@xemahq/xema 0.51.0 → 0.53.0

package/dist/runtime/edition/verb-map.d.ts

@@ -31,6 +31,7 @@ export declare enum EditionChartSetOperation {
 }
 export declare enum EditionEvidenceKind {
     AssembleInput = "assemble-input",
+    AssembleThirdPartyInput = "assemble-third-party-input",
     Statement = "statement",
     AssembleSet = "assemble-set",
     CheckCommitted = "check-committed",

package/dist/runtime/edition/verb-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verb-map.d.ts","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":"AAKA,oBAAY,WAAW;IACrB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,cAAc,oBAAoB;IAClC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,GAAG,QAAQ;IACX,eAAe,qBAAqB;IACpC,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;IAC3C,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,QAAQ,cAAc;IACtB,cAAc,oBAAoB;IAClC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAGD,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,YAAY,kBAAkB;CAC/B;AAGD,oBAAY,mBAAmB;IAC7B,aAAa,mBAAmB;IAChC,SAAS,cAAc;IACvB,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,WAAW,iBAAiB;IAC5B,GAAG,QAAQ;CACZ;AAGD,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;CACxB;AAGD,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;CAC5C;AAGD,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAE1F,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAuBnI,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAGtF,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAK/F,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAQxH,CAAC;AAGF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAI1E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAExC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAiDD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAoBtG"}
+{"version":3,"file":"verb-map.d.ts","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":"AAKA,oBAAY,WAAW;IACrB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,cAAc,oBAAoB;IAClC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,GAAG,QAAQ;IACX,eAAe,qBAAqB;IACpC,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;IAC3C,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,QAAQ,cAAc;IACtB,cAAc,oBAAoB;IAClC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAGD,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,YAAY,kBAAkB;CAC/B;AAGD,oBAAY,mBAAmB;IAC7B,aAAa,mBAAmB;IAChC,uBAAuB,+BAA+B;IACtD,SAAS,cAAc;IACvB,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,WAAW,iBAAiB;IAC5B,GAAG,QAAQ;CACZ;AAGD,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;CACxB;AAGD,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;CAC5C;AAGD,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAE1F,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAuBnI,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAGtF,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAK/F,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAUxH,CAAC;AAGF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAI1E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAExC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAiDD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAoBtG"}

package/dist/runtime/edition/verb-map.js

@@ -38,6 +38,7 @@ var EditionChartSetOperation;
 var EditionEvidenceKind;
 (function (EditionEvidenceKind) {
     EditionEvidenceKind["AssembleInput"] = "assemble-input";
+    EditionEvidenceKind["AssembleThirdPartyInput"] = "assemble-third-party-input";
     EditionEvidenceKind["Statement"] = "statement";
     EditionEvidenceKind["AssembleSet"] = "assemble-set";
     EditionEvidenceKind["CheckCommitted"] = "check-committed";
@@ -100,6 +101,7 @@ exports.EDITION_EVIDENCE_STATEMENT_ENTRY = {
 };
 exports.EDITION_EVIDENCE_ENTRY = {
     [EditionEvidenceKind.AssembleInput]: 'assemble-producer-input.mjs',
+    [EditionEvidenceKind.AssembleThirdPartyInput]: 'assemble-third-party-input.mjs',
     [EditionEvidenceKind.AssembleSet]: exports.EDITION_EVIDENCE_STATEMENT_ENTRY[EditionEvidenceStatement.Completeness],
     [EditionEvidenceKind.CheckCommitted]: 'check-committed-image-evidence.mjs',
     [EditionEvidenceKind.PlanRefresh]: 'plan-image-evidence-refresh.mjs',

package/dist/runtime/edition/verb-map.js.map

@@ -1 +1 @@
-{"version":3,"file":"verb-map.js","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":";;;AA4LA,4DAoBC;AA3MD,IAAY,WA0BX;AA1BD,WAAY,WAAW;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,iDAAkC,CAAA;IAClC,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,oCAAqB,CAAA;IACrB,sCAAuB,CAAA;IACvB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,0BAAW,CAAA;IACX,mDAAoC,CAAA;IACpC,mDAAoC,CAAA;IACpC,0DAA2C,CAAA;IAC3C,iDAAkC,CAAA;IAClC,oCAAqB,CAAA;IACrB,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,qCAAsB,CAAA;IACtB,iDAAkC,CAAA;IAClC,gCAAiB,CAAA;IACjB,0BAAW,CAAA;IACX,8BAAe,CAAA;IACf,kCAAmB,CAAA;AACrB,CAAC,EA1BW,WAAW,2BAAX,WAAW,QA0BtB;AAGD,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,0DAA8B,CAAA;AAChC,CAAC,EAHW,wBAAwB,wCAAxB,wBAAwB,QAGnC;AAGD,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,uDAAgC,CAAA;IAChC,8CAAuB,CAAA;IACvB,mDAA4B,CAAA;IAC5B,yDAAkC,CAAA;IAClC,mDAA4B,CAAA;IAC5B,kCAAW,CAAA;AACb,CAAC,EAPW,mBAAmB,mCAAnB,mBAAmB,QAO9B;AAGD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;IAC7B,uDAA2B,CAAA;IAC3B,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAGD,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,+DAA2C,CAAA;AAC7C,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,oBAGX;AAHD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,yCAAiB,CAAA;AACnB,CAAC,EAHW,oBAAoB,oCAApB,oBAAoB,QAG/B;AAGY,QAAA,yBAAyB,GAAyD;IAC7F,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,kCAAkC;CACjE,CAAC;AAEW,QAAA,kBAAkB,GAE3B;IACF,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,wBAAwB;IACtD,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,8BAA8B;IACtD,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,uBAAuB;IAChD,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,2BAA2B;IACxD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS;IAC5B,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,4BAA4B;IAC3D,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,0CAA0C;IACzE,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAC5D,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,oBAAoB;IACjD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,6BAA6B;IAC3D,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,8BAA8B;IACpD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,iBAAiB;IACpC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;CAC7C,CAAC;AAEW,QAAA,uBAAuB,GAAuD;IACzF,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC3D,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,6BAA6B;CACvE,CAAC;AAEW,QAAA,gCAAgC,GAAuD;IAClG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,mCAAmC;IACxE,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,gDAAgD;IACzF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,iDAAiD;IACzF,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,wCAAwC;CAC/E,CAAC;AAEW,QAAA,sBAAsB,GAA0F;IAC3H,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,6BAA6B;IAElE,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wCAAgC,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAC1G,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,oCAAoC;IAC1E,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,iCAAiC;IAEpE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,wBAAwB;CACpD,CAAC;AAGW,QAAA,qBAAqB,GAAG,QAAQ,CAAC;AAEjC,QAAA,mBAAmB,GAA+C;IAC7E,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,uBAAuB;IACjD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,kCAAkC;IACtE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,sCAAsC;CAC9E,CAAC;AAWF,MAAM,WAAW,GAAG,CAAC,KAAyB,EAA6B,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEjE,MAAM,cAAc,GAAG,CAAC,KAAyB,EAAgC,EAAE,CACjF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEpE,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAEnF,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAGtG,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,6BAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,wCAAgC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAGnF,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,+BAAuB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAAiB,EAAE,IAAuB;IACjF,IAAI,IAAI,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,iCAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,0BAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,2BAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"verb-map.js","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":";;;AA+LA,4DAoBC;AA9MD,IAAY,WA0BX;AA1BD,WAAY,WAAW;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,iDAAkC,CAAA;IAClC,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,oCAAqB,CAAA;IACrB,sCAAuB,CAAA;IACvB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,0BAAW,CAAA;IACX,mDAAoC,CAAA;IACpC,mDAAoC,CAAA;IACpC,0DAA2C,CAAA;IAC3C,iDAAkC,CAAA;IAClC,oCAAqB,CAAA;IACrB,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,qCAAsB,CAAA;IACtB,iDAAkC,CAAA;IAClC,gCAAiB,CAAA;IACjB,0BAAW,CAAA;IACX,8BAAe,CAAA;IACf,kCAAmB,CAAA;AACrB,CAAC,EA1BW,WAAW,2BAAX,WAAW,QA0BtB;AAGD,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,0DAA8B,CAAA;AAChC,CAAC,EAHW,wBAAwB,wCAAxB,wBAAwB,QAGnC;AAGD,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,uDAAgC,CAAA;IAChC,6EAAsD,CAAA;IACtD,8CAAuB,CAAA;IACvB,mDAA4B,CAAA;IAC5B,yDAAkC,CAAA;IAClC,mDAA4B,CAAA;IAC5B,kCAAW,CAAA;AACb,CAAC,EARW,mBAAmB,mCAAnB,mBAAmB,QAQ9B;AAGD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;IAC7B,uDAA2B,CAAA;IAC3B,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAGD,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,+DAA2C,CAAA;AAC7C,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,oBAGX;AAHD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,yCAAiB,CAAA;AACnB,CAAC,EAHW,oBAAoB,oCAApB,oBAAoB,QAG/B;AAGY,QAAA,yBAAyB,GAAyD;IAC7F,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,kCAAkC;CACjE,CAAC;AAEW,QAAA,kBAAkB,GAE3B;IACF,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,wBAAwB;IACtD,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,8BAA8B;IACtD,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,uBAAuB;IAChD,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,2BAA2B;IACxD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS;IAC5B,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,4BAA4B;IAC3D,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,0CAA0C;IACzE,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAC5D,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,oBAAoB;IACjD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,6BAA6B;IAC3D,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,8BAA8B;IACpD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,iBAAiB;IACpC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;CAC7C,CAAC;AAEW,QAAA,uBAAuB,GAAuD;IACzF,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC3D,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,6BAA6B;CACvE,CAAC;AAEW,QAAA,gCAAgC,GAAuD;IAClG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,mCAAmC;IACxE,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,gDAAgD;IACzF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,iDAAiD;IACzF,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,wCAAwC;CAC/E,CAAC;AAEW,QAAA,sBAAsB,GAA0F;IAC3H,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,6BAA6B;IAElE,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,EAAE,gCAAgC;IAE/E,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wCAAgC,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAC1G,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,oCAAoC;IAC1E,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,iCAAiC;IAEpE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,wBAAwB;CACpD,CAAC;AAGW,QAAA,qBAAqB,GAAG,QAAQ,CAAC;AAEjC,QAAA,mBAAmB,GAA+C;IAC7E,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,uBAAuB;IACjD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,kCAAkC;IACtE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,sCAAsC;CAC9E,CAAC;AAWF,MAAM,WAAW,GAAG,CAAC,KAAyB,EAA6B,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEjE,MAAM,cAAc,GAAG,CAAC,KAAyB,EAAgC,EAAE,CACjF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEpE,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAEnF,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAGtG,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,6BAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,wCAAgC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAGnF,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,+BAAuB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAAiB,EAAE,IAAuB;IACjF,IAAI,IAAI,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,iCAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,0BAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,2BAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC"}

package/edition/README.md

@@ -89,6 +89,7 @@ xema edition chart-set <resolve|source-commit> ...
 xema edition arming --channel <release|develop> --data-root <dir> --kernel <dir>
 xema edition verify-evidence <id> --descriptor <abs path> [--json]
 xema edition evidence <assemble-input|check-committed|plan-refresh|statement|assemble-set|oci> ...
+xema edition evidence assemble-third-party-input --bundle <oci repository>@sha256:<hex> --contract-authority <file> --image <image repository>@sha256:<hex> --subject-id <component image name> --provenance <absolute exported SLSA v1 predicate> --registry-credentials <file> --output <path> [--ttl-seconds <n>]   # a third-party publisher's producer input, no root flags (see Third-party sources)
 ```
 
 Results are JSON on stdout and diagnostics on stderr. Exit 0 is success and 1 is a refusal. `xema edition <verb> --help` names the roots and flags each verb takes.
@@ -146,7 +147,7 @@ The edition library builds, validates and verifies evidence statements; it never
 
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35 and v36 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30, v31, v32, v33, v34, v35, v36, v37, v38 and v38 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 A develop edition does not take the kernel's develop head blindly: `xema edition develop choose-kernel --kernel <package dir> [--kernel-pin <40-hex>] --out <file>` reads the declared protocol of each commit on the checkout's first-parent history (from source, unbuilt) and chooses the newest one this CLI supports. It writes `{chosenSha, headSha, held, reason}` (`reason`: `head-supported` | `head-ahead` | `explicit-pin`; `held` is `head-ahead`), and when held prints `kernel held at v<N> (<sha12>), head at v<M> (<sha12>): raise the CLI` (stdout only, never persisted). The head is the checkout's `refs/remotes/origin/develop` (a full-history checkout). An explicit pin wins but is still checked, and must be on that head's first-parent history (`not-on-develop` otherwise); when no commit is supported it refuses (`EditionProtocolMismatchError`, `no-supported-commit`; the walk ends at the first commit with no declaration file) and never falls back to the head; a declaration that exists but does not parse, at the head or any walked commit, is refused by name (`unparseable`), never skipped. `freeze-graph` applies the same check to `--kernel-sha`.
 
@@ -160,6 +161,8 @@ A develop edition does not take the kernel's develop head blindly: `xema edition
 ## Third-party sources
 
 - **Zero-config.** A data root with no `third-party-source-pins.json`, an empty one or an unparsable one has NO third-party source: every `kind: oci` declared source and every third-party image subject is refused, naming the loader's reason. The pin file is the explicit grant; a trust-policy row alone grants nothing. When the file exists, its sha256 is part of the evidence trust pin, so it moves only together with `xema edition repin-evidence-trust`.
+- **Publisher input.** The publisher's own GitHub-hosted workflow, on `refs/heads/main`, assembles the producer input of each image with `xema edition evidence assemble-third-party-input` (usage above), one run per image. It runs on public inputs only: this CLI and the `@xemahq/contracts` it ships (both from npm), the publisher's checkout at `GITHUB_WORKSPACE` (holding `GITHUB_SHA`), its own registry credential declaration (`--registry-credentials`, the `image-registry-credentials.json` format, naming environment variables, never a secret) and the `GITHUB_*` context. It takes no root flag and reads no data root. `--contract-authority` is the kernel contract authority object the vendor's evidence trust pin names; it must be the kernel this CLI ships, so the publisher installs the matching CLI version. The subject is the bundle's (`--bundle`, read by digest) `oci-image` service or worker component named `--subject-id`; `path` is the directory of the one `xema-biome.json` at `GITHUB_SHA` whose hash is the bundle's; `sourceTreeHash` is hashed over the checkout with no cross-repo inputs (publisher-attested); the image is read by digest (`--image`) and must carry its cosign SLSA v1 and SBOM attestations; the builder digests come from the exported predicate (`--provenance`, VCS revision `GITHUB_SHA`). The lifetime is `--ttl-seconds` or the first-party default (72h); the trust policy's `maxProducerTtlSeconds` ceiling is enforced by the vendor's third-party pin writer (`index runtime-image-source --trusted-write --third-party`) and by `verify-evidence`, and the signer rows and image ownership are checked by the pin writer. It refuses unless `RUNNER_ENVIRONMENT` is `github-hosted` and `GITHUB_REF` is `refs/heads/main`. The output is the exact input `xema edition evidence statement producer` accepts.
+- **Publisher evidence (public-input mode).** The rest of the publisher's run uses the same verbs as first party with `--contract-authority <file>` in place of `--data-root`/`--kernel`: `xema edition evidence statement producer stage` (no OIDC), a keyless `cosign attest-blob --new-bundle-format` of each staged statement in an `id-token: write` job, `statement producer accept --cosign <abs path>` (no OIDC), then `oci attach-plan`, `oras attach` and `oci validate`. Passing both modes, or neither, is refused by name. The authority and schemas come from the file and the `@xemahq/contracts` this CLI bundles, through the one resolution `assemble-third-party-input` uses. Accept verifies every bundle's signature but holds cosign to no version: the vendor's admission re-verifies with its pinned cosign. The publisher installs the xema CLI whose bundled `@xemahq/contracts` matches the authority; an authority whose contracts digest is not the bundled one is refused, naming both digests.
 - **Seal.** A third-party image subject is sealed BY DIGEST from its pin: it keeps the publisher's `imageRef`, its platforms are read at `<imageRef>@<manifestDigest>`, and its `contentHash` (the publisher's `sourceTreeHash`) is never used as a tag, a develop coordinate, a cache key or a build-ledger key. It is not a develop-coverage subject and is excluded from the first-party fleet-coordinate verdict. Its producer evidence in the edition's evidence set is the committed evidence the pin records, checked byte for byte against the pin's digests.
 - **Revocation.** A sealed lock keeps its seal-time verdict; there is no expiry machinery. To revoke a source: remove its pin and its trust-policy rows, regenerate the runtime image source index, run `xema edition repin-evidence-trust`, and reseal every edition that includes the biome. An edition already delivered is not recalled.
 - **What this does not prove.**

package/edition/assemble-producer-input.mjs

@@ -132,6 +132,13 @@ const SOURCE_REPO_PATTERN = /^(?:repos|submodules)\/[a-zA-Z0-9_.-]+$/;
 // The kernel's `CanonicalIdentifierSchema` shape (runId / subject id).
 const CANONICAL_IDENTIFIER_PATTERN =
   /^[a-zA-Z0-9](?:[a-zA-Z0-9._:/@+-]{0,254}[a-zA-Z0-9])?$/;
+/** `--subject-id` has the kernel's `CanonicalIdentifierSchema` shape. */
+export function assertCanonicalSubjectId(subjectId) {
+  if (!CANONICAL_IDENTIFIER_PATTERN.test(subjectId ?? '')) {
+    throw new Error(`--subject-id ${JSON.stringify(subjectId ?? null)} is not a canonical identifier`);
+  }
+}
+
 // cosign v2 attaches every attestation of a subject as one layer of the
 // single `sha256-<subject-digest>.att` manifest; each layer is a DSSE
 // envelope whose `predicateType` annotation names the attestation.
@@ -848,6 +855,54 @@ export async function resolveImageArtifactEvidence({
   if (!SHA256_HEX_PATTERN.test(sourceTreeHash ?? '')) {
     throw new Error('sourceTreeHash must be 64 lowercase sha256 hex characters');
   }
+  assertReferenceProvenance(referenceProvenance);
+  const { authority, repository } = splitImageRef(imageRepository);
+  const declarations = loadRegistryCredentialDeclarations(distributionsRoot);
+  const credential = resolveRegistryCredential({ authority, declarations, env });
+  const client = registryFor
+    ? registryFor({ authority, credential })
+    : new OrasRegistry({ credential, fetchImpl });
+  return publishedArtifactEvidence({
+    client,
+    repository,
+    imageRepository,
+    read: { tag: sourceTreeHash },
+    expectedDigest: manifestDigest,
+    coordinate: `${imageRepository}:${sourceTreeHash}`,
+    referenceProvenance,
+  });
+}
+
+/**
+ * The artifact section of a producer subject read BY DIGEST: the manifest at
+ * `<imageRepository>@<manifestDigest>` (its bytes must hash to that digest),
+ * its hash-proven platforms and its cosign SBOM + SLSA attestation digests. A
+ * third-party publisher's image carries no `:<sourceTreeHash>` tag
+ * (`evidence assemble-third-party-input`), so nothing is read by tag.
+ */
+export async function resolveImageArtifactEvidenceByDigest({
+  client,
+  imageRepository,
+  manifestDigest,
+  referenceProvenance,
+}) {
+  if (!SHA256_DIGEST_PATTERN.test(manifestDigest ?? '')) {
+    throw new Error('the image manifest digest must be an exact sha256:<64-hex> digest');
+  }
+  assertReferenceProvenance(referenceProvenance);
+  const { repository } = splitImageRef(imageRepository);
+  return publishedArtifactEvidence({
+    client,
+    repository,
+    imageRepository,
+    read: { digest: manifestDigest },
+    expectedDigest: manifestDigest,
+    coordinate: `${imageRepository}@${manifestDigest}`,
+    referenceProvenance,
+  });
+}
+
+function assertReferenceProvenance(referenceProvenance) {
   if (
     typeof referenceProvenance !== 'object' ||
     referenceProvenance === null ||
@@ -858,19 +913,29 @@ export async function resolveImageArtifactEvidence({
         'it is what binds the selected provenance attestation to the primary build',
     );
   }
-  const { authority, repository } = splitImageRef(imageRepository);
-  const declarations = loadRegistryCredentialDeclarations(distributionsRoot);
-  const credential = resolveRegistryCredential({ authority, declarations, env });
-  const client = registryFor
-    ? registryFor({ authority, credential })
-    : new OrasRegistry({ credential, fetchImpl });
-  const coordinate = `${imageRepository}:${sourceTreeHash}`;
-  const top = await client.getManifestByTag(repository, sourceTreeHash);
-  if (top.digest !== manifestDigest) {
+}
+
+/** The artifact evidence of the manifest `read` names (exactly one of `{tag}` or `{digest}`), which must be `expectedDigest`. */
+async function publishedArtifactEvidence({
+  client,
+  repository,
+  imageRepository,
+  read,
+  expectedDigest,
+  coordinate,
+  referenceProvenance,
+}) {
+  const top =
+    read.tag === undefined
+      ? await client.getManifestByDigest(repository, read.digest)
+      : await client.getManifestByTag(repository, read.tag);
+  if (top.digest !== expectedDigest) {
     throw new Error(
-      `${coordinate} serves ${top.digest}, not the caller-declared ${manifestDigest} — ` +
-        'the image was not published from this source identity (wrong build commit, ' +
-        'or the cross-repo record at the build commit differs from the one this source carries)',
+      read.tag === undefined
+        ? `${coordinate} was served as ${top.digest}: the registry returned a manifest that is not the digest it was read by`
+        : `${coordinate} serves ${top.digest}, not the caller-declared ${expectedDigest} — ` +
+            'the image was not published from this source identity (wrong build commit, ' +
+            'or the cross-repo record at the build commit differs from the one this source carries)',
     );
   }
   // Proves EVERY platform by its own hash-verified image config and refuses
@@ -879,7 +944,7 @@ export async function resolveImageArtifactEvidence({
   const published = await resolvePublishedPlatforms({
     client,
     repository,
-    tag: sourceTreeHash,
+    ...read,
     coordinate,
   });
   if (published.indexDigest !== top.digest) {
@@ -944,6 +1009,69 @@ export async function resolveImageArtifactEvidence({
  */
 export const DEFAULT_PRODUCER_TTL_SECONDS = 3 * 24 * 60 * 60;
 
+/** Where the ceiling on a producer lifetime is held: the closed set of producer kinds. */
+export const ProducerTtlCeilingSource = Object.freeze({
+  /** First party: the data root's trust policy `maxProducerTtlSeconds`, read here. */
+  TrustPolicy: 'trust-policy',
+  /**
+   * A third-party publisher on public inputs: the vendor policy's `maxProducerTtlSeconds`, enforced by
+   * the third-party pin writer (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`.
+   */
+  VendorAdmission: 'vendor-admission',
+});
+
+/** The latest instant an RFC 3339 `expiresAt` (four-digit year) can name. */
+const LATEST_EXPIRES_AT = Date.UTC(9999, 11, 31, 23, 59, 59);
+
+/** `--ttl-seconds` as given, or undefined when it is not. */
+export const producerTtlSecondsFlag = (value) => (value === undefined ? undefined : Number(value));
+
+/**
+ * The producer lifetime of an input issued at `now`. The default is DEFAULT_PRODUCER_TTL_SECONDS, bowed to the
+ * ceiling when it is read here (`ceiling.source` TrustPolicy, `ceiling.maxTtlSeconds`); an explicit value above that
+ * ceiling is refused. With VendorAdmission the ceiling is the vendor policy's, enforced by the third-party pin writer
+ * (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`; this CLI holds no second one. Either way a value that is not a positive integer, or whose `expiresAt` is past the last
+ * instant RFC 3339 can name, is refused by name.
+ */
+export function resolveProducerTtlSeconds({ ttlSeconds, now, ceiling }) {
+  let maxTtlSeconds;
+  if (ceiling?.source === ProducerTtlCeilingSource.TrustPolicy) {
+    ({ maxTtlSeconds } = ceiling);
+    if (!Number.isSafeInteger(maxTtlSeconds) || maxTtlSeconds < 1) {
+      throw new Error(`the trust policy's maxProducerTtlSeconds ${String(maxTtlSeconds)} is not a positive integer`);
+    }
+  } else if (ceiling?.source === ProducerTtlCeilingSource.VendorAdmission) {
+    maxTtlSeconds = null;
+  } else {
+    throw new Error(`a producer TTL ceiling source is one of ${Object.values(ProducerTtlCeilingSource).join(', ')}`);
+  }
+  // The DEFAULT bows to the policy ceiling; an EXPLICIT `--ttl-seconds` above
+  // it still fails below. Tightening `maxProducerTtlSeconds` is a legitimate
+  // operator decision, and it must not break every producer until someone
+  // edits a constant in this file — but a caller who NAMES a lifetime the
+  // verifier will reject has made a mistake, and gets told so.
+  const effective =
+    ttlSeconds ?? (maxTtlSeconds === null ? DEFAULT_PRODUCER_TTL_SECONDS : Math.min(DEFAULT_PRODUCER_TTL_SECONDS, maxTtlSeconds));
+  if (maxTtlSeconds !== null && (!Number.isSafeInteger(effective) || effective < 1 || effective > maxTtlSeconds)) {
+    throw new Error(
+      `--ttl-seconds must be an integer between 1 and the trust policy's maxProducerTtlSeconds (${maxTtlSeconds})`,
+    );
+  }
+  if (!Number.isSafeInteger(effective) || effective < 1) {
+    throw new Error(
+      `--ttl-seconds must be a positive integer number of seconds (got ${String(ttlSeconds)}); the vendor policy's ` +
+        'maxProducerTtlSeconds is its ceiling, enforced by the pin writer and verify-evidence',
+    );
+  }
+  if (now + effective * 1000 > LATEST_EXPIRES_AT) {
+    throw new Error(
+      `--ttl-seconds ${effective} puts expiresAt past ${new Date(LATEST_EXPIRES_AT).toISOString()}, the last instant an ` +
+        'RFC 3339 time can name',
+    );
+  }
+  return effective;
+}
+
 function readProducerTtlSeconds(distributionsRoot) {
   const declared = editionWorkspaceConfig().evidenceTrustPolicy.policy;
   if (declared === null) {
@@ -1011,9 +1139,7 @@ export async function assembleProducerInput({
       `--subject-kind "${String(subjectKind)}" must be one of ${subjectKinds.join(', ')}`,
     );
   }
-  if (!CANONICAL_IDENTIFIER_PATTERN.test(subjectId ?? '')) {
-    throw new Error('--subject-id is not a canonical identifier');
-  }
+  assertCanonicalSubjectId(subjectId);
   if (!SOURCE_REPO_PATTERN.test(sourceRepo ?? '')) {
     throw new Error(
       `--source-repo "${String(sourceRepo)}" must be an aggregator-plane repository (repos/<name> or submodules/<name>)`,
@@ -1090,24 +1216,42 @@ export async function assembleProducerInput({
     fetchImpl,
     registryFor,
   });
-  const maxTtlSeconds = readProducerTtlSeconds(distributionsRoot);
-  // The DEFAULT bows to the policy ceiling; an EXPLICIT `--ttl-seconds` above
-  // it still fails below. Tightening `maxProducerTtlSeconds` is a legitimate
-  // operator decision, and it must not break every producer until someone
-  // edits a constant in this file — but a caller who NAMES a lifetime the
-  // verifier will reject has made a mistake, and gets told so.
-  const effectiveTtlSeconds =
-    ttlSeconds ?? Math.min(DEFAULT_PRODUCER_TTL_SECONDS, maxTtlSeconds);
-  if (
-    !Number.isSafeInteger(effectiveTtlSeconds) ||
-    effectiveTtlSeconds < 1 ||
-    effectiveTtlSeconds > maxTtlSeconds
-  ) {
-    throw new Error(
-      `--ttl-seconds must be an integer between 1 and the trust policy's maxProducerTtlSeconds (${maxTtlSeconds})`,
-    );
-  }
-  const input = {
+  const effectiveTtlSeconds = resolveProducerTtlSeconds({
+    ttlSeconds,
+    now,
+    ceiling: { source: ProducerTtlCeilingSource.TrustPolicy, maxTtlSeconds: readProducerTtlSeconds(distributionsRoot) },
+  });
+  const input = producerInputDocument({
+    contractAuthority,
+    context,
+    builder,
+    now,
+    ttlSeconds: effectiveTtlSeconds,
+    subject: {
+      kind: subjectKind,
+      id: subjectId,
+      repositoryUrl: source.repositoryUrl,
+      repo: sourceRepo,
+      path: sourcePath,
+      sourceCommit,
+      sourceManifestHash: source.sourceManifestHash,
+      sourceTreeHash: source.sourceTreeHash,
+      imageRepository,
+      ...artifact,
+    },
+  });
+  assertAssembledProducerInput({ input, schemas, contractAuthority, context });
+  return input;
+}
+
+/**
+ * The producer input of ONE subject, in the exact shape
+ * `produce-image-source-evidence.mjs` accepts. `context` is
+ * {@link assertWorkflowContext}'s and `builder` {@link deriveBuilder}'s; the
+ * subject carries every per-subject field (source identity and artifact).
+ */
+export function producerInputDocument({ contractAuthority, context, builder, now, ttlSeconds, subject }) {
+  return {
     schemaVersion: 1,
     contractAuthority: { ...contractAuthority },
     sourceHashAlgorithm: imageInputSourceHashAlgorithm(),
@@ -1131,31 +1275,36 @@ export async function assembleProducerInput({
     runId: context.runId,
     runAttempt: context.runAttempt,
     issuedAt: rfc3339(now),
-    expiresAt: rfc3339(now + effectiveTtlSeconds * 1000),
-    expectedSubjects: [`${subjectKind}:${subjectId}`],
+    expiresAt: rfc3339(now + ttlSeconds * 1000),
+    expectedSubjects: [`${subject.kind}:${subject.id}`],
     subjects: [
       {
-        kind: subjectKind,
-        id: subjectId,
-        repositoryUrl: source.repositoryUrl,
-        repo: sourceRepo,
-        path: sourcePath,
-        sourceCommit,
-        sourceManifestHash: source.sourceManifestHash,
-        sourceTreeHash: source.sourceTreeHash,
-        imageRepository,
-        manifestDigest: artifact.manifestDigest,
-        manifestMediaType: artifact.manifestMediaType,
-        platforms: artifact.platforms,
-        sbomDigest: artifact.sbomDigest,
-        provenanceDigest: artifact.provenanceDigest,
+        kind: subject.kind,
+        id: subject.id,
+        repositoryUrl: subject.repositoryUrl,
+        repo: subject.repo,
+        path: subject.path,
+        sourceCommit: subject.sourceCommit,
+        sourceManifestHash: subject.sourceManifestHash,
+        sourceTreeHash: subject.sourceTreeHash,
+        imageRepository: subject.imageRepository,
+        manifestDigest: subject.manifestDigest,
+        manifestMediaType: subject.manifestMediaType,
+        platforms: subject.platforms,
+        sbomDigest: subject.sbomDigest,
+        provenanceDigest: subject.provenanceDigest,
       },
     ],
   };
-  // Prove the output satisfies the producer BEFORE anything reads it: the
-  // exact field contract, then the kernel statement schema the producer builds
-  // (the same parse produce-image-source-evidence.mjs runs before signing),
-  // then the GitHub context the producer action compares against.
+}
+
+/**
+ * Prove an assembled input satisfies the producer BEFORE anything reads it:
+ * the exact field contract, then the kernel statement schema the producer
+ * builds (the same parse produce-image-source-evidence.mjs runs before
+ * signing), then the GitHub context the producer compares against.
+ */
+export function assertAssembledProducerInput({ input, schemas, contractAuthority, context }) {
   assertProducerInput(input, contractAuthority);
   buildImageSourceStatements(input, schemas, contractAuthority);
   assertGitHubProducerContext(input, {
@@ -1164,23 +1313,13 @@ export async function assembleProducerInput({
     sha: context.sha,
     workflowRef: context.workflowRef,
   });
-  return input;
 }
 
-function requireValue(flags, name) {
-  const value = flags.get(name);
-  if (value === undefined) {
-    throw new Error(`--${name} is required`);
-  }
-  return value;
-}
-
-async function main() {
-  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
-    WorkspaceRoot.Data,
-    WorkspaceRoot.Sources,
-    WorkspaceRoot.Kernel,
-  ]);
+/**
+ * The `--name value` pairs of an assembler's argv: each flag once, each with a
+ * value, none outside `known`.
+ */
+export function readAssemblerFlags(args, known) {
   const flags = new Map();
   for (let index = 0; index < args.length; index += 2) {
     const flag = args[index];
@@ -1197,6 +1336,39 @@ async function main() {
     }
     flags.set(name, value);
   }
+  for (const name of flags.keys()) {
+    if (!known.has(name)) {
+      throw new Error(`unknown option "--${name}"`);
+    }
+  }
+  return flags;
+}
+
+/**
+ * Write an assembled input to `output`. The output directory is caller scratch
+ * space — created deterministically (the producer action's input-manifest
+ * must be repository-relative, so the caller cannot sidestep this by pointing
+ * at RUNNER_TEMP). `wx` refuses to overwrite an existing manifest.
+ */
+export function writeProducerInputFile(output, input) {
+  mkdirSync(dirname(output), { recursive: true });
+  writeFileSync(output, serializeJson(input), { flag: 'wx', mode: 0o600 });
+}
+
+function requireValue(flags, name) {
+  const value = flags.get(name);
+  if (value === undefined) {
+    throw new Error(`--${name} is required`);
+  }
+  return value;
+}
+
+async function main() {
+  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
+    WorkspaceRoot.Data,
+    WorkspaceRoot.Sources,
+    WorkspaceRoot.Kernel,
+  ]);
   const known = new Set([
     'output',
     'image-repository',
@@ -1211,11 +1383,7 @@ async function main() {
     'provenance',
     'ttl-seconds',
   ]);
-  for (const name of flags.keys()) {
-    if (!known.has(name)) {
-      throw new Error(`unknown option "--${name}"`);
-    }
-  }
+  const flags = readAssemblerFlags(args, known);
   const output = resolve(requireValue(flags, 'output'));
   const input = await assembleProducerInput({
     imageRepository: requireValue(flags, 'image-repository'),
@@ -1228,16 +1396,9 @@ async function main() {
     provenancePath: resolve(requireValue(flags, 'provenance')),
     sourceManifestHash: flags.get('source-manifest-hash'),
     sourceTreeHash: flags.get('source-tree-hash'),
-    ttlSeconds: flags.has('ttl-seconds')
-      ? Number(flags.get('ttl-seconds'))
-      : undefined,
+    ttlSeconds: producerTtlSecondsFlag(flags.get('ttl-seconds')),
   });
-  // The output directory is caller scratch space — create it deterministically
-  // (the producer action's input-manifest must be repository-relative, so the
-  // caller cannot sidestep this by pointing at RUNNER_TEMP). `wx` below still
-  // refuses to overwrite an existing manifest.
-  mkdirSync(dirname(output), { recursive: true });
-  writeFileSync(output, serializeJson(input), { flag: 'wx', mode: 0o600 });
+  writeProducerInputFile(output, input);
   console.log(
     `[assemble-producer-input] wrote ${output} for subject ` +
       `${input.subjects[0].kind}:${input.subjects[0].id} ` +