(evidenceRoot, entitlementDescriptorPath));
+}
+
 // edition/image-evidence-replay-state.mjs
 import { randomUUID } from "node:crypto";
 import {
@@ -53567,7 +53727,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute5, join as join6 } from "node:path";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute5, join as join7 } from "node:path";
 var MAX_REPLAY_STATE_BYTES = 64 * 1024;
 function openRegularFileNoFollow(path) {
   const descriptor = openSync3(
@@ -53614,8 +53774,8 @@ function assertTrustedStateDirectory(path) {
   }
 }
 function writeDurableReplacement(path, value) {
-  const directory = realpathSync5(dirname4(path));
-  const temporaryPath = join6(
+  const directory = realpathSync5(dirname5(path));
+  const temporaryPath = join7(
     directory,
     `.${basename3(path)}.${randomUUID()}.tmp`
   );
@@ -53663,12 +53823,12 @@ async function verifyAndAdvanceReplayState({
   if (!isAbsolute5(statePath)) {
     throw new Error("replay state path must be absolute");
   }
-  const stateDirectory = realpathSync5(dirname4(statePath));
-  if (stateDirectory !== dirname4(statePath)) {
+  const stateDirectory = realpathSync5(dirname5(statePath));
+  if (stateDirectory !== dirname5(statePath)) {
     throw new Error("replay state parent path must be canonical");
   }
   assertTrustedStateDirectory(stateDirectory);
-  const canonicalStatePath = join6(stateDirectory, basename3(statePath));
+  const canonicalStatePath = join7(stateDirectory, basename3(statePath));
   const lockPath = `${canonicalStatePath}.lock`;
   let lockDescriptor;
   try {
@@ -53772,7 +53932,7 @@ async function verifyAndAdvanceReplayState({
 
 // edition/verifier-binding.mjs
 import { readFileSync as readFileSync5, realpathSync as realpathSync6 } from "node:fs";
-import { dirname as dirname5, join as join7 } from "node:path";
+import { dirname as dirname6, join as join8 } from "node:path";
 
 // edition/verifier-files.mjs
 var VERIFIER_PROVENANCE_FILE = "verify-image-evidence.bundle.provenance.json";
@@ -53823,7 +53983,7 @@ function readRunningVerifier(bundlePath) {
   assertProtectedPathAncestry(realBundle, "the evidence verifier install");
   const bundleBytes = readFileSync5(realBundle);
   const provenanceBytes = readFileSync5(
-    join7(dirname5(realBundle), VERIFIER_PROVENANCE_FILE)
+    join8(dirname6(realBundle), VERIFIER_PROVENANCE_FILE)
   );
   parseVerifierProvenance({ provenanceBytes, bundleBytes });
   return { bundleBytes, provenanceBytes };
@@ -53841,11 +54001,12 @@ async function loadVerifierKernelSchemas() {
 }
 
 // edition/verify-image-evidence.mjs
-var USAGE = "usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path> [--evidence-set <relative-path>] [--json] [--entitlement <relative-path> --customer <id> --mode <mode> [--target-registry <registry>]] --data-root <dir> --editions-root <dir> --kernel <dir>";
+var USAGE = "usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path> [--evidence-set <relative-path>] [--json] [--entitlement <relative-path> --entitlement-workflow-sha <40-hex git sha> --customer <id> --mode <mode> [--target-registry <registry>]] --data-root <dir> --editions-root <dir> --kernel <dir>";
 var EVIDENCE_CHANNEL_OF_EDITION_CHANNEL = Object.freeze({
   [EditionChannel.Release]: "release",
   [EditionChannel.Develop]: "develop"
 });
+var GIT_COMMIT_SHA = /^[a-f0-9]{40}$/;
 var DATA_ROOT_FILES = Object.freeze(["edition-workspace.json", "runtime-image-source-index.json"]);
 function requireOptionValue(args, index, flag) {
   const value = args[index + 1];
@@ -53876,6 +54037,7 @@ function parseArgs(args) {
     cosignBinary: null,
     gitBinary: null,
     entitlementDescriptorPath: null,
+    entitlementWorkflowSha: null,
     customerId: null,
     mode: null,
     targetRegistry: null
@@ -53902,6 +54064,8 @@ function parseArgs(args) {
       options.gitBinary = value;
     } else if (flag === "--entitlement") {
       options.entitlementDescriptorPath = value;
+    } else if (flag === "--entitlement-workflow-sha") {
+      options.entitlementWorkflowSha = value;
     } else if (flag === "--customer") {
       options.customerId = value;
     } else if (flag === "--mode") {
@@ -53927,6 +54091,7 @@ function parseArgs(args) {
   }
   const entitlementFlags = [
     ["--entitlement", options.entitlementDescriptorPath],
+    ["--entitlement-workflow-sha", options.entitlementWorkflowSha],
     ["--customer", options.customerId],
     ["--mode", options.mode]
   ];
@@ -53937,7 +54102,10 @@ function parseArgs(args) {
     );
   }
   if (stated.length === 0 && options.targetRegistry !== null) {
-    throw new Error("--target-registry needs --entitlement, --customer and --mode");
+    throw new Error("--target-registry needs --entitlement, --entitlement-workflow-sha, --customer and --mode");
+  }
+  if (options.entitlementWorkflowSha !== null && !GIT_COMMIT_SHA.test(options.entitlementWorkflowSha)) {
+    throw new Error("--entitlement-workflow-sha must be a 40-character lowercase hexadecimal git commit SHA");
   }
   if (options.entitlementDescriptorPath !== null && isAbsolute6(options.entitlementDescriptorPath)) {
     throw new Error("--entitlement must be an evidence-root-relative path");
@@ -54105,13 +54273,26 @@ async function verifyEvidence({ argv, env, bundlePath }) {
           cosignBinary: options.cosignBinary,
           schemas: schemas2
         });
-        const entitlementDescriptor = options.entitlementDescriptorPath === null ? null : readCanonicalJsonFromRoot(
-          evidenceRoot,
-          options.entitlementDescriptorPath,
-          "delivery entitlement evidence descriptor"
+        const entitlement = options.entitlementDescriptorPath === null ? null : parseEntitlementDescriptorDocument(
+          readCanonicalJsonFromRoot(
+            evidenceRoot,
+            options.entitlementDescriptorPath,
+            "delivery entitlement descriptor"
+          ),
+          schemas2
         );
+        if (entitlement !== null) {
+          assertEntitlementDescriptorStates(entitlement, {
+            distributionId: options.distributionId,
+            customerId: options.customerId,
+            mode: options.mode,
+            targetRegistry: options.targetRegistry,
+            distributionStatementDigest: result.completenessStatementDigest
+          });
+        }
+        const entitlementDescriptor = entitlement === null ? null : entitlement.evidence;
         const entitlementStatement = entitlementDescriptor === null ? null : await verifyImageDeliveryEntitlement({
-          evidenceRoot,
+          evidenceRoot: entitlementEvidenceRoot(evidenceRoot, options.entitlementDescriptorPath),
           descriptor: entitlementDescriptor,
           policy: anchors.policy,
           policyRoot: dataRoot(),
@@ -54122,9 +54303,9 @@ async function verifyEvidence({ argv, env, bundlePath }) {
           mode: options.mode,
           targetRegistry: options.targetRegistry,
           now: /* @__PURE__ */ new Date(),
-          // The entitlement predicate carries no producer run, so there
-          // is no workflow SHA to demand and none is invented.
-          expectedWorkflowSha: void 0,
+          // The entitlement predicate carries no producer run: the commit
+          // its certificate is held to is the caller's statement.
+          expectedWorkflowSha: options.entitlementWorkflowSha,
           // A nonce spent by a producer or completeness statement of
           // this release cannot be reused by its entitlement.
           consumedNonces: result.verifiedNonces,