@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/generated-command.js

@@ -0,0 +1,774 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderSupplyChainCheckCommand = renderSupplyChainCheckCommand;
+function renderSupplyChainCheckCommand() {
+    return String.raw `import {
+  createSupplyChainInventory,
+  createInstalledLicenseFindings,
+  createSupplyChainScannerInput,
+  assertWorkspaceImporterCoverage,
+  deriveWorkspaceManifestPathsFromPnpmLock,
+  discoverLifecycleScripts,
+  evaluateSupplyChainPolicy,
+  frameworkActionPinInventory,
+  normalizeOsvScannerResults,
+  OSV_SCANNER_RELEASES,
+  OSV_SCANNER_VERSION,
+  assertSupplyChainScannerSubject,
+  requireActiveVendoredSourceRegistry,
+  validateReviewedBuildPermissions,
+  workspacePackageGlobs,
+  vendoredSourceRegistryDigest,
+  verifyActionPinInventory,
+} from '@empire-builder-kit/nx/supply-chain';
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const MAX_INPUT_BYTES = 5 * 1024 * 1024;
+const MAX_LOCK_BYTES = 25 * 1024 * 1024;
+const MAX_PACKAGE_COUNT = 20_000;
+const workspaceRoot = realpathSync(process.cwd());
+const options = {
+  actionScope: 'consumer',
+  now: undefined,
+  output: undefined,
+  protected: false,
+  scanner: undefined,
+};
+
+function emitFailure(error) {
+  const failure = {
+    error: {
+      classification:
+        error && typeof error === 'object' && typeof error.classification === 'string'
+          ? error.classification
+          : 'supply-chain-check-failed',
+      message:
+        (error instanceof Error ? error.message : String(error))
+          .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+          .slice(0, 2_000),
+      ...(error && typeof error === 'object' && typeof error.path === 'string'
+        ? { path: error.path.slice(0, 512) }
+        : {}),
+    },
+    generatedAt: options.now ?? new Date().toISOString(),
+    kind: 'ebk-supply-chain-check',
+    mode: options.protected ? 'protected' : 'structural',
+    outcome: 'failed',
+    schemaVersion: 1,
+  };
+  const output = JSON.stringify(failure, null, 2) + '\n';
+  if (options.output) {
+    try {
+      const target = insideWorkspace(options.output);
+      mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+      writeFileSync(target, output, { encoding: 'utf8', mode: 0o600 });
+    } catch {
+      // The bounded stderr/stdout record remains authoritative if the output
+      // destination itself is unsafe or unavailable.
+    }
+  }
+  process.stdout.write(output);
+  process.exitCode = 1;
+}
+
+process.on('uncaughtException', emitFailure);
+process.on('unhandledRejection', emitFailure);
+
+for (const argument of process.argv.slice(2)) {
+  if (argument === '--protected') {
+    options.protected = true;
+  } else if (argument.startsWith('--scanner=')) {
+    options.scanner = argument.slice('--scanner='.length);
+  } else if (argument.startsWith('--output=')) {
+    options.output = argument.slice('--output='.length);
+  } else if (argument.startsWith('--now=')) {
+    options.now = argument.slice('--now='.length);
+  } else if (argument === '--action-scope=framework') {
+    options.actionScope = 'framework';
+  } else {
+    throw new Error('Unsupported supply-chain check argument: ' + argument);
+  }
+}
+if (!options.scanner) {
+  throw new Error(
+    'Supply-chain check requires an explicit normalized --scanner=<path> input.',
+  );
+}
+
+function insideWorkspace(path) {
+  const candidate = resolve(workspaceRoot, path);
+  const child = relative(workspaceRoot, candidate);
+  if (child === '..' || child.startsWith('..' + sep) || resolve(candidate) === resolve(sep)) {
+    throw new Error('Supply-chain input escapes the workspace: ' + path);
+  }
+  return candidate;
+}
+
+function readBounded(path, maximum, label) {
+  const candidate = insideWorkspace(path);
+  const metadata = lstatSync(candidate);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > maximum) {
+    throw new Error(label + ' must be a regular bounded file: ' + path);
+  }
+  const real = realpathSync(candidate);
+  const child = relative(workspaceRoot, real);
+  if (child === '..' || child.startsWith('..' + sep)) {
+    throw new Error(label + ' resolves outside the workspace: ' + path);
+  }
+  return readFileSync(real, 'utf8');
+}
+
+function readJson(path, maximum = MAX_INPUT_BYTES) {
+  try {
+    return JSON.parse(readBounded(path, maximum, path));
+  } catch (error) {
+    throw new Error(
+      path + ' is not valid bounded JSON: ' +
+        (error instanceof Error ? error.message : String(error)),
+    );
+  }
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .sort()
+      .map((key) => [key, canonical(value[key])]),
+  );
+}
+
+function digest(value) {
+  const bytes =
+    typeof value === 'string' || Buffer.isBuffer(value)
+      ? value
+      : JSON.stringify(canonical(value));
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+function hasExactKeys(value, keys) {
+  return (
+    value &&
+    typeof value === 'object' &&
+    JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...keys].sort())
+  );
+}
+
+function discoverGlobbedManifestPaths(globs) {
+  // Walk only the directory depth each glob declares so a manifest present on
+  // disk but absent from the lockfile importers is still observed.
+  const discovered = new Set();
+  const walk = (segments, index, prefix) => {
+    if (index === segments.length) {
+      const manifest = prefix ? prefix + '/package.json' : 'package.json';
+      if (existsSync(insideWorkspace(manifest))) discovered.add(manifest);
+      return;
+    }
+    const segment = segments[index];
+    const directory = prefix ? insideWorkspace(prefix) : workspaceRoot;
+    if (!existsSync(directory) || !statSync(directory).isDirectory()) return;
+    if (segment === '*' || segment === '**') {
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+        if (entry.name === 'node_modules') continue;
+        const next = prefix ? prefix + '/' + entry.name : entry.name;
+        walk(segments, index + 1, next);
+        if (segment === '**') walk(segments, index, next);
+      }
+      return;
+    }
+    if (segment.includes('*')) {
+      throw new Error(
+        'Workspace package glob segment ' + segment + ' is not supported by the manifest drift sweep.',
+      );
+    }
+    walk(segments, index + 1, prefix ? prefix + '/' + segment : segment);
+  };
+  for (const glob of globs) {
+    walk(glob.split('/').filter((segment) => segment !== '' && segment !== '.'), 0, '');
+  }
+  return [...discovered];
+}
+
+function workspaceManifests(lockfile, workspacePolicy) {
+  const importerPaths = deriveWorkspaceManifestPathsFromPnpmLock(lockfile);
+  assertWorkspaceImporterCoverage(
+    discoverGlobbedManifestPaths(workspacePackageGlobs(workspacePolicy)),
+    importerPaths,
+  );
+  const manifests = {};
+  for (const path of importerPaths) {
+    manifests[path] = readJson(path);
+  }
+  return manifests;
+}
+
+function installedPackageMetadata() {
+  const store = insideWorkspace('node_modules/.pnpm');
+  if (!existsSync(store) || !statSync(store).isDirectory()) {
+    throw new Error(
+      'Installed dependency metadata is absent; run the frozen install before supply-chain check.',
+    );
+  }
+  const metadata = [];
+  for (const packageStore of readdirSync(store, { withFileTypes: true })) {
+    if (!packageStore.isDirectory()) continue;
+    const modules = join(store, packageStore.name, 'node_modules');
+    if (!existsSync(modules) || !statSync(modules).isDirectory()) continue;
+    for (const entry of readdirSync(modules, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith('@')) {
+        const scope = join(modules, entry.name);
+        for (const scoped of readdirSync(scope, { withFileTypes: true })) {
+          if (scoped.isDirectory()) {
+            const path = relative(
+              workspaceRoot,
+              join(scope, scoped.name, 'package.json'),
+            );
+            if (existsSync(insideWorkspace(path))) metadata.push(readJson(path, 1024 * 1024));
+          }
+        }
+      } else {
+        const path = relative(workspaceRoot, join(modules, entry.name, 'package.json'));
+        if (existsSync(insideWorkspace(path))) metadata.push(readJson(path, 1024 * 1024));
+      }
+      if (metadata.length > MAX_PACKAGE_COUNT) {
+        throw new Error('Installed dependency inventory exceeds 20,000 packages.');
+      }
+    }
+  }
+  return metadata;
+}
+
+const ignoredDirectories = new Set([
+  '.ebk',
+  '.git',
+  '.next',
+  '.nx',
+  '.open-next',
+  '.sst',
+  'coverage',
+  'dist',
+  'node_modules',
+]);
+
+function sourceFilesBelow(root, accept) {
+  const files = {};
+  const pending = [insideWorkspace(root)];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) {
+        if (ignoredDirectories.has(entry.name)) continue;
+        const path = relative(workspaceRoot, join(current, entry.name))
+          .split(sep)
+          .join('/');
+        throw new Error(
+          'Source inventory may not contain symbolic links: ' + path,
+        );
+      }
+      const absolute = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories.has(entry.name)) pending.push(absolute);
+      } else if (entry.isFile()) {
+        const path = relative(workspaceRoot, absolute).split(sep).join('/');
+        if (accept(path)) files[path] = readBounded(path, 2 * 1024 * 1024, path);
+      }
+      if (Object.keys(files).length > 10_000) {
+        throw new Error('Source inventory exceeds 10,000 accepted files.');
+      }
+    }
+  }
+  return files;
+}
+
+function records(value, path) {
+  if (
+    !hasExactKeys(value, ['records', 'schemaVersion']) ||
+    value.schemaVersion !== 1 ||
+    !Array.isArray(value.records)
+  ) {
+    throw new Error(path + ' must contain a schema-v1 records array.');
+  }
+  return value.records;
+}
+
+function verifyVendoredFiles(registry) {
+  for (const record of registry.records) {
+    for (const file of record.filePlan) {
+      const target = insideWorkspace(file.path);
+      if (file.change === 'delete') {
+        if (existsSync(target)) {
+          throw new Error('Deleted vendored path remains present: ' + file.path);
+        }
+      } else {
+        const bytes = readBounded(file.path, MAX_INPUT_BYTES, file.path);
+        if (digest(bytes) !== file.afterSha256) {
+          throw new Error('Vendored source hash drifted: ' + file.path);
+        }
+      }
+    }
+    for (const asset of record.assets) {
+      const target = insideWorkspace(asset.path);
+      const metadata = lstatSync(target);
+      if (
+        !metadata.isFile() ||
+        metadata.isSymbolicLink() ||
+        digest(readFileSync(target)) !== asset.sha256
+      ) {
+        throw new Error('Vendored asset hash drifted: ' + asset.path);
+      }
+    }
+    for (const license of record.licenses) {
+      readBounded(license.noticePath, MAX_INPUT_BYTES, license.noticePath);
+    }
+  }
+}
+
+function gitCommit() {
+  const result = spawnSync('git', ['rev-parse', 'HEAD'], {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    maxBuffer: 1024,
+    shell: false,
+  });
+  const commit = String(result.stdout).trim();
+  if (result.status !== 0 || !/^[a-f0-9]{40}$/.test(commit)) {
+    throw new Error('Supply-chain check cannot bind the current Git commit.');
+  }
+  return commit;
+}
+
+const scannerInput = readJson(options.scanner);
+if (
+  !hasExactKeys(scannerInput, [
+    'kind',
+    'licenses',
+    'requiredCoverage',
+    'scanner',
+    'schemaVersion',
+    'subject',
+    'vulnerabilities',
+  ]) ||
+  scannerInput.kind !== 'ebk-supply-chain-scanner-input' ||
+  scannerInput.schemaVersion !== 2 ||
+  !Array.isArray(scannerInput.licenses) ||
+  !Array.isArray(scannerInput.vulnerabilities) ||
+  !Array.isArray(scannerInput.requiredCoverage) ||
+  scannerInput.requiredCoverage.length === 0 ||
+  scannerInput.requiredCoverage.some(
+    (entry) => !['container', 'npm', 'vendored-source'].includes(entry),
+  ) ||
+  new Set(scannerInput.requiredCoverage).size !== scannerInput.requiredCoverage.length ||
+  !hasExactKeys(scannerInput.scanner, [
+    'coverage',
+    'resultSetDigest',
+    'scannedAt',
+    'schemaVersion',
+    'status',
+    'tool',
+    'version',
+  ]) ||
+  !hasExactKeys(scannerInput.subject, [
+    'containerInventoryDigest',
+    'lockfileDigest',
+    'repositoryCommit',
+    'resultDigests',
+    'vendoredRegistryDigest',
+  ])
+) {
+  throw new Error('Normalized scanner input is not the exact schema-v2 envelope.');
+}
+
+const workspacePolicy = readBounded(
+  'pnpm-workspace.yaml',
+  MAX_INPUT_BYTES,
+  'pnpm workspace policy',
+);
+const lockfile = readBounded(
+  'pnpm-lock.yaml',
+  MAX_LOCK_BYTES,
+  'pnpm lockfile',
+);
+const packageMetadata = installedPackageMetadata();
+const lifecycleScripts = discoverLifecycleScripts(packageMetadata);
+const buildPermissions = records(
+  readJson('supply-chain/build-permissions.json'),
+  'supply-chain/build-permissions.json',
+);
+validateReviewedBuildPermissions(workspacePolicy, buildPermissions);
+const vendoredRegistry = requireActiveVendoredSourceRegistry(
+  readJson('supply-chain/vendored-sources.json'),
+);
+verifyVendoredFiles(vendoredRegistry);
+
+const actionInventory = readJson('.github/actions-pins.json');
+if (
+  options.actionScope === 'framework' &&
+  JSON.stringify(canonical(actionInventory)) !==
+    JSON.stringify(canonical(frameworkActionPinInventory()))
+) {
+  throw new Error(
+    'Framework action pin file differs from the source-owned pin inventory.',
+  );
+}
+const actionFiles = sourceFilesBelow(
+  '.github',
+  (path) => /\.ya?ml$/i.test(path),
+);
+const actionUses = verifyActionPinInventory(
+  actionFiles,
+  actionInventory,
+  options.actionScope,
+);
+const containers = sourceFilesBelow(
+  '.',
+  (path) => /(?:^|\/)Dockerfile$/i.test(path) || /\.Dockerfile$/i.test(path),
+);
+const inventory = createSupplyChainInventory({
+  containers,
+  downloadedTools: records(
+    readJson('supply-chain/downloaded-tools.json'),
+    'supply-chain/downloaded-tools.json',
+  ),
+  lifecycleScripts,
+  lockfile,
+  manifests: workspaceManifests(lockfile, workspacePolicy),
+  nodeVersion: readBounded(
+    '.node-version',
+    64,
+    'Node.js version pin',
+  ).trim(),
+  vendoredInputs: vendoredRegistry.records.map((record) => ({
+    identity:
+      record.identity.registry +
+      '/' +
+      record.identity.publisher +
+      '/' +
+      record.identity.item,
+    revision: record.identity.revision,
+    sha256: record.retrieval.sha256,
+  })),
+  workspacePolicy,
+});
+const workflowContainers = actionUses
+  .filter(({ kind }) => kind === 'container')
+  .map(({ reference }) => reference.replace(/^docker:\/\//, ''))
+  .sort();
+const containerInventoryDigest = digest({
+  recipes: inventory.containers,
+  workflowExecutables: workflowContainers,
+});
+if (options.protected) {
+  const normalizedScanner = createSupplyChainScannerInput(scannerInput);
+  const requiredCoverage = [
+    'npm',
+    ...(inventory.containers.length > 0 || workflowContainers.length > 0
+      ? ['container']
+      : []),
+    ...(vendoredRegistry.records.length > 0 ? ['vendored-source'] : []),
+  ];
+  const resultDigests = [];
+  const normalizedVulnerabilities = [];
+  for (const reference of normalizedScanner.subject.resultDigests) {
+    const bytes = readBounded(
+      reference.path,
+      20 * 1024 * 1024,
+      'scanner result',
+    );
+    if (digest(bytes) !== reference.sha256) {
+      throw new Error(
+        'Scanner result digest does not match: ' + reference.path,
+      );
+    }
+    resultDigests.push(reference);
+    const result = JSON.parse(bytes);
+    if (reference.coverage === 'npm') {
+      const packageManager =
+        /^pnpm@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\+sha512\.[a-f0-9]{128}$/.exec(
+          inventory.packageManager,
+        );
+      if (!packageManager?.[1]) {
+        throw new Error(
+          'Supply-chain inventory package manager is not one exact pnpm authority.',
+        );
+      }
+      const expectedPackageManagerInput = {
+        results: [
+          {
+            packages: [
+              {
+                package: {
+                  ecosystem: 'npm',
+                  name: 'pnpm',
+                  version: packageManager[1],
+                },
+              },
+            ],
+          },
+        ],
+      };
+      const expectedPackageManagerInputBytes =
+        JSON.stringify(expectedPackageManagerInput, null, 2) + '\n';
+      if (
+        !hasExactKeys(result, [
+          'kind',
+          'lockfile',
+          'packageManager',
+          'schemaVersion',
+        ]) ||
+        result.kind !== 'ebk-osv-npm-results' ||
+        result.schemaVersion !== 1 ||
+        !hasExactKeys(result.packageManager, [
+          'authority',
+          'input',
+          'inputSha256',
+          'result',
+        ]) ||
+        result.packageManager.authority !== inventory.packageManager ||
+        JSON.stringify(canonical(result.packageManager.input)) !==
+          JSON.stringify(canonical(expectedPackageManagerInput)) ||
+        result.packageManager.inputSha256 !==
+          digest(expectedPackageManagerInputBytes)
+      ) {
+        throw new Error(
+          'npm scanner result does not bind the exact package-manager authority and custom input.',
+        );
+      }
+      const packageManagerResults = result.packageManager.result;
+      const scannedPackageManagers =
+        packageManagerResults && Array.isArray(packageManagerResults.results)
+          ? packageManagerResults.results.flatMap((entry) =>
+              entry && Array.isArray(entry.packages)
+                ? entry.packages
+                    .map((scanned) => scanned?.package)
+                    .filter(Boolean)
+                : [],
+            )
+          : [];
+      if (
+        scannedPackageManagers.length !== 1 ||
+        scannedPackageManagers[0].ecosystem !== 'npm' ||
+        scannedPackageManagers[0].name !== 'pnpm' ||
+        scannedPackageManagers[0].version !== packageManager[1]
+      ) {
+        throw new Error(
+          'npm scanner result does not prove the exact package-manager scan.',
+        );
+      }
+      normalizedVulnerabilities.push(
+        ...normalizeOsvScannerResults({
+          coverage: 'npm',
+          detectedAt: normalizedScanner.scanner.scannedAt,
+          inventory,
+          resultGroups: [
+            {
+              context: { releases: [], scope: 'unknown', slices: [] },
+              document: result.lockfile,
+            },
+            {
+              context: { releases: [], scope: 'unknown', slices: [] },
+              document: packageManagerResults,
+            },
+          ],
+        }),
+      );
+    } else if (reference.coverage === 'container') {
+      const expectedImages = [
+        ...new Set([
+          ...inventory.containers.flatMap(({ bases }) => bases),
+          ...workflowContainers,
+        ]),
+      ].sort();
+      if (
+        !hasExactKeys(result, ['images', 'kind', 'schemaVersion']) ||
+        result.kind !== 'ebk-osv-container-results' ||
+        result.schemaVersion !== 1 ||
+        !Array.isArray(result.images) ||
+        JSON.stringify(
+          result.images.map(({ image }) => image).sort(),
+        ) !== JSON.stringify(expectedImages)
+      ) {
+        throw new Error(
+          'Container scanner result does not bind every exact inventory base.',
+        );
+      }
+      normalizedVulnerabilities.push(
+        ...normalizeOsvScannerResults({
+          coverage: 'container',
+          detectedAt: normalizedScanner.scanner.scannedAt,
+          resultGroups: result.images.map(({ result: document }) => ({
+            context: { releases: [], scope: 'build', slices: [] },
+            document,
+          })),
+        }),
+      );
+    } else {
+      const expectedVendored = {
+        kind: 'ebk-vendored-source-scan',
+        records: vendoredRegistry.records.map((record) => ({
+          identity:
+            record.identity.registry +
+            '/' +
+            record.identity.publisher +
+            '/' +
+            record.identity.item,
+          revision: record.identity.revision,
+          sha256: record.retrieval.sha256,
+          status: record.revocation.status,
+        })),
+        registryDigest: vendoredSourceRegistryDigest(vendoredRegistry),
+        schemaVersion: 1,
+      };
+      if (
+        JSON.stringify(canonical(result)) !==
+        JSON.stringify(canonical(expectedVendored))
+      ) {
+        throw new Error(
+          'Vendored scanner result does not bind the active source registry.',
+        );
+      }
+    }
+  }
+  const expectedLicenses = createInstalledLicenseFindings({
+    inventory,
+    packageMetadata,
+  });
+  normalizedVulnerabilities.sort((left, right) =>
+    left.id + '\0' + left.component.purl + '\0' + left.component.scope <
+    right.id + '\0' + right.component.purl + '\0' + right.component.scope
+      ? -1
+      : left.id + '\0' + left.component.purl + '\0' + left.component.scope >
+          right.id + '\0' + right.component.purl + '\0' + right.component.scope
+        ? 1
+        : 0,
+  );
+  if (
+    JSON.stringify(canonical(normalizedScanner.licenses)) !==
+      JSON.stringify(canonical(expectedLicenses)) ||
+    JSON.stringify(canonical(normalizedScanner.vulnerabilities)) !==
+      JSON.stringify(canonical(normalizedVulnerabilities))
+  ) {
+    throw new Error(
+      'Normalized scanner findings differ from installed metadata or raw OSV results.',
+    );
+  }
+  const release = OSV_SCANNER_RELEASES[process.platform + '-' + process.arch];
+  if (!release) {
+    throw new Error('Protected scanner platform has no pinned OSV release.');
+  }
+  const expectedResultSetDigest = digest({
+    binary: release.sha256,
+    results: resultDigests.map(({ coverage, sha256 }) => ({
+      coverage,
+      sha256,
+    })),
+    version: OSV_SCANNER_VERSION,
+  });
+  if (
+    normalizedScanner.scanner.resultSetDigest !== expectedResultSetDigest
+  ) {
+    throw new Error(
+      'Scanner result-set identity differs from the pinned raw results.',
+    );
+  }
+  const now = Date.parse(options.now ?? new Date().toISOString());
+  const scannedAt = Date.parse(normalizedScanner.scanner.scannedAt);
+  if (scannedAt > now + 5 * 60 * 1_000 || now - scannedAt > 24 * 60 * 60 * 1_000) {
+    throw new Error('Protected scanner evidence is stale or future-dated.');
+  }
+  assertSupplyChainScannerSubject(normalizedScanner, {
+    containerInventoryDigest,
+    lockfileDigest: inventory.lockfileDigest,
+    repositoryCommit: gitCommit(),
+    requiredCoverage,
+    resultDigests,
+    vendoredRegistryDigest: vendoredSourceRegistryDigest(vendoredRegistry),
+  });
+}
+const policy = evaluateSupplyChainPolicy({
+  exceptions: records(
+    readJson('supply-chain/exceptions.json'),
+    'supply-chain/exceptions.json',
+  ),
+  licenses: scannerInput.licenses,
+  licensePolicy: readJson('supply-chain/license-policy.json'),
+  now: options.now ?? new Date().toISOString(),
+  protected: options.protected,
+  requiredScannerCoverage: scannerInput.requiredCoverage,
+  scanner: scannerInput.scanner,
+  vulnerabilities: scannerInput.vulnerabilities,
+  vulnerabilityPolicy: readJson('supply-chain/vulnerability-policy.json'),
+});
+
+const findings = policy.findings.slice(0, 200).map((finding) => ({
+  category: finding.category,
+  id: finding.id,
+  outcome: finding.outcome,
+  ...(finding.component ? { component: finding.component } : {}),
+  ...(finding.exceptionId ? { exceptionId: finding.exceptionId } : {}),
+}));
+const evidence = {
+  actions: {
+    digest: digest(actionUses),
+    reviewed: actionUses.length,
+  },
+  generatedAt: options.now ?? new Date().toISOString(),
+  inventory: {
+    containers: inventory.containers.length,
+    dependencies: inventory.dependencies.length,
+    digest: digest(inventory),
+    installedLicenseFindings: scannerInput.licenses.length,
+    lifecycleScripts: inventory.lifecycleScripts.length,
+    lockfileDigest: inventory.lockfileDigest,
+    resolvedPackages: inventory.resolvedPackages.length,
+  },
+  kind: 'ebk-supply-chain-check',
+  mode: options.protected ? 'protected' : 'structural',
+  policy: {
+    decision: policy.decision,
+    digest: digest(policy),
+    exceptions: policy.exceptions.length,
+    findingCount: policy.findings.length,
+    findings,
+    omittedFindings: policy.findings.length - findings.length,
+  },
+  scanner: {
+    coverage: scannerInput.scanner?.coverage,
+    inputDigest: digest(scannerInput),
+    resultSetDigest: scannerInput.scanner?.resultSetDigest,
+    scannedAt: scannerInput.scanner?.scannedAt,
+    schemaVersion: scannerInput.scanner?.schemaVersion,
+    status: scannerInput.scanner?.status,
+    tool: scannerInput.scanner?.tool,
+    version: scannerInput.scanner?.version,
+  },
+  schemaVersion: 1,
+};
+const output = JSON.stringify(evidence, null, 2) + '\n';
+if (Buffer.byteLength(output, 'utf8') > 256 * 1024) {
+  throw new Error('Supply-chain evidence exceeds the 256 KiB bound.');
+}
+if (options.output) {
+  const target = insideWorkspace(options.output);
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  writeFileSync(target, output, { encoding: 'utf8', mode: 0o600 });
+}
+process.stdout.write(output);
+if (policy.decision !== 'allow') process.exitCode = 1;
+`;
+}
+//# sourceMappingURL=generated-command.js.map