@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/container-release.js

@@ -0,0 +1,496 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTAINER_NATIVE_LIFECYCLE_PROOFS = exports.CONTAINER_RELEASE_PLATFORMS = exports.CONTAINER_RELEASE_SCHEMA_VERSION = exports.CONTAINER_RELEASE_BINDING_KIND = exports.CONTAINER_NATIVE_RUN_PROOF_KIND = exports.CONTAINER_PLATFORM_EVIDENCE_KIND = void 0;
+exports.containerReleaseRepositoryName = containerReleaseRepositoryName;
+exports.validateContainerNativeRunProof = validateContainerNativeRunProof;
+exports.createContainerNativeRunProof = createContainerNativeRunProof;
+exports.validateContainerPlatformEvidence = validateContainerPlatformEvidence;
+exports.createContainerPlatformEvidence = createContainerPlatformEvidence;
+exports.validateContainerReleaseBinding = validateContainerReleaseBinding;
+exports.createContainerReleaseBinding = createContainerReleaseBinding;
+exports.resolveContainerReleaseArtifact = resolveContainerReleaseArtifact;
+exports.containerReleaseBindingsEqual = containerReleaseBindingsEqual;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const ACCOUNT = /^\d{12}$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/;
+const REPOSITORY = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const EVIDENCE_PATH = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,512}$/;
+const SERIAL_NUMBER = /^urn:uuid:[a-f0-9-]{36}$/;
+const SLICE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+exports.CONTAINER_PLATFORM_EVIDENCE_KIND = 'ebk-container-platform-evidence';
+exports.CONTAINER_NATIVE_RUN_PROOF_KIND = 'ebk-container-native-run-proof';
+exports.CONTAINER_RELEASE_BINDING_KIND = 'ebk-container-release-binding';
+exports.CONTAINER_RELEASE_SCHEMA_VERSION = 1;
+exports.CONTAINER_RELEASE_PLATFORMS = [
+    'linux/amd64',
+    'linux/arm64',
+];
+exports.CONTAINER_NATIVE_LIFECYCLE_PROOFS = [
+    'job-default-success',
+    'migration-explicit-refusal',
+    'retention-default-refusal',
+    'retirement-explicit-refusal',
+    'service-default-health',
+];
+function fail(path, message, classification = 'supply-chain-input-invalid') {
+    throw new errors_js_1.SupplyChainError(classification, path, message);
+}
+function releaseStage(value, path) {
+    return value === 'development' ||
+        value === 'staging' ||
+        value === 'production'
+        ? value
+        : fail(path, 'must be staging, production, or the exact development rehearsal');
+}
+function assertDevelopmentRetirementIdentity(input) {
+    if (input.stage !== 'development')
+        return;
+    if (input.artifactId !== `${input.slice}.job.database-retirement` ||
+        (input.nativeLifecycleProof !== undefined &&
+            input.nativeLifecycleProof !== 'retirement-explicit-refusal') ||
+        (input.role !== undefined && input.role !== 'retirement')) {
+        fail(input.path, 'development evidence is reserved for the exact database-retirement rehearsal artifact');
+    }
+}
+/**
+ * Derive the only ECR repository identity accepted for a released container.
+ *
+ * Repository identity is part of the release binding rather than mutable
+ * deployment input. Keeping this derivation in the core contract prevents an
+ * otherwise-valid digest from being rebound to an unrelated repository.
+ */
+function containerReleaseRepositoryName(input) {
+    const stage = releaseStage(input.stage, 'containerRepository.stage');
+    if (!SLICE_NAME.test(input.slice) ||
+        !input.artifactId.startsWith(`${input.slice}.`) ||
+        !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\.[a-z][a-z0-9]*(?:-[a-z0-9]+)*){2}$/.test(input.artifactId)) {
+        fail('containerRepository.artifactId', 'must be one exact lower-case artifact identity owned by the Product Slice');
+    }
+    assertDevelopmentRetirementIdentity({
+        artifactId: input.artifactId,
+        path: 'containerRepository',
+        slice: input.slice,
+        stage,
+    });
+    const repository = `ebk/${stage}/${input.slice}/` + input.artifactId.replace(/\./g, '-');
+    if (repository.length > 256 || !REPOSITORY.test(repository)) {
+        fail('containerRepository', 'derives an invalid or unbounded ECR repository name');
+    }
+    return repository;
+}
+function exactKeys(value, keys, path) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        Object.keys(value).length !== keys.length ||
+        Object.keys(value).some((key) => !keys.includes(key))) {
+        fail(path, 'must match the exact v1 object shape');
+    }
+}
+function reference(value, path, pattern = common_js_1.SUPPLY_CHAIN_REFERENCE) {
+    if (typeof value !== 'string' || value.length > 512 || !pattern.test(value)) {
+        fail(path, 'must be one bounded exact reference');
+    }
+    return value;
+}
+function timestamp(value, path) {
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        fail(path, 'must be one canonical ISO-8601 timestamp');
+    }
+    return value;
+}
+function imageReference(value, accountId, region, repositoryName, imageDigest, path) {
+    const suffix = region.startsWith('cn-') ? '.com.cn' : '.com';
+    const expected = `${accountId}.dkr.ecr.${region}.amazonaws${suffix}/` +
+        `${repositoryName}@${imageDigest}`;
+    if (value !== expected) {
+        fail(path, 'must be the exact digest-qualified target ECR image');
+    }
+    return expected;
+}
+function stringList(value, path, pattern, maximum) {
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        value.length > maximum ||
+        value.some((entry) => typeof entry !== 'string' || !pattern.test(entry)) ||
+        new Set(value).size !== value.length ||
+        [...value].sort().some((entry, index) => entry !== value[index])) {
+        fail(path, 'must be one bounded, unique, sorted string list');
+    }
+    return value;
+}
+function unsignedNativeRunProof(value, path) {
+    exactKeys(value, [
+        'accountId',
+        'artifactId',
+        'artifactName',
+        'candidateArtifactDigest',
+        'entrypoints',
+        'imageDigest',
+        'imports',
+        'kind',
+        'materialDigest',
+        'nativeLifecycleProof',
+        'platform',
+        'region',
+        'repositoryName',
+        'role',
+        'schemaVersion',
+        'slice',
+        'sourceCommit',
+        'stage',
+        'status',
+    ], path);
+    const entrypoints = stringList(value.entrypoints, `${path}.entrypoints`, /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,256}$/, 16);
+    const imports = stringList(value.imports, `${path}.imports`, /^(?:@[a-z0-9._-]+\/[a-z0-9._/-]+|[a-z0-9][a-z0-9._/-]*)$/, 32);
+    const nativeLifecycleProof = exports.CONTAINER_NATIVE_LIFECYCLE_PROOFS.includes(value.nativeLifecycleProof)
+        ? value.nativeLifecycleProof
+        : fail(`${path}.nativeLifecycleProof`, 'must select one exact native lifecycle proof');
+    const role = ['job', 'migration', 'retirement', 'service'].includes(value.role)
+        ? value.role
+        : fail(`${path}.role`, 'must select one exact container role');
+    const lifecycleMatchesRole = (nativeLifecycleProof === 'service-default-health' && role === 'service') ||
+        (nativeLifecycleProof === 'job-default-success' &&
+            role === 'job' &&
+            !entrypoints.includes('dist/jobs/data-retention/src/run.js')) ||
+        (nativeLifecycleProof === 'retention-default-refusal' &&
+            role === 'job' &&
+            entrypoints.includes('dist/jobs/data-retention/src/run.js')) ||
+        (nativeLifecycleProof === 'migration-explicit-refusal' &&
+            role === 'migration' &&
+            entrypoints.includes('jobs/migrate-database.mjs')) ||
+        (nativeLifecycleProof === 'retirement-explicit-refusal' &&
+            role === 'retirement' &&
+            entrypoints.includes('jobs/retire-database.mjs'));
+    if (!lifecycleMatchesRole) {
+        fail(`${path}.nativeLifecycleProof`, 'does not match the exact role and lifecycle entrypoint contract');
+    }
+    const platform = exports.CONTAINER_RELEASE_PLATFORMS.includes(value.platform)
+        ? value.platform
+        : fail(`${path}.platform`, 'must be one required v1 Linux architecture');
+    const stage = releaseStage(value.stage, `${path}.stage`);
+    const accountId = reference(value.accountId, `${path}.accountId`, ACCOUNT);
+    const artifactId = reference(value.artifactId, `${path}.artifactId`);
+    const slice = reference(value.slice, `${path}.slice`);
+    assertDevelopmentRetirementIdentity({
+        artifactId,
+        nativeLifecycleProof,
+        path,
+        role,
+        slice,
+        stage,
+    });
+    const repositoryName = reference(value.repositoryName, `${path}.repositoryName`, REPOSITORY);
+    if (repositoryName !==
+        containerReleaseRepositoryName({ artifactId, slice, stage })) {
+        fail(`${path}.repositoryName`, 'must equal the repository derived from stage, Slice, and artifact identity');
+    }
+    return {
+        accountId,
+        artifactId,
+        artifactName: reference(value.artifactName, `${path}.artifactName`),
+        candidateArtifactDigest: reference(value.candidateArtifactDigest, `${path}.candidateArtifactDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        entrypoints,
+        imageDigest: reference(value.imageDigest, `${path}.imageDigest`, IMAGE_DIGEST),
+        imports,
+        kind: value.kind === exports.CONTAINER_NATIVE_RUN_PROOF_KIND
+            ? value.kind
+            : fail(`${path}.kind`, 'must identify one native container run proof'),
+        nativeLifecycleProof,
+        platform,
+        region: reference(value.region, `${path}.region`, REGION),
+        repositoryName,
+        role,
+        schemaVersion: value.schemaVersion === exports.CONTAINER_RELEASE_SCHEMA_VERSION
+            ? value.schemaVersion
+            : fail(`${path}.schemaVersion`, 'must equal 1'),
+        slice,
+        sourceCommit: reference(value.sourceCommit, `${path}.sourceCommit`, COMMIT),
+        stage,
+        status: value.status === 'passed'
+            ? value.status
+            : fail(`${path}.status`, 'must prove a passed native lifecycle'),
+    };
+}
+function validateContainerNativeRunProof(value) {
+    const unsigned = unsignedNativeRunProof(value, 'nativeRunProof');
+    const materialDigest = reference(value.materialDigest, 'nativeRunProof.materialDigest', common_js_1.SUPPLY_CHAIN_SHA256);
+    if (materialDigest !== (0, common_js_1.supplyChainDigest)(unsigned)) {
+        fail('nativeRunProof.materialDigest', 'does not match the exact native run proof bytes', 'supply-chain-artifact-mismatch');
+    }
+    return { ...unsigned, materialDigest };
+}
+function createContainerNativeRunProof(input) {
+    const unsigned = unsignedNativeRunProof({
+        ...input,
+        kind: exports.CONTAINER_NATIVE_RUN_PROOF_KIND,
+        materialDigest: '0'.repeat(64),
+        schemaVersion: exports.CONTAINER_RELEASE_SCHEMA_VERSION,
+    }, 'nativeRunProof');
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function unsignedPlatform(value, path) {
+    exactKeys(value, [
+        'accountId',
+        'artifactId',
+        'artifactName',
+        'candidateArtifactDigest',
+        'dockerfileDigest',
+        'imageDigest',
+        'imageReference',
+        'kind',
+        'materialDigest',
+        'platform',
+        'productionClosureDigest',
+        'region',
+        'repositoryName',
+        'runProof',
+        'sbom',
+        'schemaVersion',
+        'slice',
+        'sourceCommit',
+        'stage',
+    ], path);
+    exactKeys(value.sbom, ['componentSetDigest', 'path', 'serialNumber', 'sha256'], `${path}.sbom`);
+    exactKeys(value.runProof, ['materialDigest', 'path', 'sha256'], `${path}.runProof`);
+    const accountId = reference(value.accountId, `${path}.accountId`, ACCOUNT);
+    const region = reference(value.region, `${path}.region`, REGION);
+    const repositoryName = reference(value.repositoryName, `${path}.repositoryName`, REPOSITORY);
+    const imageDigest = reference(value.imageDigest, `${path}.imageDigest`, IMAGE_DIGEST);
+    const platform = exports.CONTAINER_RELEASE_PLATFORMS.includes(value.platform)
+        ? value.platform
+        : fail(`${path}.platform`, 'must be one required v1 Linux architecture');
+    const stage = releaseStage(value.stage, `${path}.stage`);
+    const artifactId = reference(value.artifactId, `${path}.artifactId`);
+    const slice = reference(value.slice, `${path}.slice`);
+    assertDevelopmentRetirementIdentity({ artifactId, path, slice, stage });
+    if (repositoryName !==
+        containerReleaseRepositoryName({ artifactId, slice, stage })) {
+        fail(`${path}.repositoryName`, 'must equal the repository derived from stage, Slice, and artifact identity');
+    }
+    return {
+        accountId,
+        artifactId,
+        artifactName: reference(value.artifactName, `${path}.artifactName`),
+        candidateArtifactDigest: reference(value.candidateArtifactDigest, `${path}.candidateArtifactDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        dockerfileDigest: reference(value.dockerfileDigest, `${path}.dockerfileDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        imageDigest,
+        imageReference: imageReference(value.imageReference, accountId, region, repositoryName, imageDigest, `${path}.imageReference`),
+        kind: value.kind === exports.CONTAINER_PLATFORM_EVIDENCE_KIND
+            ? value.kind
+            : fail(`${path}.kind`, 'must identify platform evidence'),
+        platform,
+        productionClosureDigest: reference(value.productionClosureDigest, `${path}.productionClosureDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        region,
+        repositoryName,
+        runProof: {
+            materialDigest: reference(value.runProof.materialDigest, `${path}.runProof.materialDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+            path: reference(value.runProof.path, `${path}.runProof.path`, EVIDENCE_PATH),
+            sha256: reference(value.runProof.sha256, `${path}.runProof.sha256`, common_js_1.SUPPLY_CHAIN_SHA256),
+        },
+        sbom: {
+            componentSetDigest: reference(value.sbom.componentSetDigest, `${path}.sbom.componentSetDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+            path: reference(value.sbom.path, `${path}.sbom.path`, EVIDENCE_PATH),
+            serialNumber: reference(value.sbom.serialNumber, `${path}.sbom.serialNumber`, SERIAL_NUMBER),
+            sha256: reference(value.sbom.sha256, `${path}.sbom.sha256`, common_js_1.SUPPLY_CHAIN_SHA256),
+        },
+        schemaVersion: value.schemaVersion === exports.CONTAINER_RELEASE_SCHEMA_VERSION
+            ? value.schemaVersion
+            : fail(`${path}.schemaVersion`, 'must equal 1'),
+        slice,
+        sourceCommit: reference(value.sourceCommit, `${path}.sourceCommit`, COMMIT),
+        stage,
+    };
+}
+function validateContainerPlatformEvidence(value) {
+    const unsigned = unsignedPlatform(value, 'platformEvidence');
+    const materialDigest = reference(value.materialDigest, 'platformEvidence.materialDigest', common_js_1.SUPPLY_CHAIN_SHA256);
+    if (materialDigest !== (0, common_js_1.supplyChainDigest)(unsigned)) {
+        fail('platformEvidence.materialDigest', 'does not match the exact platform evidence bytes', 'supply-chain-artifact-mismatch');
+    }
+    return { ...unsigned, materialDigest };
+}
+function createContainerPlatformEvidence(input) {
+    const unsigned = unsignedPlatform({
+        ...input,
+        kind: exports.CONTAINER_PLATFORM_EVIDENCE_KIND,
+        materialDigest: '0'.repeat(64),
+        schemaVersion: exports.CONTAINER_RELEASE_SCHEMA_VERSION,
+    }, 'platformEvidence');
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function normalizeArtifact(value, binding, path) {
+    exactKeys(value, [
+        'artifactId',
+        'artifactName',
+        'candidateArtifactDigest',
+        'dockerfileDigest',
+        'imageDigest',
+        'imageReference',
+        'platforms',
+        'repositoryName',
+        'sbomParityDigest',
+    ], path);
+    if (!Array.isArray(value.platforms)) {
+        fail(`${path}.platforms`, 'must contain both required platform records');
+    }
+    const platforms = value.platforms
+        .map((platform) => validateContainerPlatformEvidence(platform))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.platform, right.platform));
+    const requiredPlatforms = [...exports.CONTAINER_RELEASE_PLATFORMS].sort();
+    const common = platforms[0];
+    if (platforms.length !== requiredPlatforms.length ||
+        platforms.some((platform, index) => platform.platform !== requiredPlatforms[index]) ||
+        !common ||
+        platforms.some((platform) => platform.accountId !== binding.accountId ||
+            platform.region !== binding.region ||
+            platform.slice !== binding.slice ||
+            platform.sourceCommit !== binding.sourceCommit ||
+            platform.stage !== binding.stage ||
+            platform.artifactId !== value.artifactId ||
+            platform.artifactName !== value.artifactName ||
+            platform.candidateArtifactDigest !== value.candidateArtifactDigest ||
+            platform.dockerfileDigest !== value.dockerfileDigest ||
+            platform.repositoryName !== value.repositoryName ||
+            platform.productionClosureDigest !== common.productionClosureDigest)) {
+        fail(`${path}.platforms`, 'must prove one identical candidate and independently derived npm production closure on linux/amd64 and linux/arm64', 'supply-chain-artifact-mismatch');
+    }
+    const repositoryName = reference(value.repositoryName, `${path}.repositoryName`, REPOSITORY);
+    const artifactId = reference(value.artifactId, `${path}.artifactId`);
+    if (repositoryName !==
+        containerReleaseRepositoryName({
+            artifactId,
+            slice: binding.slice,
+            stage: binding.stage,
+        })) {
+        fail(`${path}.repositoryName`, 'must equal the repository derived from stage, Slice, and artifact identity');
+    }
+    const imageDigest = reference(value.imageDigest, `${path}.imageDigest`, IMAGE_DIGEST);
+    const expectedParityDigest = (0, common_js_1.supplyChainDigest)(platforms.map((platform) => ({
+        componentSetDigest: platform.sbom.componentSetDigest,
+        platform: platform.platform,
+        productionClosureDigest: platform.productionClosureDigest,
+        runProof: platform.runProof,
+    })));
+    if (value.sbomParityDigest !== expectedParityDigest) {
+        fail(`${path}.sbomParityDigest`, 'does not bind the complete dual-architecture run and SBOM proof', 'supply-chain-artifact-mismatch');
+    }
+    return {
+        artifactId,
+        artifactName: reference(value.artifactName, `${path}.artifactName`),
+        candidateArtifactDigest: reference(value.candidateArtifactDigest, `${path}.candidateArtifactDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        dockerfileDigest: reference(value.dockerfileDigest, `${path}.dockerfileDigest`, common_js_1.SUPPLY_CHAIN_SHA256),
+        imageDigest,
+        imageReference: imageReference(value.imageReference, binding.accountId, binding.region, repositoryName, imageDigest, `${path}.imageReference`),
+        platforms,
+        repositoryName,
+        sbomParityDigest: expectedParityDigest,
+    };
+}
+function unsignedBinding(value) {
+    exactKeys(value, [
+        'accountId',
+        'artifacts',
+        'builtAt',
+        'kind',
+        'materialDigest',
+        'provenance',
+        'region',
+        'schemaVersion',
+        'slice',
+        'sourceCommit',
+        'stage',
+    ], 'containerReleaseBinding');
+    exactKeys(value.provenance, ['runAttempt', 'runId', 'workflow'], 'containerReleaseBinding.provenance');
+    const accountId = reference(value.accountId, 'containerReleaseBinding.accountId', ACCOUNT);
+    const region = reference(value.region, 'containerReleaseBinding.region', REGION);
+    const slice = reference(value.slice, 'containerReleaseBinding.slice');
+    const sourceCommit = reference(value.sourceCommit, 'containerReleaseBinding.sourceCommit', COMMIT);
+    const stage = releaseStage(value.stage, 'containerReleaseBinding.stage');
+    if (!Array.isArray(value.artifacts) || value.artifacts.length === 0) {
+        fail('containerReleaseBinding.artifacts', 'must contain at least one exact OCI artifact');
+    }
+    const artifacts = value.artifacts
+        .map((artifact, index) => normalizeArtifact(artifact, { accountId, region, slice, sourceCommit, stage }, `containerReleaseBinding.artifacts[${index}]`))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.artifactId, right.artifactId));
+    if (stage === 'development' &&
+        (artifacts.length !== 1 ||
+            artifacts[0]?.artifactId !== `${slice}.job.database-retirement`)) {
+        fail('containerReleaseBinding.artifacts', 'development must bind exactly the database-retirement rehearsal artifact');
+    }
+    if (new Set(artifacts.map(({ artifactId }) => artifactId)).size !==
+        artifacts.length ||
+        new Set(artifacts.map(({ artifactName }) => artifactName)).size !==
+            artifacts.length ||
+        new Set(artifacts.map(({ repositoryName }) => repositoryName)).size !==
+            artifacts.length) {
+        fail('containerReleaseBinding.artifacts', 'must use unique artifact and repository identities');
+    }
+    return {
+        accountId,
+        artifacts,
+        builtAt: timestamp(value.builtAt, 'containerReleaseBinding.builtAt'),
+        kind: value.kind === exports.CONTAINER_RELEASE_BINDING_KIND
+            ? value.kind
+            : fail('containerReleaseBinding.kind', 'must identify a binding'),
+        provenance: {
+            runAttempt: reference(value.provenance.runAttempt, 'containerReleaseBinding.provenance.runAttempt', /^[1-9]\d*$/),
+            runId: reference(value.provenance.runId, 'containerReleaseBinding.provenance.runId', /^[1-9]\d*$/),
+            workflow: reference(value.provenance.workflow, 'containerReleaseBinding.provenance.workflow'),
+        },
+        region,
+        schemaVersion: value.schemaVersion === exports.CONTAINER_RELEASE_SCHEMA_VERSION
+            ? value.schemaVersion
+            : fail('containerReleaseBinding.schemaVersion', 'must equal 1'),
+        slice,
+        sourceCommit,
+        stage,
+    };
+}
+function validateContainerReleaseBinding(value, expected) {
+    const unsigned = unsignedBinding(value);
+    const materialDigest = reference(value.materialDigest, 'containerReleaseBinding.materialDigest', common_js_1.SUPPLY_CHAIN_SHA256);
+    if (materialDigest !== (0, common_js_1.supplyChainDigest)(unsigned)) {
+        fail('containerReleaseBinding.materialDigest', 'does not bind the exact predeploy OCI identities', 'supply-chain-artifact-mismatch');
+    }
+    if (expected &&
+        (unsigned.accountId !== expected.accountId ||
+            unsigned.region !== expected.region ||
+            unsigned.slice !== expected.slice ||
+            unsigned.sourceCommit !== expected.sourceCommit ||
+            unsigned.stage !== expected.stage ||
+            Object.keys(expected.candidateDigests).length !==
+                unsigned.artifacts.length ||
+            unsigned.artifacts.some(({ artifactId, candidateArtifactDigest }) => expected.candidateDigests[artifactId] !== candidateArtifactDigest))) {
+        fail('containerReleaseBinding', 'does not match the exact release candidate and target environment', 'supply-chain-artifact-mismatch');
+    }
+    return { ...unsigned, materialDigest };
+}
+function createContainerReleaseBinding(input) {
+    const unsigned = unsignedBinding({
+        ...input,
+        kind: exports.CONTAINER_RELEASE_BINDING_KIND,
+        materialDigest: '0'.repeat(64),
+        schemaVersion: exports.CONTAINER_RELEASE_SCHEMA_VERSION,
+    });
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function resolveContainerReleaseArtifact(binding, input) {
+    const validated = validateContainerReleaseBinding(binding);
+    const matches = validated.artifacts.filter(({ artifactId }) => artifactId === input.artifactId);
+    if (matches.length !== 1 ||
+        matches[0]?.candidateArtifactDigest !== input.candidateArtifactDigest) {
+        fail('containerReleaseBinding.artifacts', 'does not contain one exact requested candidate artifact', 'supply-chain-artifact-mismatch');
+    }
+    return matches[0];
+}
+function containerReleaseBindingsEqual(left, right) {
+    return ((0, common_js_1.canonicalizeSupplyChainValue)(validateContainerReleaseBinding(left)) ===
+        (0, common_js_1.canonicalizeSupplyChainValue)(validateContainerReleaseBinding(right)));
+}
+//# sourceMappingURL=container-release.js.map

package/src/supply-chain/container-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-release.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/container-release.ts"],"names":[],"mappings":";;;AA8LA,wEAiCC;AA2ND,0EAiBC;AAED,sEAgBC;AAuJD,8EAiBC;AAED,0EAgBC;AAqPD,0EAsCC;AAED,sEAaC;AAED,0EAsBC;AAED,sEAQC;AAn+BD,sEAAyD;AACzD,oDAA4C;AAC5C,2CAKqB;AACrB,2CAA+C;AAE/C,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAC3D,MAAM,UAAU,GACd,qFAAqF,CAAC;AACxF,MAAM,aAAa,GACjB,0DAA0D,CAAC;AAC7D,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAExC,QAAA,gCAAgC,GAC3C,iCAA0C,CAAC;AAChC,QAAA,+BAA+B,GAC1C,gCAAyC,CAAC;AAC/B,QAAA,8BAA8B,GACzC,+BAAwC,CAAC;AAC9B,QAAA,gCAAgC,GAAG,CAAU,CAAC;AAC9C,QAAA,2BAA2B,GAAG;IACzC,aAAa;IACb,aAAa;CACL,CAAC;AACE,QAAA,iCAAiC,GAAG;IAC/C,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;IAC3B,6BAA6B;IAC7B,wBAAwB;CAChB,CAAC;AAsGX,SAAS,IAAI,CACX,IAAY,EACZ,OAAe,EACf,iBAEmC,4BAA4B;IAE/D,MAAM,IAAI,4BAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,OAAO,KAAK,KAAK,aAAa;QAC5B,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,YAAY;QACtB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CACF,IAAI,EACJ,iEAAiE,CAClE,CAAC;AACR,CAAC;AAED,SAAS,mCAAmC,CAAC,KAO5C;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO;IAC1C,IACE,KAAK,CAAC,UAAU,KAAK,GAAG,KAAK,CAAC,KAAK,0BAA0B;QAC7D,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;YACvC,KAAK,CAAC,oBAAoB,KAAK,6BAA6B,CAAC;QAC/D,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EACzD,CAAC;QACD,IAAI,CACF,KAAK,CAAC,IAAI,EACV,uFAAuF,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAC,KAI9C;IACC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACrE,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/C,CAAC,uEAAuE,CAAC,IAAI,CAC3E,KAAK,CAAC,UAAU,CACjB,EACD,CAAC;QACD,IAAI,CACF,gCAAgC,EAChC,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,mCAAmC,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,UAAU,GACd,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,IAAI,CACF,qBAAqB,EACrB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAuB,EACvB,IAAY;IAEZ,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAY,EACZ,UAAkB,kCAAsB;IAExC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,SAAiB,EACjB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,QAAQ,GACZ,GAAG,SAAS,YAAY,MAAM,aAAa,MAAM,GAAG;QACpD,GAAG,cAAc,IAAI,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,qDAAqD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,KAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAe;IAEf,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,OAAO;QACtB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,IAAY;IAEZ,SAAS,CACP,KAAK,EACL;QACE,WAAW;QACX,YAAY;QACZ,cAAc;QACd,yBAAyB;QACzB,aAAa;QACb,aAAa;QACb,SAAS;QACT,MAAM;QACN,gBAAgB;QAChB,sBAAsB;QACtB,UAAU;QACV,QAAQ;QACR,gBAAgB;QAChB,MAAM;QACN,eAAe;QACf,OAAO;QACP,cAAc;QACd,OAAO;QACP,QAAQ;KACT,EACD,IAAI,CACL,CAAC;IACF,MAAM,WAAW,GAAG,UAAU,CAC5B,KAAK,CAAC,WAAW,EACjB,GAAG,IAAI,cAAc,EACrB,0DAA0D,EAC1D,EAAE,CACH,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CACxB,KAAK,CAAC,OAAO,EACb,GAAG,IAAI,UAAU,EACjB,0DAA0D,EAC1D,EAAE,CACH,CAAC;IACF,MAAM,oBAAoB,GAAG,yCAAiC,CAAC,QAAQ,CACrE,KAAK,CAAC,oBAAqD,CAC5D;QACC,CAAC,CAAE,KAAK,CAAC,oBAAsD;QAC/D,CAAC,CAAC,IAAI,CACF,GAAG,IAAI,uBAAuB,EAC9B,8CAA8C,CAC/C,CAAC;IACN,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CACjE,KAAK,CAAC,IAAc,CACrB;QACC,CAAC,CAAE,KAAK,CAAC,IAA0C;QACnD,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACjE,MAAM,oBAAoB,GACxB,CAAC,oBAAoB,KAAK,wBAAwB,IAAI,IAAI,KAAK,SAAS,CAAC;QACzE,CAAC,oBAAoB,KAAK,qBAAqB;YAC7C,IAAI,KAAK,KAAK;YACd,CAAC,WAAW,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC/D,CAAC,oBAAoB,KAAK,2BAA2B;YACnD,IAAI,KAAK,KAAK;YACd,WAAW,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC9D,CAAC,oBAAoB,KAAK,4BAA4B;YACpD,IAAI,KAAK,WAAW;YACpB,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QACpD,CAAC,oBAAoB,KAAK,6BAA6B;YACrD,IAAI,KAAK,YAAY;YACrB,WAAW,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,IAAI,CACF,GAAG,IAAI,uBAAuB,EAC9B,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CACnD,KAAK,CAAC,QAAoC,CAC3C;QACC,CAAC,CAAE,KAAK,CAAC,QAAqC;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,4CAA4C,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACtD,mCAAmC,CAAC;QAClC,UAAU;QACV,oBAAoB;QACpB,IAAI;QACJ,IAAI;QACJ,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,SAAS,CAC9B,KAAK,CAAC,cAAc,EACpB,GAAG,IAAI,iBAAiB,EACxB,UAAU,CACX,CAAC;IACF,IACE,cAAc;QACd,8BAA8B,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC5D,CAAC;QACD,IAAI,CACF,GAAG,IAAI,iBAAiB,EACxB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,UAAU;QACV,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC;QACnE,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;QACD,WAAW;QACX,WAAW,EAAE,SAAS,CACpB,KAAK,CAAC,WAAW,EACjB,GAAG,IAAI,cAAc,EACrB,YAAY,CACb;QACD,OAAO;QACP,IAAI,EACF,KAAK,CAAC,IAAI,KAAK,uCAA+B;YAC5C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,8CAA8C,CAAC;QAC1E,oBAAoB;QACpB,QAAQ;QACR,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,CAAC;QACzD,cAAc;QACd,IAAI;QACJ,aAAa,EACX,KAAK,CAAC,aAAa,KAAK,wCAAgC;YACtD,CAAC,CAAC,KAAK,CAAC,aAAa;YACrB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,cAAc,CAAC;QACnD,KAAK;QACL,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,CAAC;QAC3E,KAAK;QACL,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,sCAAsC,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAc;IAEd,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,SAAS,CAC7B,KAAiC,CAAC,cAAc,EACjD,+BAA+B,EAC/B,+BAAmB,CACpB,CAAC;IACF,IAAI,cAAc,KAAK,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CACF,+BAA+B,EAC/B,iDAAiD,EACjD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAGC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CACrC;QACE,GAAG,KAAK;QACR,IAAI,EAAE,uCAA+B;QACrC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,aAAa,EAAE,wCAAgC;KAChD,EACD,gBAAgB,CACjB,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,IAAY;IAEZ,SAAS,CACP,KAAK,EACL;QACE,WAAW;QACX,YAAY;QACZ,cAAc;QACd,yBAAyB;QACzB,kBAAkB;QAClB,aAAa;QACb,gBAAgB;QAChB,MAAM;QACN,gBAAgB;QAChB,UAAU;QACV,yBAAyB;QACzB,QAAQ;QACR,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,eAAe;QACf,OAAO;QACP,cAAc;QACd,OAAO;KACR,EACD,IAAI,CACL,CAAC;IACF,SAAS,CACP,KAAK,CAAC,IAAI,EACV,CAAC,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EACxD,GAAG,IAAI,OAAO,CACf,CAAC;IACF,SAAS,CACP,KAAK,CAAC,QAAQ,EACd,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,EACpC,GAAG,IAAI,WAAW,CACnB,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,SAAS,CAC9B,KAAK,CAAC,cAAc,EACpB,GAAG,IAAI,iBAAiB,EACxB,UAAU,CACX,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAC3B,KAAK,CAAC,WAAW,EACjB,GAAG,IAAI,cAAc,EACrB,YAAY,CACb,CAAC;IACF,MAAM,QAAQ,GAAG,mCAA2B,CAAC,QAAQ,CACnD,KAAK,CAAC,QAAoC,CAC3C;QACC,CAAC,CAAE,KAAK,CAAC,QAAqC;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,4CAA4C,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACtD,mCAAmC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,IACE,cAAc;QACd,8BAA8B,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC5D,CAAC;QACD,IAAI,CACF,GAAG,IAAI,iBAAiB,EACxB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,UAAU;QACV,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC;QACnE,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;QACD,gBAAgB,EAAE,SAAS,CACzB,KAAK,CAAC,gBAAgB,EACtB,GAAG,IAAI,mBAAmB,EAC1B,+BAAmB,CACpB;QACD,WAAW;QACX,cAAc,EAAE,cAAc,CAC5B,KAAK,CAAC,cAAc,EACpB,SAAS,EACT,MAAM,EACN,cAAc,EACd,WAAW,EACX,GAAG,IAAI,iBAAiB,CACzB;QACD,IAAI,EACF,KAAK,CAAC,IAAI,KAAK,wCAAgC;YAC7C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,iCAAiC,CAAC;QAC7D,QAAQ;QACR,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;QACD,MAAM;QACN,cAAc;QACd,QAAQ,EAAE;YACR,cAAc,EAAE,SAAS,CACvB,KAAK,CAAC,QAAQ,CAAC,cAAc,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;YACD,IAAI,EAAE,SAAS,CACb,KAAK,CAAC,QAAQ,CAAC,IAAI,EACnB,GAAG,IAAI,gBAAgB,EACvB,aAAa,CACd;YACD,MAAM,EAAE,SAAS,CACf,KAAK,CAAC,QAAQ,CAAC,MAAM,EACrB,GAAG,IAAI,kBAAkB,EACzB,+BAAmB,CACpB;SACF;QACD,IAAI,EAAE;YACJ,kBAAkB,EAAE,SAAS,CAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;YACD,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,aAAa,CAAC;YACpE,YAAY,EAAE,SAAS,CACrB,KAAK,CAAC,IAAI,CAAC,YAAY,EACvB,GAAG,IAAI,oBAAoB,EAC3B,aAAa,CACd;YACD,MAAM,EAAE,SAAS,CACf,KAAK,CAAC,IAAI,CAAC,MAAM,EACjB,GAAG,IAAI,cAAc,EACrB,+BAAmB,CACpB;SACF;QACD,aAAa,EACX,KAAK,CAAC,aAAa,KAAK,wCAAgC;YACtD,CAAC,CAAC,KAAK,CAAC,aAAa;YACrB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,cAAc,CAAC;QACnD,KAAK;QACL,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,CAAC;QAC3E,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,KAAc;IAEd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,SAAS,CAC7B,KAAiC,CAAC,cAAc,EACjD,iCAAiC,EACjC,+BAAmB,CACpB,CAAC;IACF,IAAI,cAAc,KAAK,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CACF,iCAAiC,EACjC,kDAAkD,EAClD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAGC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAC/B;QACE,GAAG,KAAK;QACR,IAAI,EAAE,wCAAgC;QACtC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,aAAa,EAAE,wCAAgC;KAChD,EACD,kBAAkB,CACnB,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,OAMC,EACD,IAAY;IAEZ,SAAS,CACP,KAAK,EACL;QACE,YAAY;QACZ,cAAc;QACd,yBAAyB;QACzB,kBAAkB;QAClB,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,gBAAgB;QAChB,kBAAkB;KACnB,EACD,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS;SAC9B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,iCAAiC,CAAC,QAAQ,CAAC,CAAC;SAC9D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,MAAM,iBAAiB,GAAG,CAAC,GAAG,mCAA2B,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5B,IACE,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;QAC7C,SAAS,CAAC,IAAI,CACZ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,CACpE;QACD,CAAC,MAAM;QACP,SAAS,CAAC,IAAI,CACZ,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACxC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAClC,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;YAChC,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;YAC9C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;YAChC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;YACxC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAC5C,QAAQ,CAAC,uBAAuB,KAAK,KAAK,CAAC,uBAAuB;YAClE,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;YACpD,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAChD,QAAQ,CAAC,uBAAuB,KAAK,MAAM,CAAC,uBAAuB,CACtE,EACD,CAAC;QACD,IAAI,CACF,GAAG,IAAI,YAAY,EACnB,oHAAoH,EACpH,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAC9B,KAAK,CAAC,cAAc,EACpB,GAAG,IAAI,iBAAiB,EACxB,UAAU,CACX,CAAC;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACrE,IACE,cAAc;QACd,8BAA8B,CAAC;YAC7B,UAAU;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,EACF,CAAC;QACD,IAAI,CACF,GAAG,IAAI,iBAAiB,EACxB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAC3B,KAAK,CAAC,WAAW,EACjB,GAAG,IAAI,cAAc,EACrB,YAAY,CACb,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAA,6BAAiB,EAC5C,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3B,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB;QACpD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;QACzD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC,CACJ,CAAC;IACF,IAAI,KAAK,CAAC,gBAAgB,KAAK,oBAAoB,EAAE,CAAC;QACpD,IAAI,CACF,GAAG,IAAI,mBAAmB,EAC1B,iEAAiE,EACjE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC;QACnE,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,GAAG,IAAI,0BAA0B,EACjC,+BAAmB,CACpB;QACD,gBAAgB,EAAE,SAAS,CACzB,KAAK,CAAC,gBAAgB,EACtB,GAAG,IAAI,mBAAmB,EAC1B,+BAAmB,CACpB;QACD,WAAW;QACX,cAAc,EAAE,cAAc,CAC5B,KAAK,CAAC,cAAc,EACpB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,cAAc,EACd,WAAW,EACX,GAAG,IAAI,iBAAiB,CACzB;QACD,SAAS;QACT,cAAc;QACd,gBAAgB,EAAE,oBAAoB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAc;IAEd,SAAS,CACP,KAAK,EACL;QACE,WAAW;QACX,WAAW;QACX,SAAS;QACT,MAAM;QACN,gBAAgB;QAChB,YAAY;QACZ,QAAQ;QACR,eAAe;QACf,OAAO;QACP,cAAc;QACd,OAAO;KACR,EACD,yBAAyB,CAC1B,CAAC;IACF,SAAS,CACP,KAAK,CAAC,UAAU,EAChB,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,EACnC,oCAAoC,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CACzB,KAAK,CAAC,SAAS,EACf,mCAAmC,EACnC,OAAO,CACR,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CACtB,KAAK,CAAC,MAAM,EACZ,gCAAgC,EAChC,MAAM,CACP,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,SAAS,CAC5B,KAAK,CAAC,YAAY,EAClB,sCAAsC,EACtC,MAAM,CACP,CAAC;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,IAAI,CACF,mCAAmC,EACnC,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS;SAC9B,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CACvB,iBAAiB,CACf,QAAQ,EACR,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EACjD,qCAAqC,KAAK,GAAG,CAC9C,CACF;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,IACE,KAAK,KAAK,aAAa;QACvB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACrB,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,GAAG,KAAK,0BAA0B,CAAC,EAClE,CAAC;QACD,IAAI,CACF,mCAAmC,EACnC,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,IACE,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,CAAC,MAAM;QAClB,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YAC7D,SAAS,CAAC,MAAM;QAClB,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,CAAC,MAAM,EAClB,CAAC;QACD,IAAI,CACF,mCAAmC,EACnC,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,SAAS;QACT,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,iCAAiC,CAAC;QACpE,IAAI,EACF,KAAK,CAAC,IAAI,KAAK,sCAA8B;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;QACrE,UAAU,EAAE;YACV,UAAU,EAAE,SAAS,CACnB,KAAK,CAAC,UAAU,CAAC,UAAU,EAC3B,+CAA+C,EAC/C,YAAY,CACb;YACD,KAAK,EAAE,SAAS,CACd,KAAK,CAAC,UAAU,CAAC,KAAK,EACtB,0CAA0C,EAC1C,YAAY,CACb;YACD,QAAQ,EAAE,SAAS,CACjB,KAAK,CAAC,UAAU,CAAC,QAAQ,EACzB,6CAA6C,CAC9C;SACF;QACD,MAAM;QACN,aAAa,EACX,KAAK,CAAC,aAAa,KAAK,wCAAgC;YACtD,CAAC,CAAC,KAAK,CAAC,aAAa;YACrB,CAAC,CAAC,IAAI,CAAC,uCAAuC,EAAE,cAAc,CAAC;QACnE,KAAK;QACL,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAc,EACd,QAAwC;IAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,SAAS,CAC7B,KAAiC,CAAC,cAAc,EACjD,wCAAwC,EACxC,+BAAmB,CACpB,CAAC;IACF,IAAI,cAAc,KAAK,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CACF,wCAAwC,EACxC,kDAAkD,EAClD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,QAAQ;QACR,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YACxC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACnC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YACjC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;YAC/C,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YACjC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM;gBAC3C,QAAQ,CAAC,SAAS,CAAC,MAAM;YAC3B,QAAQ,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAC1C,QAAQ,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,uBAAuB,CACpE,CAAC,EACJ,CAAC;QACD,IAAI,CACF,yBAAyB,EACzB,mEAAmE,EACnE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAGC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,GAAG,KAAK;QACR,IAAI,EAAE,sCAA8B;QACpC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,aAAa,EAAE,wCAAgC;KAChD,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,+BAA+B,CAC7C,OAAkC,EAClC,KAGC;IAED,MAAM,SAAS,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CACxC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CACpD,CAAC;IACF,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,EAAE,uBAAuB,KAAK,KAAK,CAAC,uBAAuB,EACrE,CAAC;QACD,IAAI,CACF,mCAAmC,EACnC,yDAAyD,EACzD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,6BAA6B,CAC3C,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,CACL,IAAA,wCAA4B,EAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACnE,IAAA,wCAA4B,EAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC"}

package/src/supply-chain/ecr-applicability.d.ts

@@ -0,0 +1,19 @@
+export declare const ECR_SCAN_APPLICABILITY_KIND: "ebk-ecr-scan-applicability";
+export declare const ECR_SCAN_APPLICABILITY_SCHEMA_VERSION: 1;
+export type EcrScanApplicabilityStatus = 'applicable' | 'not-a-container' | 'unsupported-current-sst-context-build' | 'unsupported-container-artifact';
+export interface EcrScanApplicabilityReportV1 {
+    artifacts: readonly {
+        artifactId: string;
+        artifactName: string;
+        reason: string;
+        status: EcrScanApplicabilityStatus;
+        workload: string;
+    }[];
+    kind: typeof ECR_SCAN_APPLICABILITY_KIND;
+    materialDigest: string;
+    schemaVersion: typeof ECR_SCAN_APPLICABILITY_SCHEMA_VERSION;
+    slice: string;
+    unit7Obligation: 'not-required' | 'pre-v1-exact-digest-container-consumption-and-live-ecr-proof';
+}
+export declare function assessEcrScanApplicability(releaseControls: unknown, slice: string): EcrScanApplicabilityReportV1;
+export declare function verifyEcrScanApplicability(value: EcrScanApplicabilityReportV1, releaseControls: unknown, slice: string): EcrScanApplicabilityReportV1;

package/src/supply-chain/ecr-applicability.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ECR_SCAN_APPLICABILITY_SCHEMA_VERSION = exports.ECR_SCAN_APPLICABILITY_KIND = void 0;
+exports.assessEcrScanApplicability = assessEcrScanApplicability;
+exports.verifyEcrScanApplicability = verifyEcrScanApplicability;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+exports.ECR_SCAN_APPLICABILITY_KIND = 'ebk-ecr-scan-applicability';
+exports.ECR_SCAN_APPLICABILITY_SCHEMA_VERSION = 1;
+function invalid(path, message) {
+    throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, message);
+}
+function exactReference(value, path) {
+    if (typeof value !== 'string' || !common_js_1.SUPPLY_CHAIN_REFERENCE.test(value)) {
+        return invalid(path, 'must be one bounded exact artifact reference');
+    }
+    return value;
+}
+function classifyArtifact(value, index) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        return invalid(`artifactInventory[${index}]`, 'must be one release artifact record');
+    }
+    const artifactId = exactReference(value.id, `artifactInventory[${index}].id`);
+    const artifactName = exactReference(value.name, `artifactInventory[${index}].name`);
+    const workload = exactReference(value.workload, `artifactInventory[${index}].workload`);
+    const finalArtifact = value.finalArtifact;
+    if (!(0, validation_js_1.isRecord)(finalArtifact)) {
+        return invalid(`artifactInventory[${index}].finalArtifact`, 'must state final-artifact support explicitly');
+    }
+    if (!['job', 'service'].includes(workload)) {
+        return {
+            artifactId,
+            artifactName,
+            reason: 'ECR enhanced scanning applies only to an OCI Service or Job image.',
+            status: 'not-a-container',
+            workload,
+        };
+    }
+    if (finalArtifact.support === 'supported' &&
+        finalArtifact.family === 'oci-image' &&
+        finalArtifact.imageConsumption === 'digest-qualified') {
+        return {
+            artifactId,
+            artifactName,
+            reason: 'The protected deploy path consumes one independently discoverable digest-qualified OCI image.',
+            status: 'applicable',
+            workload,
+        };
+    }
+    if (finalArtifact.support === 'unsupported' &&
+        finalArtifact.family === 'sst-provider-artifact') {
+        return {
+            artifactId,
+            artifactName,
+            reason: 'SST currently builds this image from context during deployment and does not expose an exact predeploy image digest.',
+            status: 'unsupported-current-sst-context-build',
+            workload,
+        };
+    }
+    return {
+        artifactId,
+        artifactName,
+        reason: 'The container artifact does not declare exact digest-qualified deployment consumption.',
+        status: 'unsupported-container-artifact',
+        workload,
+    };
+}
+function assessEcrScanApplicability(releaseControls, slice) {
+    if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(slice) ||
+        !(0, validation_js_1.isRecord)(releaseControls) ||
+        releaseControls.schemaVersion !== 1 ||
+        !Array.isArray(releaseControls.artifactInventory) ||
+        releaseControls.artifactInventory.length === 0) {
+        return invalid('releaseControls', 'must contain one nonempty v1 release artifact inventory');
+    }
+    const artifacts = releaseControls.artifactInventory
+        .map(classifyArtifact)
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.artifactId, right.artifactId));
+    if (new Set(artifacts.map(({ artifactId }) => artifactId)).size !==
+        artifacts.length) {
+        return invalid('releaseControls.artifactInventory', 'must not contain duplicate artifact identities');
+    }
+    const unsigned = {
+        artifacts,
+        kind: exports.ECR_SCAN_APPLICABILITY_KIND,
+        schemaVersion: exports.ECR_SCAN_APPLICABILITY_SCHEMA_VERSION,
+        slice,
+        unit7Obligation: artifacts.some(({ status }) => status === 'unsupported-current-sst-context-build')
+            ? 'pre-v1-exact-digest-container-consumption-and-live-ecr-proof'
+            : 'not-required',
+    };
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function verifyEcrScanApplicability(value, releaseControls, slice) {
+    const expected = assessEcrScanApplicability(releaseControls, slice);
+    if ((0, common_js_1.supplyChainDigest)(value) !== (0, common_js_1.supplyChainDigest)(expected)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'ecrScanApplicability', 'does not match the exact current release artifact inventory');
+    }
+    return value;
+}
+//# sourceMappingURL=ecr-applicability.js.map