@xemahq/xema 0.49.1 → 0.50.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2521,343 +2521,343 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/canonical-evidence-json.mjs",
       "sha256": "sha256:3b32f6786c9fb1c0deadf2f687077356a503b0db766392d2e0254aa1ab78feec"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:f36e4f7cbe7849789422ec2f0ebce2d62f7dc3684afecc3ac51a32560e72d8a1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/cosign-certificate-constraints.mjs",
       "sha256": "sha256:f8776e6095a477d3a6b510df572de804de73d2f5abf4a0fe9040a926dbe42d73"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:319db77e708dd73a9dd4a81a963d86e52b030cad3346b104c0862af4e38a2237"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:4ca19b111d10252a067a6ee135338716ac5b509b56ba3ac475c05e9ea3c4a805"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:58af55e9a2b36ca23485246d44a295260afa240bcdc0649c697563b36085ddaa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:217fa5b1fa25cb50ee4e1b46ea5e086061ff1f44e00198e1dc28f52376f236a0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:e2c6e66378f878499f44b62d060ae50197f40757b2044d9ce05290e367dfe21d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:566a17301ad15b94a06fef12b26bbe39e292ed2bf30a2659a9bf07ce5ce487e0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-kind.mjs",
       "sha256": "sha256:b4f3358ffa81bbafb8c37d158b9e01032a7358c38b9d6e5aca409091f989e47a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:4122dfb12c0f5e9fb44c96a277f8c2a308823095f0e4bed357189f7538230eb9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-publisher.mjs",
       "sha256": "sha256:8803b41067d81acbc35a8974426f606b5b8168b7a9c2581c16586a86f36db50f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4bea69437af5a36c139b5b41d0ecf2d1ddcf3f871e10c78e3d351f608eedca3b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:eb46e4d6a79dfac5536b7a439ab9df7dd4b03af369bdcfa9fcdd522aa1aab8dd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/fulcio-certificate-extensions.mjs",
       "sha256": "sha256:6f1f5a8ea110a489f7aff4bfb8e0b2d058919fe3e8ba4a1e5e8396fca24861b7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:6902845b5a015c6576b787fe9b443bb2876e65bcadbad5b62ef724a373b9be00"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:cf0326f29b6488438497c40665feffa68b470f493cf69a2f3fb5dea9624c40d4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/kernel-contract-source-path-set.mjs",
       "sha256": "sha256:bc4756f217d80fd8f802932f47da71ab14e782873fa9fa977002a94e058d8a9e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/kernel-package.mjs",
       "sha256": "sha256:b468039179d89b0251abcdbb3020c6dcadb86a675c398a3cbb4cbca53c59830e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/lib.mjs",
       "sha256": "sha256:89b6ed1883198fc0b6eff89d9797292d80e307ad983fad559a27edde8c6c644f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:82c0fadc5b10c6f60a1258ad685aeb33e58a53c14f83d4b6d468ac71a5e4e7b4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/third-party-admission.mjs",
       "sha256": "sha256:7e32f631a8948e2b93a5cfa163390d52d2a8d9ade87a637c7fe1fc6351fe5974"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/third-party-certificate-extensions.mjs",
       "sha256": "sha256:3293267b09452199f605001d8c14070d1c822b77390caee4088e17b059b7b05d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/third-party-source-pins.mjs",
       "sha256": "sha256:6f12feb9061bd4ea3e5aeab3f369c081ab58da335c0d281e21b250251e1c0dd9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/trust-policy-image-ownership.mjs",
       "sha256": "sha256:be0c787c6a75124f0143fc0ce3b127a94e3bb7f6aa64e282c91dd84e566e550e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:156d0ee39210658ec489609629c5b9cddd3ce5b3938d8980dcf8282ae4be60bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:958360f7889985c48abb048852c5bbba349cd7353ce4b532c4511b4902380fac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:18c28e9fa2a6b7d8589c8434fc6ed9f1e93954d41339813e711ed0fbbcf5c61d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.49.1",
+      "version": "0.50.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/dist/runtime/biome-publish.d.ts

@@ -1,7 +1,7 @@
 import { type BiomeManifest } from '@xemahq/contracts/biome';
 import { type PackageImageLayers } from './biome-publish-image-layers';
 import { PublishedContentState } from './biome-published-content';
-import { PublishedAttestationState, PublishedSignatureState } from './biome-published-cosign';
+import { PublishedAttestationState, PublishedSignatureState, type CosignSigner } from './biome-published-cosign';
 export declare const BIOME_ARTIFACT_TYPE = "application/vnd.xema.biome.manifest.v1+json";
 export declare const COSIGN_KEY_ENV = "COSIGN_KEY";
 export interface PublishOptions {
@@ -14,6 +14,8 @@ export interface PublishOptions {
     readonly configPath?: string;
     readonly dryRun?: boolean;
     readonly keyless?: boolean;
+    readonly certificateIdentity?: string;
+    readonly certificateOidcIssuer?: string;
     readonly imageLock?: string;
 }
 export interface PublishPlan {
@@ -29,6 +31,7 @@ export interface PublishPlan {
     readonly tokenEnv?: string;
     readonly tokenPresent: boolean;
     readonly cosignKeyResolved: boolean;
+    readonly signer?: CosignSigner;
     readonly contentHash: string;
     readonly indexSha256: string;
     readonly published: PublishedContentState;

package/dist/runtime/biome-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"biome-publish.d.ts","sourceRoot":"","sources":["../../src/runtime/biome-publish.ts"],"names":[],"mappings":"AAkBA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,yBAAyB,EACzB,uBAAuB,EAExB,MAAM,0BAA0B,CAAC;AAwClC,eAAO,MAAM,mBAAmB,gDAAgD,CAAC;AAGjF,eAAO,MAAM,cAAc,eAAe,CAAC;AAoF3C,MAAM,WAAW,cAAc;IAE7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAW7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAW1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAO3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAMvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAM1C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAEhD,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAE1C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAC7D;AAOD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAOD,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,CA2KjE;AAUD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,iBAAiB,CA2B7F;AAYD,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItE;AA+CD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,MAAM,EAAE,CAEV;AASD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAY5D;AAgED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAOD,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,CAY5D;AA4GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBxD;AAwBD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,aAAa,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA4B9D;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAEzE"}
+{"version":3,"file":"biome-publish.d.ts","sourceRoot":"","sources":["../../src/runtime/biome-publish.ts"],"names":[],"mappings":"AAkBA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,qBAAqB,EAKtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAIL,yBAAyB,EACzB,uBAAuB,EAEvB,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAwClC,eAAO,MAAM,mBAAmB,gDAAgD,CAAC;AAGjF,eAAO,MAAM,cAAc,eAAe,CAAC;AAoF3C,MAAM,WAAW,cAAc;IAE7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAW7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAW1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAQ3B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAOxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAMvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAE/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAM1C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAEhD,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAE1C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAC7D;AAOD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAOD,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,CAsLjE;AAUD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,iBAAiB,CA2B7F;AAYD,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItE;AA+CD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,MAAM,EAAE,CAEV;AASD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAY5D;AAgED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAOD,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,CAY5D;AAsKD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBxD;AAwBD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,aAAa,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA4B9D;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAEzE"}

package/dist/runtime/biome-publish.js

@@ -55,6 +55,7 @@ class MissingRuntimeToolError extends Error {
 exports.MissingRuntimeToolError = MissingRuntimeToolError;
 function publishBiome(options) {
     const biomeDir = (0, node_path_1.resolve)(options.path);
+    assertKeylessIdentity(options);
     const manifest = loadManifest(biomeDir);
     const biomeId = manifest.xema.id;
     const version = manifest.version;
@@ -81,23 +82,26 @@ function publishBiome(options) {
         const token = auth.tokenEnv !== undefined && (options.dryRun !== true || credentials.has(auth.tokenEnv))
             ? credentials.resolve(auth.tokenEnv, auth.sourceName)
             : undefined;
-        const probed = (0, biome_published_content_1.assertPublishedContentCurrent)((0, biome_published_content_1.readPublishedContentHash)(ociRef, tag, {
-            username,
-            ...(token !== undefined ? { token } : {}),
-        }), ociRef, pack.contentHash);
+        const registryAuth = { username, ...(token !== undefined ? { token } : {}) };
+        const publishedContent = (0, biome_published_content_1.readPublishedContentHash)(ociRef, tag, registryAuth);
+        const probed = (0, biome_published_content_1.assertPublishedContentCurrent)(publishedContent, ociRef, pack.contentHash);
+        const existingSubject = publishedContent.state === biome_published_content_1.PublishedContentState.Present
+            ? `${(0, biome_published_content_1.repositoryOf)(ociRef, tag)}@${publishedContent.manifestDigest}`
+            : undefined;
         const published = probed === biome_published_content_1.PublishedContentState.Absent && token === undefined && options.dryRun === true
             ? biome_published_content_1.PublishedContentState.Unverified
             : probed;
-        const { signature, attestation } = published === biome_published_content_1.PublishedContentState.Present
-            ? (0, biome_published_cosign_1.readPublishedCosignState)(ociRef, tag, {
-                username,
-                ...(token !== undefined ? { token } : {}),
-            })
-            : biome_published_cosign_1.NOTHING_PUBLISHED;
         const cosignKey = process.env[exports.COSIGN_KEY_ENV];
         const keyless = options.keyless === true;
-        const cosignArgs = buildCosignArgs(ociRef, cosignKey, keyless);
-        const cosignAttestArgs = buildCosignAttestArgs(ociRef, cosignKey, keyless);
+        const signer = resolveSigner(options, cosignKey);
+        if (existingSubject !== undefined || options.dryRun !== true) {
+            ensureToolInstalled('cosign');
+            (0, biome_published_cosign_1.assertCosignVersionSupported)();
+        }
+        const { signature, attestation } = existingSubject !== undefined ? (0, biome_published_cosign_1.readPublishedCosignState)(existingSubject, requireSigner(signer)) : biome_published_cosign_1.NOTHING_PUBLISHED;
+        const signTarget = existingSubject ?? ociRef;
+        const cosignArgs = buildCosignArgs(signTarget, cosignKey, keyless);
+        const cosignAttestArgs = buildCosignAttestArgs(signTarget, cosignKey, keyless);
         const credentialArgs = cosignCredentialArgs(cosignKey, keyless);
         const cosignSignBlobArgs = (imageLayers?.signingJobs ?? []).map((job) => (0, biome_publish_image_layers_1.buildCosignSignBlobArgs)(job, credentialArgs));
         const plan = {
@@ -113,6 +117,7 @@ function publishBiome(options) {
             ...(auth.tokenEnv !== undefined ? { tokenEnv: auth.tokenEnv } : {}),
             tokenPresent: credentials.has(auth.tokenEnv),
             cosignKeyResolved: cosignKey !== undefined && cosignKey.length > 0,
+            ...(signer !== undefined ? { signer } : {}),
             contentHash: pack.contentHash,
             indexSha256: pack.indexSha256,
             published,
@@ -128,17 +133,11 @@ function publishBiome(options) {
         if (published === biome_published_content_1.PublishedContentState.Present &&
             signature === biome_published_cosign_1.PublishedSignatureState.Signed &&
             attestation === biome_published_cosign_1.PublishedAttestationState.Attested) {
-            console.log(`${ociRef} is already current (content.hash ${pack.contentHash}), signed and attested; nothing to publish.`);
+            console.log(`${ociRef} is already current (content.hash ${pack.contentHash}), signed and attested by this signer; nothing to publish.`);
             return plan;
         }
-        ensureToolInstalled('cosign');
         if (!keyless && !plan.cosignKeyResolved) {
-            throw new BiomePublishConfigError(`${exports.COSIGN_KEY_ENV} is not set — a published biome MUST be cosign-signed AND carry a ` +
-                'SLSA provenance attestation (the fetcher refuses artifacts missing either). ' +
-                `Set ${exports.COSIGN_KEY_ENV} to your cosign private key ref, or pass --keyless to ` +
-                'sign with an ambient OIDC identity (which is what CI should do: a first-party ' +
-                'catalog bundle must carry an identity, because that is what a publisher label ' +
-                'resolves from).');
+            throw missingCosignKeyError();
         }
         if (imageLayers !== undefined && published === biome_published_content_1.PublishedContentState.Present) {
             throw new BiomePublishConfigError(`${ociRef} is already published without these image layers; a version's artifact is immutable, so publish the image lock with a new version.`);
@@ -158,8 +157,15 @@ function publishBiome(options) {
         if (attestOwed) {
             attestProvenance({ plan, biomeDir: pack.root, startedOn });
         }
+        const verifiedSubject = existingSubject ?? publishedSubject((0, biome_published_content_1.readPublishedContentHash)(ociRef, tag, registryAuth), ociRef, tag);
+        const after = (0, biome_published_cosign_1.readPublishedCosignState)(verifiedSubject, requireSigner(signer));
+        if (after.signature !== biome_published_cosign_1.PublishedSignatureState.Signed || after.attestation !== biome_published_cosign_1.PublishedAttestationState.Attested) {
+            throw new BiomePublishConfigError(`${verifiedSubject} is not signed and attested by the declared signer after publishing ` +
+                `(signature: ${after.signature}, attestation: ${after.attestation}). The signer declared with ` +
+                '--certificate-identity / --certificate-oidc-issuer (or COSIGN_KEY) is not the one cosign signed as.');
+        }
         console.log(published === biome_published_content_1.PublishedContentState.Present
-            ? `Completed an already-published artifact: ${ociRef} (content.hash ${pack.contentHash}) — ${[signOwed ? 'signed it' : undefined, attestOwed ? 'attested it' : undefined].filter((x) => x !== undefined).join(' and ')}.`
+            ? `Completed an already-published artifact: ${ociRef} (content.hash ${pack.contentHash}), as this signer — ${[signOwed ? 'signed it' : undefined, attestOwed ? 'attested it' : undefined].filter((x) => x !== undefined).join(' and ')}.`
             : `Published, signed and attested ${ociRef}.`);
         return plan;
     }
@@ -286,6 +292,50 @@ function buildOrasArgs(input) {
     }
     return args;
 }
+function publishedSubject(content, ociRef, tag) {
+    if (content.state !== biome_published_content_1.PublishedContentState.Present) {
+        throw new biome_published_content_1.PublishedContentProbeError(`${ociRef} is not readable after publishing, so its signature cannot be verified.`);
+    }
+    return `${(0, biome_published_content_1.repositoryOf)(ociRef, tag)}@${content.manifestDigest}`;
+}
+function assertKeylessIdentity(options) {
+    const given = (value) => value !== undefined && value.length > 0;
+    if (options.keyless === true) {
+        if (!given(options.certificateIdentity) || !given(options.certificateOidcIssuer)) {
+            throw new BiomePublishConfigError('--keyless requires --certificate-identity <uri> and --certificate-oidc-issuer <url>: the signer this ' +
+                'run signs and attests as, which decides what an already-published tag still owes it. They are not ' +
+                'derived from GITHUB_WORKFLOW_REF (Fulcio signs the job_workflow_ref, which differs for a reusable workflow).');
+        }
+        return;
+    }
+    if (given(options.certificateIdentity) || given(options.certificateOidcIssuer)) {
+        throw new BiomePublishConfigError('--certificate-identity and --certificate-oidc-issuer name a keyless signer; pass --keyless with them, or drop them to sign with COSIGN_KEY.');
+    }
+}
+function resolveSigner(options, cosignKey) {
+    if (options.keyless === true) {
+        return {
+            kind: biome_published_cosign_1.CosignSignerKind.Keyless,
+            identity: options.certificateIdentity,
+            issuer: options.certificateOidcIssuer,
+        };
+    }
+    return cosignKey !== undefined && cosignKey.length > 0 ? { kind: biome_published_cosign_1.CosignSignerKind.Key, keyRef: cosignKey } : undefined;
+}
+function requireSigner(signer) {
+    if (signer === undefined) {
+        throw missingCosignKeyError();
+    }
+    return signer;
+}
+function missingCosignKeyError() {
+    return new BiomePublishConfigError(`${exports.COSIGN_KEY_ENV} is not set — a published biome MUST be cosign-signed AND carry a ` +
+        'SLSA provenance attestation (the fetcher refuses artifacts missing either). ' +
+        `Set ${exports.COSIGN_KEY_ENV} to your cosign private key ref, or pass --keyless ` +
+        '--certificate-identity <uri> --certificate-oidc-issuer <url> to sign with an ambient OIDC ' +
+        'identity (which is what CI should do: a first-party catalog bundle must carry an identity, ' +
+        'because that is what a publisher label resolves from).');
+}
 function buildCosignArgs(ociRef, cosignKey, keyless) {
     if (keyless) {
         return ['sign', '--yes', ociRef];
@@ -393,13 +443,13 @@ const PUBLISHED_PLAN_TEXT = {
     [biome_published_content_1.PublishedContentState.Unverified]: 'unverified (no registry credentials)',
 };
 const PUBLISHED_SIGNATURE_PLAN_TEXT = {
-    [biome_published_cosign_1.PublishedSignatureState.Signed]: 'signed — nothing to sign',
-    [biome_published_cosign_1.PublishedSignatureState.Unsigned]: 'unsigned — a real publish would sign it',
+    [biome_published_cosign_1.PublishedSignatureState.Signed]: 'signed by this signer — nothing to sign',
+    [biome_published_cosign_1.PublishedSignatureState.Unsigned]: 'not signed by this signer — a real publish would sign it',
     [biome_published_cosign_1.PublishedSignatureState.NotApplicable]: 'n/a',
 };
 const PUBLISHED_ATTESTATION_PLAN_TEXT = {
-    [biome_published_cosign_1.PublishedAttestationState.Attested]: 'attested — nothing to attest',
-    [biome_published_cosign_1.PublishedAttestationState.Unattested]: 'unattested — a real publish would attest it',
+    [biome_published_cosign_1.PublishedAttestationState.Attested]: 'attested by this signer — nothing to attest',
+    [biome_published_cosign_1.PublishedAttestationState.Unattested]: 'not attested by this signer — a real publish would attest it',
     [biome_published_cosign_1.PublishedAttestationState.NotApplicable]: 'n/a',
 };
 function printPlan(plan, biomeDir, username) {
@@ -409,6 +459,11 @@ function printPlan(plan, biomeDir, username) {
     console.log(`  tag       : ${plan.tag}`);
     console.log(`  oci ref   : ${plan.ociRef}`);
     console.log(`  published : ${PUBLISHED_PLAN_TEXT[plan.published]}`);
+    if (plan.signer !== undefined) {
+        console.log(`  signer    : ${plan.signer.kind === biome_published_cosign_1.CosignSignerKind.Keyless
+            ? `keyless ${plan.signer.identity} (issuer ${plan.signer.issuer})`
+            : `key (${exports.COSIGN_KEY_ENV})`}`);
+    }
     if (plan.signature !== biome_published_cosign_1.PublishedSignatureState.NotApplicable) {
         console.log(`  signature : ${PUBLISHED_SIGNATURE_PLAN_TEXT[plan.signature]}`);
     }