@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/container-artifact-contract.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateContainerArtifactIdentity = validateContainerArtifactIdentity;
+const validation_js_1 = require("../validation.js");
+const NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function fail(path, message) {
+    throw new TypeError(`${path} ${message}`);
+}
+function exactList(value, expected, path) {
+    if (!Array.isArray(value) ||
+        value.length !== expected.length ||
+        value.some((entry, index) => entry !== expected[index])) {
+        fail(path, `must equal ${JSON.stringify(expected)}`);
+    }
+}
+function candidateList(value, minimum, path) {
+    if (!Array.isArray(value) ||
+        value.length > 256 ||
+        value.some((entry) => typeof entry !== 'string' ||
+            entry.length === 0 ||
+            entry.length > 512 ||
+            entry !== entry.trim() ||
+            entry.startsWith('/') ||
+            entry.includes('\\') ||
+            entry
+                .split('/')
+                .some((segment) => segment === '' || segment === '.' || segment === '..')) ||
+        new Set(value).size !== value.length) {
+        fail(path, 'must contain unique canonical repository-relative paths');
+    }
+    const selected = new Set(value);
+    const omitted = minimum.filter((entry) => !selected.has(entry));
+    if (omitted.length > 0) {
+        fail(path, `must include ${JSON.stringify(omitted)}`);
+    }
+}
+function contractFor(artifactId, slice, path) {
+    const fixed = artifactId.slice(`${slice}.job.`.length);
+    if (artifactId === `${slice}.job.data-retention`) {
+        return {
+            artifactId,
+            artifactName: `${slice}-data-retention`,
+            candidate: {
+                materialPaths: [`packages/${slice}/jobs/data-retention/dist`],
+                recipePaths: [
+                    'pnpm-lock.yaml',
+                    `packages/${slice}/jobs/data-retention/Dockerfile`,
+                    `packages/${slice}/jobs/data-retention/package.json`,
+                    `packages/${slice}/sst.config.ts`,
+                ],
+                sourceInputPaths: [`packages/${slice}/jobs/data-retention/src`],
+            },
+            dockerfile: `packages/${slice}/jobs/data-retention/Dockerfile`,
+            nativeLifecycleProof: 'retention-default-refusal',
+            packageManifest: `packages/${slice}/jobs/data-retention/package.json`,
+            proofEntrypoints: [
+                'dist/jobs/data-retention/src/maintenance.js',
+                'dist/jobs/data-retention/src/run.js',
+            ],
+            proofImports: [
+                '@aws-sdk/client-eventbridge',
+                '@aws-sdk/client-sfn',
+                '@empire-builder-kit/runtime',
+                'pg',
+            ],
+            role: 'job',
+            workload: 'job',
+        };
+    }
+    if (artifactId === `${slice}.job.database-migration` ||
+        artifactId === `${slice}.job.database-retirement`) {
+        const retirement = fixed === 'database-retirement';
+        return {
+            artifactId,
+            artifactName: `${slice}-${fixed}`,
+            candidate: {
+                materialPaths: [
+                    `packages/${slice}/database/migrations`,
+                    `packages/${slice}/jobs/bootstrap-database.mjs`,
+                    `packages/${slice}/jobs/database-lifecycle-logging.mjs`,
+                    `packages/${slice}/jobs/migrate-database.mjs`,
+                    `packages/${slice}/jobs/retire-database.mjs`,
+                    `packages/${slice}/migration/package.json`,
+                ],
+                recipePaths: [
+                    'pnpm-lock.yaml',
+                    `packages/${slice}/migration/Dockerfile`,
+                    `packages/${slice}/migration/package.json`,
+                    `packages/${slice}/sst.config.ts`,
+                ],
+                sourceInputPaths: [
+                    `packages/${slice}/database/migrations`,
+                    `packages/${slice}/jobs/bootstrap-database.mjs`,
+                    `packages/${slice}/jobs/database-lifecycle-logging.mjs`,
+                    `packages/${slice}/jobs/migrate-database.mjs`,
+                    `packages/${slice}/jobs/retire-database.mjs`,
+                ],
+            },
+            dockerfile: `packages/${slice}/migration/Dockerfile`,
+            nativeLifecycleProof: retirement
+                ? 'retirement-explicit-refusal'
+                : 'migration-explicit-refusal',
+            packageManifest: `packages/${slice}/migration/package.json`,
+            proofEntrypoints: [
+                'jobs/bootstrap-database.mjs',
+                'jobs/migrate-database.mjs',
+                'jobs/retire-database.mjs',
+            ],
+            proofImports: [
+                '@aws-sdk/client-secrets-manager',
+                '@aws-sdk/client-sfn',
+                '@aws-sdk/rds-signer',
+                'pg',
+            ],
+            role: retirement ? 'retirement' : 'migration',
+            workload: 'job',
+        };
+    }
+    for (const workload of ['service', 'job']) {
+        const prefix = `${slice}.${workload}.`;
+        if (!artifactId.startsWith(prefix))
+            continue;
+        const workloadName = artifactId.slice(prefix.length);
+        if (!NAME.test(workloadName) ||
+            ['data-retention', 'database-migration', 'database-retirement'].includes(workloadName)) {
+            fail(path, 'has an invalid extension workload identity');
+        }
+        const plural = workload === 'service' ? 'services' : 'jobs';
+        const role = workload;
+        return {
+            artifactId,
+            artifactName: `${slice}-${workload}-${workloadName}`,
+            candidate: {
+                materialPaths: [`packages/${slice}/${plural}/${workloadName}/dist`],
+                recipePaths: [
+                    'pnpm-lock.yaml',
+                    `packages/${slice}/${plural}/${workloadName}/Dockerfile`,
+                    `packages/${slice}/${plural}/${workloadName}/package.json`,
+                    `packages/${slice}/sst.config.ts`,
+                ],
+                sourceInputPaths: [
+                    `packages/${slice}/${plural}/${workloadName}/src`,
+                    `packages/${slice}/${plural}/${workloadName}/tsconfig.json`,
+                ],
+            },
+            dockerfile: `packages/${slice}/${plural}/${workloadName}/Dockerfile`,
+            nativeLifecycleProof: workload === 'service'
+                ? 'service-default-health'
+                : 'job-default-success',
+            packageManifest: `packages/${slice}/${plural}/${workloadName}/package.json`,
+            proofEntrypoints: [
+                workload === 'service' ? 'dist/main.js' : 'dist/run.js',
+            ],
+            proofImports: [
+                '@aws-sdk/client-appconfigdata',
+                '@empire-builder-kit/runtime/logging',
+            ],
+            role,
+            workload,
+        };
+    }
+    fail(path, 'must use one exact <slice>.service.<name>, <slice>.job.<name>, or fixed container artifact identity');
+}
+/**
+ * Validate the generated v1 identity-to-runtime mapping for one OCI artifact.
+ *
+ * The mapping is deliberately closed: lifecycle proof selection is a framework
+ * invariant, not adopter-editable release metadata.
+ */
+function validateContainerArtifactIdentity(value, slice, path = 'containerArtifact') {
+    if (!NAME.test(slice) || !(0, validation_js_1.isRecord)(value)) {
+        fail(path, 'must be one generated Product Slice container artifact');
+    }
+    const artifactId = value.id;
+    if (typeof artifactId !== 'string') {
+        fail(`${path}.id`, 'must be one exact artifact identity');
+    }
+    const contract = contractFor(artifactId, slice, `${path}.id`);
+    const candidate = value.candidate;
+    const finalArtifact = value.finalArtifact;
+    if (value.name !== contract.artifactName ||
+        value.workload !== contract.workload ||
+        value.classification !== 'stage-neutral' ||
+        !(0, validation_js_1.isRecord)(candidate) ||
+        Object.keys(candidate).sort().join('\0') !==
+            ['materialPaths', 'recipePaths', 'sourceInputPaths'].join('\0') ||
+        !(0, validation_js_1.isRecord)(finalArtifact) ||
+        finalArtifact.family !== 'oci-image' ||
+        finalArtifact.imageConsumption !== 'digest-qualified' ||
+        finalArtifact.support !== 'supported' ||
+        !(0, validation_js_1.isRecord)(finalArtifact.container)) {
+        fail(path, 'does not match its exact generated OCI artifact identity');
+    }
+    candidateList(candidate.materialPaths, contract.candidate.materialPaths, `${path}.candidate.materialPaths`);
+    candidateList(candidate.recipePaths, contract.candidate.recipePaths, `${path}.candidate.recipePaths`);
+    candidateList(candidate.sourceInputPaths, contract.candidate.sourceInputPaths, `${path}.candidate.sourceInputPaths`);
+    const container = finalArtifact.container;
+    if (container.context !== '.' ||
+        container.dockerfile !== contract.dockerfile ||
+        container.nativeLifecycleProof !== contract.nativeLifecycleProof ||
+        container.role !== contract.role) {
+        fail(`${path}.finalArtifact.container`, 'does not match the artifact identity, Dockerfile, role, and native lifecycle proof');
+    }
+    exactList(container.proofEntrypoints, contract.proofEntrypoints, `${path}.finalArtifact.container.proofEntrypoints`);
+    exactList(container.proofImports, contract.proofImports, `${path}.finalArtifact.container.proofImports`);
+    return contract;
+}
+//# sourceMappingURL=container-artifact-contract.js.map

package/src/supply-chain/container-artifact-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-artifact-contract.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/container-artifact-contract.ts"],"names":[],"mappings":";;AAiOA,8EAoEC;AArSD,oDAA4C;AAE5C,MAAM,IAAI,GAAG,iCAAiC,CAAC;AAwB/C,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,QAA2B,EAC3B,IAAY;IAEZ,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAChC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACvD,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,OAA0B,EAC1B,IAAY;IAEZ,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,IAAI,CACR,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,MAAM,GAAG,GAAG;YAClB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;YACtB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpB,KAAK;iBACF,KAAK,CAAC,GAAG,CAAC;iBACV,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACnE,CACN;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACpC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,UAAkB,EAClB,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,GAAG,KAAK,qBAAqB,EAAE,CAAC;QACjD,OAAO;YACL,UAAU;YACV,YAAY,EAAE,GAAG,KAAK,iBAAiB;YACvC,SAAS,EAAE;gBACT,aAAa,EAAE,CAAC,YAAY,KAAK,2BAA2B,CAAC;gBAC7D,WAAW,EAAE;oBACX,gBAAgB;oBAChB,YAAY,KAAK,iCAAiC;oBAClD,YAAY,KAAK,mCAAmC;oBACpD,YAAY,KAAK,gBAAgB;iBAClC;gBACD,gBAAgB,EAAE,CAAC,YAAY,KAAK,0BAA0B,CAAC;aAChE;YACD,UAAU,EAAE,YAAY,KAAK,iCAAiC;YAC9D,oBAAoB,EAAE,2BAA2B;YACjD,eAAe,EAAE,YAAY,KAAK,mCAAmC;YACrE,gBAAgB,EAAE;gBAChB,6CAA6C;gBAC7C,qCAAqC;aACtC;YACD,YAAY,EAAE;gBACZ,6BAA6B;gBAC7B,qBAAqB;gBACrB,6BAA6B;gBAC7B,IAAI;aACL;YACD,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IACD,IACE,UAAU,KAAK,GAAG,KAAK,yBAAyB;QAChD,UAAU,KAAK,GAAG,KAAK,0BAA0B,EACjD,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,KAAK,qBAAqB,CAAC;QACnD,OAAO;YACL,UAAU;YACV,YAAY,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE;YACjC,SAAS,EAAE;gBACT,aAAa,EAAE;oBACb,YAAY,KAAK,sBAAsB;oBACvC,YAAY,KAAK,8BAA8B;oBAC/C,YAAY,KAAK,sCAAsC;oBACvD,YAAY,KAAK,4BAA4B;oBAC7C,YAAY,KAAK,2BAA2B;oBAC5C,YAAY,KAAK,yBAAyB;iBAC3C;gBACD,WAAW,EAAE;oBACX,gBAAgB;oBAChB,YAAY,KAAK,uBAAuB;oBACxC,YAAY,KAAK,yBAAyB;oBAC1C,YAAY,KAAK,gBAAgB;iBAClC;gBACD,gBAAgB,EAAE;oBAChB,YAAY,KAAK,sBAAsB;oBACvC,YAAY,KAAK,8BAA8B;oBAC/C,YAAY,KAAK,sCAAsC;oBACvD,YAAY,KAAK,4BAA4B;oBAC7C,YAAY,KAAK,2BAA2B;iBAC7C;aACF;YACD,UAAU,EAAE,YAAY,KAAK,uBAAuB;YACpD,oBAAoB,EAAE,UAAU;gBAC9B,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,4BAA4B;YAChC,eAAe,EAAE,YAAY,KAAK,yBAAyB;YAC3D,gBAAgB,EAAE;gBAChB,6BAA6B;gBAC7B,2BAA2B;gBAC3B,0BAA0B;aAC3B;YACD,YAAY,EAAE;gBACZ,iCAAiC;gBACjC,qBAAqB;gBACrB,qBAAqB;gBACrB,IAAI;aACL;YACD,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW;YAC7C,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,KAAK,CAAU,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,QAAQ,GAAG,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YACxB,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CACtE,YAAY,CACb,EACD,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,OAAO;YACL,UAAU;YACV,YAAY,EAAE,GAAG,KAAK,IAAI,QAAQ,IAAI,YAAY,EAAE;YACpD,SAAS,EAAE;gBACT,aAAa,EAAE,CAAC,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,OAAO,CAAC;gBACnE,WAAW,EAAE;oBACX,gBAAgB;oBAChB,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,aAAa;oBACxD,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,eAAe;oBAC1D,YAAY,KAAK,gBAAgB;iBAClC;gBACD,gBAAgB,EAAE;oBAChB,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,MAAM;oBACjD,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,gBAAgB;iBAC5D;aACF;YACD,UAAU,EAAE,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,aAAa;YACpE,oBAAoB,EAClB,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,qBAAqB;YAC3B,eAAe,EAAE,YAAY,KAAK,IAAI,MAAM,IAAI,YAAY,eAAe;YAC3E,gBAAgB,EAAE;gBAChB,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aACxD;YACD,YAAY,EAAE;gBACZ,+BAA+B;gBAC/B,qCAAqC;aACtC;YACD,IAAI;YACJ,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IAAI,CACF,IAAI,EACJ,qGAAqG,CACtG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iCAAiC,CAC/C,KAAc,EACd,KAAa,EACb,IAAI,GAAG,mBAAmB;IAE1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC;IAC5B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY;QACpC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACpC,KAAK,CAAC,cAAc,KAAK,eAAe;QACxC,CAAC,IAAA,wBAAQ,EAAC,SAAS,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,CAAC,eAAe,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACjE,CAAC,IAAA,wBAAQ,EAAC,aAAa,CAAC;QACxB,aAAa,CAAC,MAAM,KAAK,WAAW;QACpC,aAAa,CAAC,gBAAgB,KAAK,kBAAkB;QACrD,aAAa,CAAC,OAAO,KAAK,WAAW;QACrC,CAAC,IAAA,wBAAQ,EAAC,aAAa,CAAC,SAAS,CAAC,EAClC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACzE,CAAC;IACD,aAAa,CACX,SAAS,CAAC,aAAa,EACvB,QAAQ,CAAC,SAAS,CAAC,aAAa,EAChC,GAAG,IAAI,0BAA0B,CAClC,CAAC;IACF,aAAa,CACX,SAAS,CAAC,WAAW,EACrB,QAAQ,CAAC,SAAS,CAAC,WAAW,EAC9B,GAAG,IAAI,wBAAwB,CAChC,CAAC;IACF,aAAa,CACX,SAAS,CAAC,gBAAgB,EAC1B,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EACnC,GAAG,IAAI,6BAA6B,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;IAC1C,IACE,SAAS,CAAC,OAAO,KAAK,GAAG;QACzB,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC5C,SAAS,CAAC,oBAAoB,KAAK,QAAQ,CAAC,oBAAoB;QAChE,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAChC,CAAC;QACD,IAAI,CACF,GAAG,IAAI,0BAA0B,EACjC,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,SAAS,CACP,SAAS,CAAC,gBAAgB,EAC1B,QAAQ,CAAC,gBAAgB,EACzB,GAAG,IAAI,2CAA2C,CACnD,CAAC;IACF,SAAS,CACP,SAAS,CAAC,YAAY,EACtB,QAAQ,CAAC,YAAY,EACrB,GAAG,IAAI,uCAAuC,CAC/C,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/src/supply-chain/container-release.d.ts

@@ -0,0 +1,119 @@
+export declare const CONTAINER_PLATFORM_EVIDENCE_KIND: "ebk-container-platform-evidence";
+export declare const CONTAINER_NATIVE_RUN_PROOF_KIND: "ebk-container-native-run-proof";
+export declare const CONTAINER_RELEASE_BINDING_KIND: "ebk-container-release-binding";
+export declare const CONTAINER_RELEASE_SCHEMA_VERSION: 1;
+export declare const CONTAINER_RELEASE_PLATFORMS: readonly ["linux/amd64", "linux/arm64"];
+export declare const CONTAINER_NATIVE_LIFECYCLE_PROOFS: readonly ["job-default-success", "migration-explicit-refusal", "retention-default-refusal", "retirement-explicit-refusal", "service-default-health"];
+export type ContainerReleasePlatform = (typeof CONTAINER_RELEASE_PLATFORMS)[number];
+export type ContainerNativeLifecycleProof = (typeof CONTAINER_NATIVE_LIFECYCLE_PROOFS)[number];
+export type ContainerReleaseStage = 'development' | 'production' | 'staging';
+export interface ContainerNativeRunProofV1 {
+    accountId: string;
+    artifactId: string;
+    artifactName: string;
+    candidateArtifactDigest: string;
+    entrypoints: readonly string[];
+    imageDigest: string;
+    imports: readonly string[];
+    kind: typeof CONTAINER_NATIVE_RUN_PROOF_KIND;
+    materialDigest: string;
+    nativeLifecycleProof: ContainerNativeLifecycleProof;
+    platform: ContainerReleasePlatform;
+    region: string;
+    repositoryName: string;
+    role: 'job' | 'migration' | 'retirement' | 'service';
+    schemaVersion: typeof CONTAINER_RELEASE_SCHEMA_VERSION;
+    slice: string;
+    sourceCommit: string;
+    stage: ContainerReleaseStage;
+    status: 'passed';
+}
+export interface ContainerPlatformEvidenceV1 {
+    accountId: string;
+    artifactId: string;
+    artifactName: string;
+    candidateArtifactDigest: string;
+    dockerfileDigest: string;
+    imageDigest: string;
+    imageReference: string;
+    kind: typeof CONTAINER_PLATFORM_EVIDENCE_KIND;
+    materialDigest: string;
+    platform: ContainerReleasePlatform;
+    productionClosureDigest: string;
+    region: string;
+    repositoryName: string;
+    runProof: {
+        materialDigest: string;
+        path: string;
+        sha256: string;
+    };
+    sbom: {
+        componentSetDigest: string;
+        path: string;
+        serialNumber: string;
+        sha256: string;
+    };
+    schemaVersion: typeof CONTAINER_RELEASE_SCHEMA_VERSION;
+    slice: string;
+    sourceCommit: string;
+    stage: ContainerReleaseStage;
+}
+export interface ContainerReleaseArtifactV1 {
+    artifactId: string;
+    artifactName: string;
+    candidateArtifactDigest: string;
+    dockerfileDigest: string;
+    imageDigest: string;
+    imageReference: string;
+    platforms: readonly ContainerPlatformEvidenceV1[];
+    repositoryName: string;
+    sbomParityDigest: string;
+}
+export interface ContainerReleaseBindingV1 {
+    accountId: string;
+    artifacts: readonly ContainerReleaseArtifactV1[];
+    builtAt: string;
+    kind: typeof CONTAINER_RELEASE_BINDING_KIND;
+    materialDigest: string;
+    provenance: {
+        runAttempt: string;
+        runId: string;
+        workflow: string;
+    };
+    region: string;
+    schemaVersion: typeof CONTAINER_RELEASE_SCHEMA_VERSION;
+    slice: string;
+    sourceCommit: string;
+    stage: ContainerReleaseStage;
+}
+export interface ContainerReleaseExpectationV1 {
+    accountId: string;
+    candidateDigests: Readonly<Record<string, string>>;
+    region: string;
+    slice: string;
+    sourceCommit: string;
+    stage: ContainerReleaseStage;
+}
+/**
+ * Derive the only ECR repository identity accepted for a released container.
+ *
+ * Repository identity is part of the release binding rather than mutable
+ * deployment input. Keeping this derivation in the core contract prevents an
+ * otherwise-valid digest from being rebound to an unrelated repository.
+ */
+export declare function containerReleaseRepositoryName(input: {
+    artifactId: string;
+    slice: string;
+    stage: string;
+}): string;
+export declare function validateContainerNativeRunProof(value: unknown): ContainerNativeRunProofV1;
+export declare function createContainerNativeRunProof(input: Omit<ContainerNativeRunProofV1, 'kind' | 'materialDigest' | 'schemaVersion'>): ContainerNativeRunProofV1;
+export declare function validateContainerPlatformEvidence(value: unknown): ContainerPlatformEvidenceV1;
+export declare function createContainerPlatformEvidence(input: Omit<ContainerPlatformEvidenceV1, 'kind' | 'materialDigest' | 'schemaVersion'>): ContainerPlatformEvidenceV1;
+export declare function validateContainerReleaseBinding(value: unknown, expected?: ContainerReleaseExpectationV1): ContainerReleaseBindingV1;
+export declare function createContainerReleaseBinding(input: Omit<ContainerReleaseBindingV1, 'kind' | 'materialDigest' | 'schemaVersion'>): ContainerReleaseBindingV1;
+export declare function resolveContainerReleaseArtifact(binding: ContainerReleaseBindingV1, input: {
+    artifactId: string;
+    candidateArtifactDigest: string;
+}): ContainerReleaseArtifactV1;
+export declare function containerReleaseBindingsEqual(left: ContainerReleaseBindingV1, right: ContainerReleaseBindingV1): boolean;