@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/generated-container-release-command.js

@@ -0,0 +1,2087 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CRANE_RELEASES = exports.CRANE_VERSION = void 0;
+exports.renderContainerReleaseCommand = renderContainerReleaseCommand;
+const generated_ecr_collector_command_js_1 = require("./generated-ecr-collector-command.js");
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+exports.CRANE_VERSION = '0.21.7';
+exports.CRANE_RELEASES = Object.freeze({
+    'linux-arm64': {
+        archiveFormat: 'tar-gzip',
+        sha256: 'b6ee979d9411dfb05ce35ab9e156fe5de7def11a230764a7856ffa2eb971fa88',
+        source: 'https://github.com/google/go-containerregistry/releases/download/v0.21.7/go-containerregistry_Linux_arm64.tar.gz',
+    },
+    'linux-x64': {
+        archiveFormat: 'tar-gzip',
+        sha256: '1a57bc98207fa1c0d04bf760699099e26f8383499bfd55b99c1b919a928a7230',
+        source: 'https://github.com/google/go-containerregistry/releases/download/v0.21.7/go-containerregistry_Linux_x86_64.tar.gz',
+    },
+});
+function validatedReleases(releases) {
+    if (Object.keys(releases).length === 0 ||
+        Object.entries(releases).some(([platform, release]) => !/^linux-(?:arm64|x64)$/.test(platform) ||
+            !['binary', 'tar-gzip'].includes(release.archiveFormat) ||
+            !/^[a-f0-9]{64}$/.test(release.sha256) ||
+            !/^https:\/\/github\.com\/anchore\/syft\/releases\/download\/v\d+\.\d+\.\d+\/[A-Za-z0-9._-]+$/.test(release.source))) {
+        throw new Error('Container-release Syft assets must be exact official integrity-bound releases.');
+    }
+    return releases;
+}
+function validatedCraneReleases(releases) {
+    if (Object.keys(releases).length === 0 ||
+        Object.entries(releases).some(([platform, release]) => !/^linux-(?:arm64|x64)$/.test(platform) ||
+            release.archiveFormat !== 'tar-gzip' ||
+            !/^[a-f0-9]{64}$/.test(release.sha256) ||
+            !/^https:\/\/github\.com\/google\/go-containerregistry\/releases\/download\/v\d+\.\d+\.\d+\/go-containerregistry_Linux_(?:arm64|x86_64)\.tar\.gz$/.test(release.source))) {
+        throw new Error('Container-release Crane assets must be exact official integrity-bound releases.');
+    }
+    return releases;
+}
+/** Render the protected native-platform OCI build and assembly command. */
+function renderContainerReleaseCommand(options = {}) {
+    const moduleSpecifier = options.moduleSpecifier ?? '@empire-builder-kit/nx/supply-chain';
+    const releases = validatedReleases(options.releases ?? generated_ecr_collector_command_js_1.SYFT_COLLECTOR_RELEASES);
+    const syftVersion = options.syftVersion ?? generated_ecr_collector_command_js_1.SYFT_VERSION;
+    const craneReleases = validatedCraneReleases(options.craneReleases ?? exports.CRANE_RELEASES);
+    const craneVersion = options.craneVersion ?? exports.CRANE_VERSION;
+    if (!/^(?:@empire-builder-kit\/nx\/supply-chain|file:\/\/\/[^'"\n]+)$/.test(moduleSpecifier) ||
+        !/^\d+\.\d+\.\d+$/.test(syftVersion) ||
+        !/^\d+\.\d+\.\d+$/.test(craneVersion)) {
+        throw new Error('The generated container release configuration is invalid.');
+    }
+    return `import { createHash } from 'node:crypto';
+import { execFileSync, spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { tmpdir } from 'node:os';
+import {
+  CONTAINER_NATIVE_LIFECYCLE_PROOFS,
+  CONTAINER_RELEASE_PLATFORMS,
+  containerReleaseRepositoryName,
+  createContainerNativeRunProof,
+  createContainerPlatformEvidence,
+  createContainerReleaseBinding,
+  resolveContainerReleaseArtifact,
+  supplyChainDigest,
+  validateContainerArtifactIdentity,
+  validateContainerReleaseBinding,
+  validateContainerNativeRunProof,
+  validateContainerPlatformEvidence,
+  validateReviewedReleaseCheckout,
+} from '${moduleSpecifier}';
+
+const SYFT_VERSION = ${JSON.stringify(syftVersion)};
+const SYFT_RELEASES = Object.freeze(${JSON.stringify(releases)});
+const CRANE_VERSION = ${JSON.stringify(craneVersion)};
+const CRANE_RELEASES = Object.freeze(${JSON.stringify(craneReleases)});
+const SHA256 = /^[a-f0-9]{64}$/;
+const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const REFERENCE = new RegExp(${JSON.stringify((0, safe_reference_1.safeReferencePatternSource)())});
+const PACKAGE_NAME =
+  /^(?:@[A-Za-z0-9][A-Za-z0-9._-]*[/])?[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const AWS_REGION_NAME =
+  /^(?=.{9,32}$)[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\\d$/;
+const MAX_TOOL_BYTES = 100 * 1024 * 1024;
+const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+const mode = process.argv[2];
+const requestedPlatform = process.argv[3];
+if (
+  !['platform', 'assemble', 'promote'].includes(mode) ||
+  (mode === 'platform' &&
+    !CONTAINER_RELEASE_PLATFORMS.includes(requestedPlatform)) ||
+  (['assemble', 'promote'].includes(mode) && requestedPlatform !== undefined)
+) {
+  throw new Error(
+    'Usage: container-release.mjs <platform linux/amd64|platform linux/arm64|assemble|promote>',
+  );
+}
+
+const digestBytes = (value) =>
+  createHash('sha256').update(value).digest('hex');
+const repositoryRoot = realpathSync(
+  execFileSync('git', ['rev-parse', '--show-toplevel'], {
+    encoding: 'utf8',
+  }).trim(),
+);
+const sliceRoot = realpathSync(process.cwd());
+const slice = basename(sliceRoot);
+if (
+  relative(repositoryRoot, sliceRoot).split(sep).join('/') !==
+    'packages/' + slice
+) {
+  throw new Error('Container release must run from one exact Product Slice root.');
+}
+const deploymentSourceCommit = process.env.EBK_SOURCE_COMMIT?.trim() ?? '';
+const sourceCommit =
+  process.env.EBK_RELEASE_SOURCE_COMMIT?.trim() ?? deploymentSourceCommit;
+const stage = process.env.EBK_STAGE?.trim() ?? '';
+const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+const region = process.env.AWS_REGION?.trim() ?? '';
+const runId = process.env.GITHUB_RUN_ID?.trim() ?? '';
+const runAttempt = process.env.GITHUB_RUN_ATTEMPT?.trim() ?? '';
+const workflow = process.env.GITHUB_WORKFLOW_REF?.trim() ?? '';
+if (
+  !COMMIT.test(deploymentSourceCommit) ||
+  !COMMIT.test(sourceCommit) ||
+  !['development', 'staging', 'production'].includes(stage) ||
+  !/^\\d{12}$/.test(accountId) ||
+  !AWS_REGION_NAME.test(region) ||
+  !/^[1-9]\\d*$/.test(runId) ||
+  !/^[1-9]\\d*$/.test(runAttempt) ||
+  !REFERENCE.test(workflow)
+) {
+  throw new Error(
+    'Container release requires one exact protected source, run, account, Region, and stage.',
+  );
+}
+const requireReviewedCheckout = () => {
+  validateReviewedReleaseCheckout({
+    deploymentSourceCommit,
+    releaseSourceCommit: sourceCommit,
+    repositoryRoot,
+  });
+  const checkoutStatus = execFileSync(
+    'git',
+    ['status', '--porcelain=v1', '--untracked-files=all'],
+    { encoding: 'utf8' },
+  );
+  if (checkoutStatus.length !== 0) {
+    throw new Error(
+      'Container release requires an entirely clean reviewed checkout.',
+    );
+  }
+};
+requireReviewedCheckout();
+const safePath = (candidate, label, options = {}) => {
+  if (
+    typeof candidate !== 'string' ||
+    candidate === '' ||
+    candidate !== candidate.trim() ||
+    isAbsolute(candidate)
+  ) {
+    throw new Error(label + ' must be one relative repository path.');
+  }
+  const absolute = resolve(options.base ?? repositoryRoot, candidate);
+  const fromRoot = relative(repositoryRoot, absolute);
+  if (
+    fromRoot === '..' ||
+    fromRoot.startsWith('..' + sep) ||
+    isAbsolute(fromRoot)
+  ) {
+    throw new Error(label + ' escapes the repository.');
+  }
+  let walked = repositoryRoot;
+  for (const segment of fromRoot.split(sep).filter(Boolean)) {
+    walked = join(walked, segment);
+    if (!existsSync(walked)) {
+      if (options.output) return absolute;
+      throw new Error(label + ' is absent.');
+    }
+    if (lstatSync(walked).isSymbolicLink()) {
+      throw new Error(label + ' may not traverse symbolic links.');
+    }
+  }
+  if (!options.output && realpathSync(absolute) !== absolute) {
+    throw new Error(label + ' aliases another path.');
+  }
+  return absolute;
+};
+const digestCandidatePaths = (paths, label) => {
+  if (!Array.isArray(paths) || paths.length === 0) {
+    throw new Error(label + ' must name at least one candidate path.');
+  }
+  const files = [];
+  const seen = new Set();
+  const visit = (absolute) => {
+    const metadata = lstatSync(absolute);
+    if (metadata.isSymbolicLink()) {
+      throw new Error(label + ' may not traverse symbolic links.');
+    }
+    if (metadata.isDirectory()) {
+      for (const child of readdirSync(absolute).sort()) {
+        visit(
+          safePath(
+            relative(repositoryRoot, join(absolute, child)),
+            label,
+          ),
+        );
+      }
+      return;
+    }
+    if (!metadata.isFile()) {
+      throw new Error(label + ' may contain only regular files.');
+    }
+    const normalized = relative(repositoryRoot, absolute)
+      .split(sep)
+      .join('/');
+    if (seen.has(normalized)) {
+      throw new Error(label + ' contains overlapping candidate paths.');
+    }
+    seen.add(normalized);
+    files.push([normalized, absolute]);
+  };
+  for (const candidate of [...paths].sort()) {
+    visit(safePath(candidate, label));
+  }
+  const hash = createHash('sha256');
+  for (const [path, absolute] of files.sort(([left], [right]) =>
+    left < right ? -1 : left > right ? 1 : 0,
+  )) {
+    const content = readFileSync(absolute);
+    hash.update(path, 'utf8');
+    hash.update('\\0');
+    hash.update(String(content.byteLength), 'utf8');
+    hash.update('\\0');
+    hash.update(content);
+    hash.update('\\0');
+  }
+  return hash.digest('hex');
+};
+const readJson = (path, label) => {
+  const metadata = lstatSync(path);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size <= 0 ||
+    metadata.size > MAX_OUTPUT_BYTES
+  ) {
+    throw new Error(label + ' must be one bounded regular file.');
+  }
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    throw new Error(label + ' is not valid JSON.');
+  }
+};
+const immutableWrite = (path, value) => {
+  const serialized =
+    typeof value === 'string' ? value : JSON.stringify(value, null, 2) + '\\n';
+  mkdirSync(resolve(path, '..'), { recursive: true, mode: 0o700 });
+  try {
+    writeFileSync(path, serialized, {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600,
+    });
+  } catch (error) {
+    if (readFileSync(path, 'utf8') !== serialized) throw error;
+  }
+};
+const execute = (command, args, label, options = {}) => {
+  try {
+    return execFileSync(command, args, {
+      cwd: options.cwd ?? repositoryRoot,
+      encoding: options.encoding ?? 'utf8',
+      env: { ...process.env, ...(options.env ?? {}) },
+      input: options.input,
+      maxBuffer: options.maximumBytes ?? MAX_OUTPUT_BYTES,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    throw new Error(
+      label + ' failed without complete evidence: ' +
+        String(error?.stderr ?? error?.message ?? error).slice(0, 2_000),
+    );
+  }
+};
+const awsJson = (args, label) => {
+  const raw = execute('aws', args, label);
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(label + ' returned invalid JSON.');
+  }
+};
+const describeRepository = (repositoryName) => {
+  const result = spawnSync(
+    'aws',
+    [
+      'ecr',
+      'describe-repositories',
+      '--repository-names',
+      repositoryName,
+      '--region',
+      region,
+      '--output',
+      'json',
+    ],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: MAX_OUTPUT_BYTES,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    },
+  );
+  if (result.status === 0) {
+    try {
+      return JSON.parse(result.stdout);
+    } catch {
+      throw new Error('ECR repository lookup returned invalid JSON.');
+    }
+  }
+  const error = String(result.stderr ?? '');
+  if (
+    !error.startsWith(
+      'An error occurred (RepositoryNotFoundException) when calling the DescribeRepositories operation:',
+    )
+  ) {
+    throw new Error('ECR repository lookup failed outside the create-if-absent path.');
+  }
+  return undefined;
+};
+const caller = awsJson(
+  ['sts', 'get-caller-identity', '--output', 'json'],
+  'AWS caller identity',
+);
+if (caller?.Account !== accountId) {
+  throw new Error('Container release AWS caller differs from the target account.');
+}
+const controls = readJson(
+  safePath('operations/release.json', 'Release controls', { base: sliceRoot }),
+  'Release controls',
+);
+const candidateBundle = safePath(
+  '.ebk/evidence/release-candidate/packages/' + slice +
+    '/release-artifacts.json',
+  'Release artifact evidence',
+);
+const artifactEvidence = readJson(candidateBundle, 'Release artifact evidence');
+if (
+  controls?.schemaVersion !== 1 ||
+  !Array.isArray(controls.artifactInventory) ||
+  controls.artifactInventory.length === 0 ||
+  artifactEvidence?.kind !== 'ebk-release-artifact-evidence' ||
+  artifactEvidence.schemaVersion !== 1 ||
+  artifactEvidence.sourceCommit !== sourceCommit ||
+  !Array.isArray(artifactEvidence.artifacts) ||
+  artifactEvidence.inventoryDigest !==
+    digestBytes(Buffer.from(JSON.stringify(controls.artifactInventory), 'utf8'))
+) {
+  throw new Error('Container release controls and candidate evidence are stale.');
+}
+const capturedByName = new Map(
+  artifactEvidence.artifacts.map((artifact) => [artifact?.name, artifact]),
+);
+const declaredContainers = controls.artifactInventory
+  .filter(
+    (artifact) =>
+      artifact?.finalArtifact?.support === 'supported' &&
+      artifact.finalArtifact.family === 'oci-image' &&
+      artifact.finalArtifact.imageConsumption === 'digest-qualified',
+  )
+  .sort((left, right) =>
+    String(left.id) < String(right.id)
+      ? -1
+      : String(left.id) > String(right.id)
+        ? 1
+        : 0,
+  );
+if (declaredContainers.length === 0) {
+  throw new Error('Release controls contain no digest-qualified OCI artifacts.');
+}
+const releaseContainerInputs = declaredContainers.map((declared, index) => {
+  const identity = validateContainerArtifactIdentity(
+    declared,
+    slice,
+    'artifactInventory[' + String(index) + ']',
+  );
+  const captured = capturedByName.get(declared.name);
+  const candidateArtifactDigest =
+    captured?.classification === 'stage-neutral'
+      ? captured.digest
+      : captured?.candidateDigest;
+  const candidate = declared.candidate;
+  const materialDigest = digestCandidatePaths(
+    candidate.materialPaths,
+    'OCI artifact candidate material',
+  );
+  const buildRecipeDigest = digestCandidatePaths(
+    candidate.recipePaths,
+    'OCI artifact candidate recipe',
+  );
+  const sourceInputsDigest = digestCandidatePaths(
+    candidate.sourceInputPaths,
+    'OCI artifact source inputs',
+  );
+  const container = declared.finalArtifact.container;
+  if (
+    !declared ||
+    !REFERENCE.test(declared.id ?? '') ||
+    !REFERENCE.test(declared.name ?? '') ||
+    !['job', 'service'].includes(declared.workload) ||
+    !captured ||
+    !SHA256.test(candidateArtifactDigest ?? '') ||
+    !container ||
+    Object.keys(container).sort().join('\\0') !==
+      [
+        'context',
+        'dockerfile',
+        'nativeLifecycleProof',
+        'proofEntrypoints',
+        'proofImports',
+        'role',
+      ].join('\\0') ||
+    typeof container.context !== 'string' ||
+    typeof container.dockerfile !== 'string' ||
+    !['job', 'migration', 'retirement', 'service'].includes(container.role) ||
+    !CONTAINER_NATIVE_LIFECYCLE_PROOFS.includes(
+      container.nativeLifecycleProof,
+    ) ||
+    !(
+      (container.nativeLifecycleProof === 'service-default-health' &&
+        container.role === 'service') ||
+      (container.nativeLifecycleProof === 'job-default-success' &&
+        container.role === 'job' &&
+        !container.proofEntrypoints?.includes(
+          'dist/jobs/data-retention/src/run.js',
+        )) ||
+      (container.nativeLifecycleProof === 'retention-default-refusal' &&
+        container.role === 'job' &&
+        container.proofEntrypoints?.includes(
+          'dist/jobs/data-retention/src/run.js',
+        )) ||
+      (container.nativeLifecycleProof === 'migration-explicit-refusal' &&
+        container.role === 'migration' &&
+        container.proofEntrypoints?.includes('jobs/migrate-database.mjs')) ||
+      (container.nativeLifecycleProof === 'retirement-explicit-refusal' &&
+        container.role === 'retirement' &&
+        container.proofEntrypoints?.includes('jobs/retire-database.mjs'))
+    ) ||
+    !Array.isArray(container.proofEntrypoints) ||
+    container.proofEntrypoints.length === 0 ||
+    container.proofEntrypoints.length > 16 ||
+    container.proofEntrypoints.some(
+      (entrypoint) =>
+        typeof entrypoint !== 'string' ||
+        !/^(?!\\/)(?!.*(?:^|\\/)\\.\\.(?:\\/|$))[A-Za-z0-9._/-]{1,256}$/.test(
+          entrypoint,
+        ),
+    ) ||
+    !Array.isArray(container.proofImports) ||
+    container.proofImports.length === 0 ||
+    container.proofImports.length > 32 ||
+    container.proofImports.some(
+      (specifier) =>
+        typeof specifier !== 'string' ||
+        !/^(?:@[a-z0-9._-]+\\/[a-z0-9._/-]+|[a-z0-9][a-z0-9._/-]*)$/.test(
+          specifier,
+        ),
+    )
+  ) {
+    throw new Error(
+      'OCI artifact ' + index + ' does not match the exact container contract.',
+    );
+  }
+  if (
+    candidateArtifactDigest !== materialDigest ||
+    captured.buildRecipeDigest !== buildRecipeDigest ||
+    captured.sourceInputsDigest !== sourceInputsDigest ||
+    captured.workload !== declared.workload ||
+    JSON.stringify(captured.stages) !==
+      JSON.stringify(['production', 'staging'])
+  ) {
+    throw new Error(
+      'OCI artifact candidate evidence does not bind its exact material, recipe, source, and workload authority.',
+    );
+  }
+  const context = safePath(container.context, 'Container context');
+  const dockerfile = safePath(container.dockerfile, 'Container Dockerfile');
+  if (!lstatSync(context).isDirectory() || !lstatSync(dockerfile).isFile()) {
+    throw new Error('Container context or Dockerfile has the wrong file type.');
+  }
+  const packageManifestPath = safePath(
+    identity.packageManifest,
+    'Container package manifest',
+  );
+  const packageManifest = readJson(
+    packageManifestPath,
+    'Container package manifest',
+  );
+  if (
+    !PACKAGE_NAME.test(packageManifest?.name ?? '') ||
+    typeof packageManifest?.version !== 'string' ||
+    !/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(packageManifest.version)
+  ) {
+    throw new Error('Container package manifest has no exact package identity.');
+  }
+  return {
+    buildRecipeDigest,
+    candidateArtifactDigest,
+    context,
+    declared,
+    dockerfile,
+    materialDigest,
+    packageManifestPath,
+    packageName: packageManifest.name,
+    nativeLifecycleProof: container.nativeLifecycleProof,
+    proofEntrypoints: [...new Set(container.proofEntrypoints)].sort(),
+    proofImports: [...new Set(container.proofImports)].sort(),
+    sourceInputsDigest,
+  };
+});
+if (
+  capturedByName.size !== artifactEvidence.artifacts.length ||
+  releaseContainerInputs.some(
+    ({ declared }) =>
+      artifactEvidence.artifacts.filter(({ name }) => name === declared.name)
+        .length !== 1,
+  )
+) {
+  throw new Error('Container release candidate artifact identities are ambiguous.');
+}
+const requireCandidateAuthority = (input) => {
+  if (
+    digestCandidatePaths(
+      input.declared.candidate.materialPaths,
+      'OCI artifact candidate material',
+    ) !== input.materialDigest ||
+    digestCandidatePaths(
+      input.declared.candidate.recipePaths,
+      'OCI artifact candidate recipe',
+    ) !== input.buildRecipeDigest ||
+    digestCandidatePaths(
+      input.declared.candidate.sourceInputPaths,
+      'OCI artifact source inputs',
+    ) !== input.sourceInputsDigest
+  ) {
+    throw new Error(
+      'Container release source or candidate bytes changed after authority validation.',
+    );
+  }
+};
+const retirementArtifactId = slice + '.job.database-retirement';
+const containerInputs =
+  stage === 'development'
+    ? releaseContainerInputs.filter(
+        ({ declared }) => declared.id === retirementArtifactId,
+      )
+    : releaseContainerInputs;
+if (
+  stage === 'development' &&
+  (mode === 'promote' ||
+    containerInputs.length !== 1 ||
+    containerInputs[0]?.declared.finalArtifact.container.role !== 'retirement' ||
+    containerInputs[0]?.nativeLifecycleProof !== 'retirement-explicit-refusal')
+) {
+  throw new Error(
+    'Development container release is reserved for one exact database-retirement rehearsal artifact.',
+  );
+}
+const registrySuffix = region.startsWith('cn-') ? '.com.cn' : '.com';
+const registry =
+  accountId + '.dkr.ecr.' + region + '.amazonaws' + registrySuffix;
+const repositoryForStage = (artifactId, targetStage) =>
+  containerReleaseRepositoryName({ artifactId, slice, stage: targetStage });
+const repositoryFor = (artifactId) => repositoryForStage(artifactId, stage);
+const ensureRepository = (repositoryName) => {
+  let response = describeRepository(repositoryName);
+  if (!response) {
+    try {
+      const created = awsJson(
+        [
+          'ecr',
+          'create-repository',
+          '--repository-name',
+          repositoryName,
+          '--image-tag-mutability',
+          'IMMUTABLE',
+          '--encryption-configuration',
+          'encryptionType=AES256',
+          '--image-scanning-configuration',
+          'scanOnPush=true',
+          '--region',
+          region,
+          '--output',
+          'json',
+        ],
+        'ECR repository creation',
+      );
+      response = { repositories: [created.repository] };
+    } catch (error) {
+      if (!String(error).includes('RepositoryAlreadyExistsException')) {
+        throw error;
+      }
+      response = describeRepository(repositoryName);
+      if (!response) {
+        throw new Error('Raced ECR repository creation did not converge.');
+      }
+    }
+  }
+  const repositories = response?.repositories;
+  if (
+    !Array.isArray(repositories) ||
+    repositories.length !== 1 ||
+    repositories[0]?.registryId !== accountId ||
+    repositories[0]?.repositoryName !== repositoryName ||
+    repositories[0]?.imageTagMutability !== 'IMMUTABLE' ||
+    repositories[0]?.imageScanningConfiguration?.scanOnPush !== true ||
+    repositories[0]?.encryptionConfiguration?.encryptionType !== 'AES256'
+  ) {
+    throw new Error('ECR repository does not match the protected immutable contract.');
+  }
+};
+const login = () => {
+  const password = execute(
+    'aws',
+    ['ecr', 'get-login-password', '--region', region],
+    'ECR login token',
+  );
+  const result = spawnSync(
+    'docker',
+    ['login', '--username', 'AWS', '--password-stdin', registry],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      input: password,
+      maxBuffer: 2 * 1024 * 1024,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error('Docker ECR login failed without exposing its credential.');
+  }
+};
+const exactImageByTag = (repositoryName, tag) => {
+  const response = awsJson(
+    [
+      'ecr',
+      'describe-images',
+      '--registry-id',
+      accountId,
+      '--repository-name',
+      repositoryName,
+      '--image-ids',
+      'imageTag=' + tag,
+      '--region',
+      region,
+      '--output',
+      'json',
+    ],
+    'Exact ECR image lookup',
+  );
+  if (
+    !Array.isArray(response?.imageDetails) ||
+    response.imageDetails.length !== 1 ||
+    response.imageDetails[0]?.registryId !== accountId ||
+    response.imageDetails[0]?.repositoryName !== repositoryName ||
+    !IMAGE_DIGEST.test(response.imageDetails[0]?.imageDigest ?? '')
+  ) {
+    throw new Error('Exact ECR image tag is absent or ambiguous.');
+  }
+  return response.imageDetails[0].imageDigest;
+};
+const acquireSyft = async () => {
+  const platformKey = process.platform + '-' + process.arch;
+  const release = SYFT_RELEASES[platformKey];
+  if (!release) {
+    throw new Error('No reviewed Syft release exists for ' + platformKey + '.');
+  }
+  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-syft-'));
+  const supplied = process.env.EBK_SYFT_ARCHIVE_PATH?.trim();
+  const archive = supplied
+    ? safePath(relative(repositoryRoot, resolve(repositoryRoot, supplied)), 'Supplied Syft archive')
+    : join(temporary, 'syft-archive');
+  if (!supplied) {
+    const response = await fetch(release.source, {
+      redirect: 'follow',
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (
+      !response.ok ||
+      Number(response.headers.get('content-length') ?? 0) > MAX_TOOL_BYTES
+    ) {
+      throw new Error('Pinned Syft archive download failed or was oversized.');
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.byteLength === 0 || bytes.byteLength > MAX_TOOL_BYTES) {
+      throw new Error('Pinned Syft archive is empty or oversized.');
+    }
+    writeFileSync(archive, bytes, { mode: 0o600 });
+  }
+  const bytes = readFileSync(archive);
+  if (
+    bytes.byteLength === 0 ||
+    bytes.byteLength > MAX_TOOL_BYTES ||
+    digestBytes(bytes) !== release.sha256
+  ) {
+    throw new Error('Pinned Syft archive integrity does not match policy.');
+  }
+  const path = join(temporary, 'syft');
+  if (release.archiveFormat === 'binary') {
+    writeFileSync(path, bytes, { mode: 0o700 });
+  } else {
+    execute('tar', ['-xzf', archive, '-C', temporary, 'syft'], 'Syft extraction');
+    chmodSync(path, 0o700);
+  }
+  const version = String(execute(path, ['version'], 'Syft version'));
+  if (
+    !new RegExp('(?:Version|version):?\\\\s*' + SYFT_VERSION.replaceAll('.', '\\\\.')).test(
+      version,
+    )
+  ) {
+    throw new Error('Syft runtime version differs from reviewed policy.');
+  }
+  return { path, temporary };
+};
+const acquireCrane = async () => {
+  const platformKey = process.platform + '-' + process.arch;
+  const release = CRANE_RELEASES[platformKey];
+  if (!release) {
+    throw new Error('No reviewed Crane release exists for ' + platformKey + '.');
+  }
+  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-crane-'));
+  const supplied = process.env.EBK_CRANE_ARCHIVE_PATH?.trim();
+  const archive = supplied
+    ? safePath(
+        relative(repositoryRoot, resolve(repositoryRoot, supplied)),
+        'Supplied Crane archive',
+      )
+    : join(temporary, 'crane-archive.tar.gz');
+  if (!supplied) {
+    const response = await fetch(release.source, {
+      redirect: 'follow',
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (
+      !response.ok ||
+      Number(response.headers.get('content-length') ?? 0) > MAX_TOOL_BYTES
+    ) {
+      throw new Error('Pinned Crane archive download failed or was oversized.');
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.byteLength === 0 || bytes.byteLength > MAX_TOOL_BYTES) {
+      throw new Error('Pinned Crane archive is empty or oversized.');
+    }
+    writeFileSync(archive, bytes, { mode: 0o600 });
+  }
+  const bytes = readFileSync(archive);
+  if (
+    bytes.byteLength === 0 ||
+    bytes.byteLength > MAX_TOOL_BYTES ||
+    digestBytes(bytes) !== release.sha256
+  ) {
+    throw new Error('Pinned Crane archive integrity does not match policy.');
+  }
+  execute('tar', ['-xzf', archive, '-C', temporary, 'crane'], 'Crane extraction');
+  const path = join(temporary, 'crane');
+  chmodSync(path, 0o700);
+  const version = String(execute(path, ['version'], 'Crane version')).trim();
+  if (
+    !new RegExp('(?:^|\\s|v)' + CRANE_VERSION.replaceAll('.', '\\.') + '(?:$|\\s)').test(
+      version,
+    )
+  ) {
+    throw new Error('Crane runtime version differs from reviewed policy.');
+  }
+  return { path, temporary };
+};
+const parseCycloneDx = (value, label) => {
+  if (
+    value?.bomFormat !== 'CycloneDX' ||
+    value.specVersion !== '1.6' ||
+    value.version !== 1 ||
+    !/^urn:uuid:[a-fA-F0-9-]{36}$/.test(value.serialNumber ?? '') ||
+    !Array.isArray(value.components) ||
+    value.components.length === 0 ||
+    !Array.isArray(value.dependencies) ||
+    !value.metadata ||
+    typeof value.metadata !== 'object'
+  ) {
+    throw new Error(label + ' is not complete CycloneDX 1.6.');
+  }
+  return value;
+};
+const componentSetFor = (sbom) =>
+  sbom.components
+    .map((component) => ({
+      name: component?.name,
+      purl: component?.purl ?? '',
+      type: component?.type,
+      version: component?.version,
+    }))
+    .sort((left, right) =>
+      JSON.stringify(left) < JSON.stringify(right)
+        ? -1
+        : JSON.stringify(left) > JSON.stringify(right)
+          ? 1
+          : 0,
+    );
+const npmClosureFor = (syftDocument, options = {}) => {
+  if (!Array.isArray(syftDocument?.artifacts)) {
+    throw new Error('Syft npm closure inventory is malformed.');
+  }
+  const packages = syftDocument.artifacts.flatMap((artifact) => {
+    if (artifact?.type !== 'npm') return [];
+    const locations = Array.isArray(artifact.locations)
+      ? artifact.locations.map(({ path }) => {
+          const value = String(path ?? '');
+          return value.startsWith('./')
+            ? value.slice(2)
+            : value.startsWith('/')
+              ? value.slice(1)
+              : value;
+        })
+      : [];
+    if (
+      options.applicationOnly &&
+      !locations.some(
+        (path) =>
+          path === 'app/package.json' ||
+          path.startsWith('app/node_modules/'),
+      )
+    ) {
+      return [];
+    }
+    if (
+      !PACKAGE_NAME.test(artifact.name ?? '') ||
+      typeof artifact.version !== 'string' ||
+      artifact.version.length === 0 ||
+      artifact.version.length > 128
+    ) {
+      throw new Error('Syft npm closure contains an invalid package identity.');
+    }
+    return [{ name: artifact.name, version: artifact.version }];
+  });
+  const unique = [
+    ...new Map(
+      packages.map((entry) => [entry.name + '@' + entry.version, entry]),
+    ).values(),
+  ].sort(
+    (left, right) =>
+      (left.name < right.name ? -1 : left.name > right.name ? 1 : 0) ||
+      (left.version < right.version
+        ? -1
+        : left.version > right.version
+          ? 1
+          : 0),
+  );
+  if (unique.length === 0) {
+    throw new Error('Syft npm closure inventory is empty.');
+  }
+  return unique;
+};
+const deriveExpectedProductionClosure = (syft, input) => {
+  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-closure-'));
+  const deployed = join(temporary, 'deployed');
+  try {
+    execute(
+      'pnpm',
+      [
+        '--filter',
+        input.packageName,
+        'deploy',
+        '--prod',
+        '--offline',
+        '--frozen-lockfile',
+        deployed,
+      ],
+      'Independent production closure deployment',
+      { env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' } },
+    );
+    const raw = String(
+      execute(
+        syft.path,
+        ['scan', 'dir:' + deployed, '--output', 'syft-json'],
+        'Independent production closure inventory',
+        { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+      ),
+    );
+    let inventory;
+    try {
+      inventory = JSON.parse(raw);
+    } catch {
+      throw new Error('Independent production closure inventory is invalid JSON.');
+    }
+    const packages = npmClosureFor(inventory);
+    if (
+      !packages.some(
+        ({ name, version }) =>
+          name === input.packageName &&
+          version === readJson(
+            input.packageManifestPath,
+            'Container package manifest',
+          ).version,
+      )
+    ) {
+      throw new Error('Independent production closure omits the workload package.');
+    }
+    return { digest: supplyChainDigest(packages), packages };
+  } finally {
+    rmSync(temporary, { force: true, recursive: true });
+  }
+};
+const validateRetainedSbom = (entry, label) => {
+  const path = safePath(entry.sbom.path, label, { base: repositoryRoot });
+  const bytes = readFileSync(path);
+  if (digestBytes(bytes) !== entry.sbom.sha256) {
+    throw new Error(label + ' bytes differ from retained evidence.');
+  }
+  let sbom;
+  try {
+    sbom = parseCycloneDx(JSON.parse(bytes.toString('utf8')), label);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new Error(label + ' is invalid JSON.');
+    }
+    throw error;
+  }
+  if (
+    sbom.serialNumber.toLowerCase() !== entry.sbom.serialNumber ||
+    supplyChainDigest(componentSetFor(sbom)) !== entry.sbom.componentSetDigest
+  ) {
+    throw new Error(label + ' component identity differs from retained evidence.');
+  }
+  return sbom;
+};
+const validateRetainedRunProof = (entry, input, label) => {
+  const path = safePath(entry.runProof.path, label, { base: repositoryRoot });
+  const bytes = readFileSync(path);
+  if (digestBytes(bytes) !== entry.runProof.sha256) {
+    throw new Error(label + ' bytes differ from retained evidence.');
+  }
+  const proof = validateContainerNativeRunProof(readJson(path, label));
+  if (
+    proof.materialDigest !== entry.runProof.materialDigest ||
+    proof.accountId !== entry.accountId ||
+    proof.artifactId !== entry.artifactId ||
+    proof.artifactName !== entry.artifactName ||
+    proof.candidateArtifactDigest !== entry.candidateArtifactDigest ||
+    proof.imageDigest !== entry.imageDigest ||
+    proof.platform !== entry.platform ||
+    proof.region !== entry.region ||
+    proof.repositoryName !== entry.repositoryName ||
+    proof.slice !== entry.slice ||
+    proof.sourceCommit !== entry.sourceCommit ||
+    proof.stage !== entry.stage ||
+    proof.nativeLifecycleProof !== input.nativeLifecycleProof ||
+    proof.role !== input.declared.finalArtifact.container.role ||
+    JSON.stringify(proof.entrypoints) !==
+      JSON.stringify(input.proofEntrypoints) ||
+    JSON.stringify(proof.imports) !== JSON.stringify(input.proofImports)
+  ) {
+    throw new Error(label + ' is stale, cross-paired, or incomplete.');
+  }
+  return proof;
+};
+const runNativeLifecycle = async (input, imageReference, platform) => {
+  const architecture = platform.split('/')[1];
+  const structuralProgram =
+    'const {spawnSync}=await import("node:child_process");' +
+    'const imports=' + JSON.stringify(input.proofImports) + ';' +
+    'for(const value of imports)await import(value);' +
+    'const entrypoints=' + JSON.stringify(input.proofEntrypoints) + ';' +
+    'for(const value of entrypoints){const checked=spawnSync(' +
+    'process.execPath,["--check",value],{encoding:"utf8"});' +
+    'if(checked.status!==0)throw new Error("entrypoint check failed");}' +
+    'process.stdout.write(JSON.stringify({architecture:process.arch,entrypoints,imports}));';
+  const structuralRaw = String(
+    execute(
+      'docker',
+      [
+        'run',
+        '--rm',
+        '--platform',
+        platform,
+        '--entrypoint',
+        'node',
+        imageReference,
+        '--input-type=module',
+        '--eval',
+        structuralProgram,
+      ],
+      'Native container structural proof',
+    ),
+  );
+  let structural;
+  try {
+    structural = JSON.parse(structuralRaw);
+  } catch {
+    throw new Error('Native container structural proof returned invalid JSON.');
+  }
+  const structuralArchitecture =
+    structural?.architecture === 'x64'
+      ? 'amd64'
+      : structural?.architecture;
+  if (
+    structuralArchitecture !== architecture ||
+    JSON.stringify(structural.entrypoints) !==
+      JSON.stringify(input.proofEntrypoints) ||
+    JSON.stringify(structural.imports) !== JSON.stringify(input.proofImports)
+  ) {
+    throw new Error('Native container structural proof is incomplete.');
+  }
+
+  if (input.nativeLifecycleProof === 'service-default-health') {
+    const containerId = String(
+      execute(
+        'docker',
+        [
+          'run',
+          '--detach',
+          '--rm',
+          '--platform',
+          platform,
+          '--env',
+          'EBK_STAGE=development',
+          '--publish',
+          '127.0.0.1::3000',
+          imageReference,
+        ],
+        'Native service default lifecycle start',
+      ),
+    ).trim();
+    if (!/^[a-f0-9]{12,64}$/.test(containerId)) {
+      throw new Error('Native service did not return one exact container identity.');
+    }
+    try {
+      let port;
+      let health;
+      for (let attempt = 0; attempt < 40; attempt += 1) {
+        const mapping = spawnSync(
+          'docker',
+          ['port', containerId, '3000/tcp'],
+          {
+            cwd: repositoryRoot,
+            encoding: 'utf8',
+            env: process.env,
+            maxBuffer: 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'pipe'],
+          },
+        );
+        const matched = String(mapping.stdout ?? '').trim().match(/:(\\d+)$/);
+        if (mapping.status === 0 && matched) port = matched[1];
+        if (port) {
+          try {
+            const response = await fetch('http://127.0.0.1:' + port + '/health', {
+              signal: AbortSignal.timeout(1_000),
+            });
+            const body = await response.json();
+            if (response.status === 200 && body?.status === 'ok') {
+              health = { body, status: response.status };
+              break;
+            }
+          } catch {
+            // The real service process is still inside its bounded startup window.
+          }
+        }
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 250));
+      }
+      if (!port || health?.status !== 200) {
+        throw new Error('Native service default lifecycle did not become healthy.');
+      }
+      const missing = await fetch(
+        'http://127.0.0.1:' + port + '/__ebk_missing_health_proof',
+        { signal: AbortSignal.timeout(1_000) },
+      );
+      if (missing.status !== 404) {
+        throw new Error('Native service default lifecycle routed an unknown path.');
+      }
+      return {
+        architecture,
+        entrypoints: input.proofEntrypoints,
+        imports: input.proofImports,
+        nativeLifecycleProof: input.nativeLifecycleProof,
+        role: 'service',
+        status: 'passed',
+      };
+    } finally {
+      execute(
+        'docker',
+        ['stop', '--time', '5', containerId],
+        'Native service proof cleanup',
+      );
+    }
+  }
+
+  const databaseName =
+    ['development', slice, 'retirement_rehearsal']
+      .join('_')
+      .replaceAll('-', '_');
+  const lifecycleArguments = ['run', '--rm', '--platform', platform];
+  let expectedRefusal;
+  if (input.nativeLifecycleProof === 'retirement-explicit-refusal') {
+    const secretPrefix =
+      'arn:aws:secretsmanager:' + region + ':' + accountId +
+      ':secret:ebk/development/' + slice +
+      '/database/retirement_rehearsal/';
+    for (const [name, value] of Object.entries({
+      EBK_CANDIDATE_IDENTITY: input.candidateArtifactDigest,
+      EBK_DATABASE_HOST: 'retirement-proof.invalid',
+      EBK_DATABASE_IDENTIFIER: 'retirement_rehearsal',
+      EBK_DATABASE_LIFECYCLE_CORRELATION_ID: 'native-lifecycle-proof',
+      EBK_DATABASE_MIGRATOR_ROLE: databaseName + '_migrator',
+      EBK_DATABASE_NAME: databaseName,
+      EBK_DATABASE_PORT: '5432',
+      EBK_DATABASE_READONLY_ROLE: databaseName + '_readonly',
+      EBK_DATABASE_READWRITE_ROLE: databaseName + '_readwrite',
+      EBK_EXECUTION_DATABASE_IDENTIFIER: 'retirement_rehearsal',
+      EBK_EXECUTION_SLICE: slice,
+      EBK_EXECUTION_STAGE: 'development',
+      EBK_MASTER_SECRET_ARN: secretPrefix + 'master-proof',
+      EBK_READONLY_SECRET_ARN: secretPrefix + 'readonly-proof',
+      EBK_READWRITE_SECRET_ARN: secretPrefix + 'readwrite-proof',
+      EBK_REGISTRATION_DIGEST: input.candidateArtifactDigest,
+      EBK_SLICE: slice,
+      EBK_STAGE: 'development',
+    })) {
+      lifecycleArguments.push('--env', name + '=' + value);
+    }
+    lifecycleArguments.push(
+      '--entrypoint',
+      'node',
+      imageReference,
+      'jobs/retire-database.mjs',
+    );
+    expectedRefusal = 'EBK_RETIREMENT_ID is required.';
+  } else if (input.nativeLifecycleProof === 'migration-explicit-refusal') {
+    lifecycleArguments.push(
+      '--entrypoint',
+      'node',
+      imageReference,
+      'jobs/migrate-database.mjs',
+    );
+    expectedRefusal = 'EBK_MIGRATION_ID is required.';
+  } else {
+    lifecycleArguments.push(imageReference);
+    if (input.nativeLifecycleProof === 'retention-default-refusal') {
+      expectedRefusal = 'EBK_RETENTION_MODE is required.';
+    }
+  }
+  const lifecycle = spawnSync(
+    'docker',
+    lifecycleArguments,
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: MAX_OUTPUT_BYTES,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 30_000,
+    },
+  );
+  if (lifecycle.error || lifecycle.signal || lifecycle.status === null) {
+    throw new Error(
+      'Native container lifecycle proof did not complete normally.',
+    );
+  }
+  const lifecycleOutput =
+    String(lifecycle.stderr ?? '') + String(lifecycle.stdout ?? '');
+  if (expectedRefusal) {
+    if (lifecycle.status === 0 || !lifecycleOutput.includes(expectedRefusal)) {
+      throw new Error(
+        'Protected lifecycle command failed outside its exact missing-authority guard.',
+      );
+    }
+  } else if (
+    input.nativeLifecycleProof !== 'job-default-success' ||
+    lifecycle.status !== 0
+  ) {
+    throw new Error(
+      'Native Job default command did not complete successfully.',
+    );
+  }
+  return {
+    architecture,
+    entrypoints: input.proofEntrypoints,
+    imports: input.proofImports,
+    nativeLifecycleProof: input.nativeLifecycleProof,
+    role: input.declared.finalArtifact.container.role,
+    status: 'passed',
+  };
+};
+
+let developmentSourceArtifact;
+if (stage === 'development') {
+  const expectedSourceAccountId =
+    process.env.EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  const expectedSourceRegion =
+    process.env.EBK_STAGING_PROMOTION_REGION?.trim() ?? '';
+  if (
+    !/^\\d{12}$/.test(expectedSourceAccountId) ||
+    !AWS_REGION_NAME.test(expectedSourceRegion) ||
+    expectedSourceAccountId === accountId
+  ) {
+    throw new Error(
+      'Development retirement promotion requires one independent staging account and Region.',
+    );
+  }
+  const sourceBindingPath = safePath(
+    process.env.EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH?.trim() ?? '',
+    'Development retirement source binding',
+  );
+  const sourceSidecarPath = safePath(
+    process.env.EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH?.trim() ?? '',
+    'Development retirement release-bound container sidecar',
+  );
+  const sourceBinding = validateContainerReleaseBinding(
+    readJson(sourceBindingPath, 'Development retirement source binding'),
+  );
+  const sourceSidecar = validateContainerReleaseBinding(
+    readJson(
+      sourceSidecarPath,
+      'Development retirement release-bound container sidecar',
+    ),
+  );
+  const sourceCandidateDigests = Object.fromEntries(
+    releaseContainerInputs.map(({ candidateArtifactDigest, declared }) => [
+      declared.id,
+      candidateArtifactDigest,
+    ]),
+  );
+  if (
+    sourceBindingPath === sourceSidecarPath ||
+    JSON.stringify(sourceBinding) !== JSON.stringify(sourceSidecar) ||
+    sourceBinding.stage !== 'staging' ||
+    sourceBinding.accountId !== expectedSourceAccountId ||
+    sourceBinding.region !== expectedSourceRegion ||
+    sourceBinding.slice !== slice ||
+    sourceBinding.sourceCommit !== sourceCommit ||
+    sourceBinding.artifacts.length !== releaseContainerInputs.length ||
+    sourceBinding.artifacts.some(
+      ({ artifactId, candidateArtifactDigest }) =>
+        sourceCandidateDigests[artifactId] !== candidateArtifactDigest,
+    )
+  ) {
+    throw new Error(
+      'Development retirement source is not the exact sealed staging binding.',
+    );
+  }
+  const retirementInput = containerInputs[0];
+  developmentSourceArtifact = resolveContainerReleaseArtifact(sourceBinding, {
+    artifactId: retirementInput.declared.id,
+    candidateArtifactDigest: retirementInput.candidateArtifactDigest,
+  });
+  const dockerfileDigest = digestBytes(readFileSync(retirementInput.dockerfile));
+  const sourceRepositoryName = repositoryForStage(
+    retirementInput.declared.id,
+    'staging',
+  );
+  if (
+    developmentSourceArtifact.artifactName !== retirementInput.declared.name ||
+    developmentSourceArtifact.dockerfileDigest !== dockerfileDigest ||
+    developmentSourceArtifact.repositoryName !== sourceRepositoryName ||
+    developmentSourceArtifact.platforms.some(
+      (platform) =>
+        platform.accountId !== expectedSourceAccountId ||
+        platform.region !== expectedSourceRegion ||
+        platform.slice !== slice ||
+        platform.sourceCommit !== sourceCommit ||
+        platform.stage !== 'staging' ||
+        platform.dockerfileDigest !== dockerfileDigest ||
+        platform.repositoryName !== sourceRepositoryName,
+    )
+  ) {
+    throw new Error(
+      'Development retirement source artifact is stale or cross-paired.',
+    );
+  }
+  for (const platform of developmentSourceArtifact.platforms) {
+    validateRetainedSbom(
+      platform,
+      'Development retirement source platform SBOM',
+    );
+    validateRetainedRunProof(
+      platform,
+      retirementInput,
+      'Development retirement source native run proof',
+    );
+  }
+}
+
+if (mode === 'promote') {
+  if (stage !== 'production') {
+    throw new Error('Exact OCI promotion targets production only.');
+  }
+  const expectedSourceAccountId =
+    process.env.EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  const expectedSourceRegion =
+    process.env.EBK_STAGING_PROMOTION_REGION?.trim() ?? '';
+  if (
+    !/^\\d{12}$/.test(expectedSourceAccountId) ||
+    !AWS_REGION_NAME.test(expectedSourceRegion) ||
+    expectedSourceAccountId === accountId
+  ) {
+    throw new Error(
+      'OCI promotion requires one bounded independent staging account and Region.',
+    );
+  }
+  const sourceBindingInput =
+    process.env.EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH?.trim() ?? '';
+  const sourceBindingPath = safePath(
+    sourceBindingInput,
+    'Promotion source binding',
+  );
+  const sourceBinding = validateContainerReleaseBinding(
+    readJson(sourceBindingPath, 'Promotion source binding'),
+  );
+  const sourceSidecarPath = safePath(
+    process.env.EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH?.trim() ?? '',
+    'Promotion release-bound container sidecar',
+  );
+  const sourceSidecar = validateContainerReleaseBinding(
+    readJson(sourceSidecarPath, 'Promotion release-bound container sidecar'),
+  );
+  if (
+    sourceSidecarPath === sourceBindingPath ||
+    JSON.stringify(sourceSidecar) !== JSON.stringify(sourceBinding)
+  ) {
+    throw new Error(
+      'Promotion source binding differs from the verified staging release sidecar.',
+    );
+  }
+  const candidateDigests = Object.fromEntries(
+    containerInputs.map(({ candidateArtifactDigest, declared }) => [
+      declared.id,
+      candidateArtifactDigest,
+    ]),
+  );
+  if (
+    sourceBinding.stage !== 'staging' ||
+    sourceBinding.accountId !== expectedSourceAccountId ||
+    sourceBinding.region !== expectedSourceRegion ||
+    sourceBinding.slice !== slice ||
+    sourceBinding.sourceCommit !== sourceCommit ||
+    sourceBinding.artifacts.length !== containerInputs.length ||
+    sourceBinding.artifacts.some(
+      ({ artifactId, candidateArtifactDigest }) =>
+        candidateDigests[artifactId] !== candidateArtifactDigest,
+    )
+  ) {
+    throw new Error('Promotion source is not the exact reviewed staging binding.');
+  }
+  const preparedSources = containerInputs.map((input) => {
+    const sourceArtifact = resolveContainerReleaseArtifact(sourceBinding, {
+      artifactId: input.declared.id,
+      candidateArtifactDigest: input.candidateArtifactDigest,
+    });
+    const dockerfileDigest = digestBytes(readFileSync(input.dockerfile));
+    const sourceRepositoryName = repositoryForStage(
+      input.declared.id,
+      'staging',
+    );
+    if (
+      sourceArtifact.artifactName !== input.declared.name ||
+      sourceArtifact.dockerfileDigest !== dockerfileDigest ||
+      sourceArtifact.repositoryName !== sourceRepositoryName ||
+      sourceArtifact.platforms.some(
+        (platform) =>
+          platform.accountId !== expectedSourceAccountId ||
+          platform.region !== expectedSourceRegion ||
+          platform.slice !== slice ||
+          platform.sourceCommit !== sourceCommit ||
+          platform.stage !== 'staging' ||
+          platform.dockerfileDigest !== dockerfileDigest ||
+          platform.repositoryName !== sourceRepositoryName,
+      )
+    ) {
+      throw new Error(
+        'Promotion source artifact is stale or belongs to another build authority.',
+      );
+    }
+    for (const platform of sourceArtifact.platforms) {
+      validateRetainedSbom(platform, 'Promotion source platform SBOM');
+      validateRetainedRunProof(
+        platform,
+        input,
+        'Promotion source native run proof',
+      );
+    }
+    return { input, sourceArtifact };
+  });
+  const crane = await acquireCrane();
+  try {
+    login();
+  const artifacts = [];
+  for (const { input, sourceArtifact } of preparedSources) {
+    const repositoryName = repositoryFor(input.declared.id);
+    ensureRepository(repositoryName);
+    const tag =
+      'promotion-' + sourceCommit + '-' + runId + '-' + runAttempt + '-index';
+    const taggedReference = registry + '/' + repositoryName + ':' + tag;
+    execute(
+      crane.path,
+      [
+        'copy',
+        sourceArtifact.imageReference,
+        taggedReference,
+      ],
+      'Recursive exact staging OCI index promotion',
+    );
+    const imageDigest = exactImageByTag(repositoryName, tag);
+    if (imageDigest !== sourceArtifact.imageDigest) {
+      throw new Error('Production OCI index digest differs from reviewed staging.');
+    }
+    const imageReference = registry + '/' + repositoryName + '@' + imageDigest;
+    const rawIndex = String(
+      execute(
+        'docker',
+        ['buildx', 'imagetools', 'inspect', '--raw', imageReference],
+        'Promoted OCI index inspection',
+      ),
+    );
+    let index;
+    try {
+      index = JSON.parse(rawIndex);
+    } catch {
+      throw new Error('Promoted OCI index inspection returned invalid JSON.');
+    }
+    const rawDescriptors = Array.isArray(index?.manifests)
+      ? index.manifests
+      : [];
+    const descriptors = rawDescriptors
+      .map((descriptor) => ({
+        digest: descriptor?.digest,
+        platform:
+          String(descriptor?.platform?.os) + '/' +
+          String(descriptor?.platform?.architecture),
+      }))
+      .sort((left, right) =>
+        left.platform < right.platform
+          ? -1
+          : left.platform > right.platform
+            ? 1
+            : 0,
+      );
+    const sourcePlatforms = [...sourceArtifact.platforms].sort((left, right) =>
+      left.platform < right.platform
+        ? -1
+        : left.platform > right.platform
+          ? 1
+          : 0,
+    );
+    if (
+      ![
+        'application/vnd.oci.image.index.v1+json',
+        'application/vnd.docker.distribution.manifest.list.v2+json',
+      ].includes(index?.mediaType) ||
+      rawDescriptors.length !== CONTAINER_RELEASE_PLATFORMS.length ||
+      descriptors.some(
+        ({ digest, platform }) =>
+          !IMAGE_DIGEST.test(digest) ||
+          !CONTAINER_RELEASE_PLATFORMS.includes(platform),
+      ) ||
+      descriptors.some(
+        (descriptor, index) =>
+          descriptor.platform !== sourcePlatforms[index]?.platform ||
+          descriptor.digest !== sourcePlatforms[index]?.imageDigest,
+      )
+    ) {
+      throw new Error('Production OCI child manifests differ from staging.');
+    }
+    for (const descriptor of descriptors) {
+      const response = awsJson(
+        [
+          'ecr',
+          'batch-get-image',
+          '--repository-name',
+          repositoryName,
+          '--image-ids',
+          'imageDigest=' + descriptor.digest,
+          '--accepted-media-types',
+          'application/vnd.oci.image.manifest.v1+json',
+          'application/vnd.docker.distribution.manifest.v2+json',
+          '--region',
+          region,
+          '--output',
+          'json',
+        ],
+        'Promoted OCI child manifest lookup',
+      );
+      const image = response?.images?.[0];
+      if (
+        !Array.isArray(response?.images) ||
+        response.images.length !== 1 ||
+        !Array.isArray(response?.failures) ||
+        response.failures.length !== 0 ||
+        image?.imageId?.imageDigest !== descriptor.digest ||
+        typeof image?.imageManifest !== 'string' ||
+        image.imageManifest.length === 0 ||
+        Buffer.byteLength(image.imageManifest, 'utf8') > MAX_OUTPUT_BYTES ||
+        ![
+          'application/vnd.oci.image.manifest.v1+json',
+          'application/vnd.docker.distribution.manifest.v2+json',
+        ].includes(image.imageManifestMediaType)
+      ) {
+        throw new Error(
+          'Promoted OCI child manifest is absent from the target repository.',
+        );
+      }
+    }
+    const platforms = sourcePlatforms.map((platform) =>
+      createContainerPlatformEvidence({
+        accountId,
+        artifactId: platform.artifactId,
+        artifactName: platform.artifactName,
+        candidateArtifactDigest: platform.candidateArtifactDigest,
+        dockerfileDigest: platform.dockerfileDigest,
+        imageDigest: platform.imageDigest,
+        imageReference:
+          registry + '/' + repositoryName + '@' + platform.imageDigest,
+        platform: platform.platform,
+        productionClosureDigest: platform.productionClosureDigest,
+        region,
+        repositoryName,
+        runProof: platform.runProof,
+        sbom: platform.sbom,
+        slice,
+        sourceCommit,
+        stage: 'production',
+      }),
+    );
+    artifacts.push({
+      ...sourceArtifact,
+      imageReference,
+      platforms,
+      repositoryName,
+      sbomParityDigest: supplyChainDigest(
+        platforms.map((entry) => ({
+          componentSetDigest: entry.sbom.componentSetDigest,
+          platform: entry.platform,
+          productionClosureDigest: entry.productionClosureDigest,
+          runProof: entry.runProof,
+        })),
+      ),
+    });
+  }
+  const binding = createContainerReleaseBinding({
+    accountId,
+    artifacts,
+    builtAt: new Date().toISOString(),
+    provenance: { runAttempt, runId, workflow },
+    region,
+    slice,
+    sourceCommit,
+    stage: 'production',
+  });
+  const output = resolve(
+    repositoryRoot,
+    '.ebk/evidence/container-release/production/packages',
+    slice,
+    'binding.json',
+  );
+  immutableWrite(output, binding);
+  process.stdout.write(
+    JSON.stringify({
+      artifactCount: artifacts.length,
+      bindingDigest: binding.materialDigest,
+      evidencePath: output,
+      promotedFrom: sourceBinding.materialDigest,
+      schemaVersion: 1,
+      stage,
+    }) + '\\n',
+  );
+  } finally {
+    rmSync(crane.temporary, { force: true, recursive: true });
+  }
+  process.exit(0);
+}
+
+if (mode === 'platform') {
+  const nativeArchitecture = process.arch === 'x64' ? 'amd64' : process.arch;
+  if (
+    process.platform !== 'linux' ||
+    requestedPlatform !== 'linux/' + nativeArchitecture
+  ) {
+    throw new Error(
+      'Platform evidence must run on the matching native Linux architecture.',
+    );
+  }
+  const syft = await acquireSyft();
+  const crane = stage === 'development' ? await acquireCrane() : undefined;
+  try {
+    const expectedClosures = new Map(
+      containerInputs.map((input) => [
+        input.declared.id,
+        deriveExpectedProductionClosure(syft, input),
+      ]),
+    );
+    requireReviewedCheckout();
+    for (const input of containerInputs) requireCandidateAuthority(input);
+    login();
+    const architecture = requestedPlatform.split('/')[1];
+    const outputRoot = resolve(
+      repositoryRoot,
+      '.ebk/evidence/container-release/partials',
+      stage,
+      slice,
+      architecture,
+    );
+    for (const input of containerInputs) {
+      const expectedClosure = expectedClosures.get(input.declared.id);
+      if (!expectedClosure) {
+        throw new Error('Independent production closure is absent.');
+      }
+      const repositoryName = repositoryFor(input.declared.id);
+      ensureRepository(repositoryName);
+      const tag =
+        'candidate-' + sourceCommit + '-' + runId + '-' + runAttempt + '-' +
+        architecture;
+      const taggedReference = registry + '/' + repositoryName + ':' + tag;
+      requireReviewedCheckout();
+      requireCandidateAuthority(input);
+      const developmentSourcePlatform =
+        stage === 'development'
+          ? developmentSourceArtifact?.platforms.find(
+              ({ platform }) => platform === requestedPlatform,
+            )
+          : undefined;
+      if (stage === 'development') {
+        if (!crane || !developmentSourcePlatform) {
+          throw new Error(
+            'Development retirement source platform is absent.',
+          );
+        }
+        execute(
+          crane.path,
+          ['copy', developmentSourcePlatform.imageReference, taggedReference],
+          'Exact staging retirement child promotion',
+        );
+      } else {
+        execute(
+          'docker',
+          [
+            'buildx',
+            'build',
+            '--file',
+            relative(repositoryRoot, input.dockerfile),
+            '--label',
+            'org.opencontainers.image.revision=' + sourceCommit,
+            '--label',
+            'dev.empire-builder-kit.candidate-digest=' +
+              input.candidateArtifactDigest,
+            '--platform',
+            requestedPlatform,
+            '--provenance=false',
+            '--push',
+            '--sbom=false',
+            '--tag',
+            taggedReference,
+            relative(repositoryRoot, input.context) || '.',
+          ],
+          'Native container build and push',
+        );
+      }
+      const imageDigest = exactImageByTag(repositoryName, tag);
+      const imageReference = registry + '/' + repositoryName + '@' + imageDigest;
+      if (
+        stage === 'development' &&
+        developmentSourcePlatform?.imageDigest !== imageDigest
+      ) {
+        throw new Error(
+          'Development retirement child promotion differs from exact staging.',
+        );
+      }
+      const runtimeManifestRaw = String(
+        execute(
+          'docker',
+          ['buildx', 'imagetools', 'inspect', '--raw', imageReference],
+          'Native runtime manifest inspection',
+        ),
+      );
+      let runtimeManifest;
+      try {
+        runtimeManifest = JSON.parse(runtimeManifestRaw);
+      } catch {
+        throw new Error('Native runtime manifest inspection returned invalid JSON.');
+      }
+      if (
+        ![
+          'application/vnd.oci.image.manifest.v1+json',
+          'application/vnd.docker.distribution.manifest.v2+json',
+        ].includes(runtimeManifest?.mediaType) ||
+        Array.isArray(runtimeManifest?.manifests)
+      ) {
+        throw new Error(
+          'Native build must publish one plain runtime manifest; the integrity-bound Syft SBOM is retained separately.',
+        );
+      }
+      const runProof = await runNativeLifecycle(
+        input,
+        imageReference,
+        requestedPlatform,
+      );
+      if (
+        runProof.architecture !== architecture ||
+        runProof.status !== 'passed' ||
+        runProof.nativeLifecycleProof !== input.nativeLifecycleProof ||
+        JSON.stringify(runProof.entrypoints) !==
+          JSON.stringify(input.proofEntrypoints) ||
+        JSON.stringify(runProof.imports) !== JSON.stringify(input.proofImports) ||
+        runProof.role !== input.declared.finalArtifact.container.role
+      ) {
+        throw new Error('Native production container run proof is incomplete.');
+      }
+      const safeArtifact = input.declared.name.replace(/[^A-Za-z0-9._-]/g, '_');
+      const nativeRunProof = createContainerNativeRunProof({
+        accountId,
+        artifactId: input.declared.id,
+        artifactName: input.declared.name,
+        candidateArtifactDigest: input.candidateArtifactDigest,
+        entrypoints: runProof.entrypoints,
+        imageDigest,
+        imports: runProof.imports,
+        nativeLifecycleProof: runProof.nativeLifecycleProof,
+        platform: requestedPlatform,
+        region,
+        repositoryName,
+        role: runProof.role,
+        slice,
+        sourceCommit,
+        stage,
+        status: runProof.status,
+      });
+      const serializedRunProof = JSON.stringify(nativeRunProof, null, 2) + '\\n';
+      const relativeRunProofPath =
+        '.ebk/evidence/container-release/partials/' + stage + '/' +
+        slice + '/' + architecture + '/' + safeArtifact + '.run-proof.json';
+      immutableWrite(
+        resolve(repositoryRoot, relativeRunProofPath),
+        serializedRunProof,
+      );
+      const closureRaw = String(
+        execute(
+          syft.path,
+          ['scan', 'registry:' + imageReference, '--output', 'syft-json'],
+          'Exact application npm closure inventory',
+          { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+        ),
+      );
+      let closureInventory;
+      try {
+        closureInventory = JSON.parse(closureRaw);
+      } catch {
+        throw new Error('Exact application npm closure inventory is invalid JSON.');
+      }
+      const observedClosure = npmClosureFor(closureInventory, {
+        applicationOnly: true,
+      });
+      if (
+        JSON.stringify(observedClosure) !==
+        JSON.stringify(expectedClosure.packages)
+      ) {
+        throw new Error(
+          'Container application npm closure differs from the independently deployed production closure.',
+        );
+      }
+      const rawSbom = String(
+        execute(
+          syft.path,
+          ['scan', 'registry:' + imageReference, '--output', 'cyclonedx-json'],
+          'Exact platform OCI SBOM',
+          { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+        ),
+      );
+      let sbom;
+      try {
+        sbom = parseCycloneDx(
+          JSON.parse(rawSbom),
+          'Syft platform SBOM',
+        );
+      } catch {
+        throw new Error('Syft returned invalid platform CycloneDX JSON.');
+      }
+      const componentSet = componentSetFor(sbom);
+      if (
+        componentSet.some(
+          (component) =>
+            typeof component.name !== 'string' ||
+            typeof component.type !== 'string' ||
+            typeof component.version !== 'string',
+        )
+      ) {
+        throw new Error('Platform SBOM contains invalid or development components.');
+      }
+      const serializedSbom = JSON.stringify(sbom, null, 2) + '\\n';
+      const relativeSbomPath =
+        '.ebk/evidence/container-release/partials/' + stage + '/' +
+        slice + '/' + architecture + '/' + safeArtifact + '.cdx.json';
+      immutableWrite(resolve(repositoryRoot, relativeSbomPath), serializedSbom);
+      const evidence = createContainerPlatformEvidence({
+        accountId,
+        artifactId: input.declared.id,
+        artifactName: input.declared.name,
+        candidateArtifactDigest: input.candidateArtifactDigest,
+        dockerfileDigest: digestBytes(readFileSync(input.dockerfile)),
+        imageDigest,
+        imageReference,
+        platform: requestedPlatform,
+        productionClosureDigest: expectedClosure.digest,
+        region,
+        repositoryName,
+        runProof: {
+          materialDigest: nativeRunProof.materialDigest,
+          path: relativeRunProofPath,
+          sha256: digestBytes(Buffer.from(serializedRunProof, 'utf8')),
+        },
+        sbom: {
+          componentSetDigest: supplyChainDigest(componentSet),
+          path: relativeSbomPath,
+          serialNumber: sbom.serialNumber.toLowerCase(),
+          sha256: digestBytes(Buffer.from(serializedSbom, 'utf8')),
+        },
+        slice,
+        sourceCommit,
+        stage,
+      });
+      immutableWrite(
+        join(outputRoot, safeArtifact + '.platform.json'),
+        evidence,
+      );
+    }
+    process.stdout.write(
+      JSON.stringify({
+        artifactCount: containerInputs.length,
+        platform: requestedPlatform,
+        schemaVersion: 1,
+        stage,
+      }) + '\\n',
+    );
+  } finally {
+    rmSync(syft.temporary, { force: true, recursive: true });
+    if (crane) {
+      rmSync(crane.temporary, { force: true, recursive: true });
+    }
+  }
+  process.exit(0);
+}
+
+const partialRoot = resolve(
+  repositoryRoot,
+  '.ebk/evidence/container-release/partials',
+  stage,
+  slice,
+);
+if (!existsSync(partialRoot) || !lstatSync(partialRoot).isDirectory()) {
+  throw new Error('Container platform evidence directory is absent.');
+}
+const partialPaths = [];
+const visit = (directory) => {
+  for (const entry of readdirSync(directory).sort()) {
+    const path = join(directory, entry);
+    const metadata = lstatSync(path);
+    if (metadata.isSymbolicLink()) {
+      throw new Error('Container platform evidence may not contain symlinks.');
+    }
+    if (metadata.isDirectory()) visit(path);
+    else if (metadata.isFile() && entry.endsWith('.platform.json')) {
+      partialPaths.push(path);
+    }
+  }
+};
+visit(partialRoot);
+if (
+  partialPaths.length !==
+  containerInputs.length * CONTAINER_RELEASE_PLATFORMS.length
+) {
+  throw new Error('Container platform evidence is incomplete or excessive.');
+}
+const partials = partialPaths.map((path) =>
+  validateContainerPlatformEvidence(readJson(path, 'Container platform evidence')),
+);
+const preparedArtifacts = containerInputs.map((input) => {
+  const evidence = partials
+    .filter(({ artifactId }) => artifactId === input.declared.id)
+    .sort((left, right) =>
+      left.platform < right.platform
+        ? -1
+        : left.platform > right.platform
+          ? 1
+          : 0,
+    );
+  const repositoryName = repositoryFor(input.declared.id);
+  const dockerfileDigest = digestBytes(readFileSync(input.dockerfile));
+  const expectedPlatforms = [...CONTAINER_RELEASE_PLATFORMS].sort();
+  if (
+    evidence.length !== CONTAINER_RELEASE_PLATFORMS.length ||
+    evidence.some(
+      (entry, index) =>
+        entry.accountId !== accountId ||
+        entry.region !== region ||
+        entry.slice !== slice ||
+        entry.sourceCommit !== sourceCommit ||
+        entry.stage !== stage ||
+        entry.artifactId !== input.declared.id ||
+        entry.artifactName !== input.declared.name ||
+        entry.candidateArtifactDigest !== input.candidateArtifactDigest ||
+        entry.dockerfileDigest !== dockerfileDigest ||
+        entry.repositoryName !== repositoryName ||
+        entry.platform !== expectedPlatforms[index] ||
+        entry.productionClosureDigest !== evidence[0]?.productionClosureDigest,
+    )
+  ) {
+    throw new Error(
+      'Container platform evidence is stale, cross-paired, or incomplete.',
+    );
+  }
+  for (const entry of evidence) {
+    validateRetainedSbom(entry, 'Container platform SBOM');
+    validateRetainedRunProof(entry, input, 'Container native run proof');
+  }
+  return { dockerfileDigest, evidence, input, repositoryName };
+});
+const assemblyCrane = stage === 'development' ? await acquireCrane() : undefined;
+try {
+login();
+const artifacts = [];
+for (const prepared of preparedArtifacts) {
+  const { dockerfileDigest, evidence, input, repositoryName } = prepared;
+  ensureRepository(repositoryName);
+  const tag =
+    'candidate-' + sourceCommit + '-' + runId + '-' + runAttempt + '-index';
+  const taggedReference = registry + '/' + repositoryName + ':' + tag;
+  if (assemblyCrane) {
+    if (!developmentSourceArtifact) {
+      throw new Error('Development retirement source index is absent.');
+    }
+    execute(
+      assemblyCrane.path,
+      ['copy', developmentSourceArtifact.imageReference, taggedReference],
+      'Exact staging retirement OCI index promotion',
+    );
+  } else {
+    execute(
+      'docker',
+      [
+        'buildx',
+        'imagetools',
+        'create',
+        '--tag',
+        taggedReference,
+        ...evidence.map(({ imageReference }) => imageReference),
+      ],
+      'Dual-architecture OCI index assembly',
+    );
+  }
+  const imageDigest = exactImageByTag(repositoryName, tag);
+  const imageReference = registry + '/' + repositoryName + '@' + imageDigest;
+  if (
+    stage === 'development' &&
+    developmentSourceArtifact?.imageDigest !== imageDigest
+  ) {
+    throw new Error(
+      'Development retirement OCI index differs from exact staging.',
+    );
+  }
+  const rawIndex = String(
+    execute(
+      'docker',
+      ['buildx', 'imagetools', 'inspect', '--raw', imageReference],
+      'Dual-architecture OCI index inspection',
+    ),
+  );
+  let index;
+  try {
+    index = JSON.parse(rawIndex);
+  } catch {
+    throw new Error('OCI index inspection returned invalid JSON.');
+  }
+  const rawDescriptors = Array.isArray(index?.manifests)
+    ? index.manifests
+    : [];
+  const descriptors = rawDescriptors
+    .map((descriptor) => ({
+      digest: descriptor?.digest,
+      platform:
+        String(descriptor?.platform?.os) + '/' +
+        String(descriptor?.platform?.architecture),
+    }))
+    .sort((left, right) =>
+      left.platform < right.platform
+        ? -1
+        : left.platform > right.platform
+          ? 1
+          : 0,
+    );
+  if (
+    ![
+      'application/vnd.oci.image.index.v1+json',
+      'application/vnd.docker.distribution.manifest.list.v2+json',
+    ].includes(index?.mediaType) ||
+    rawDescriptors.length !== CONTAINER_RELEASE_PLATFORMS.length ||
+    descriptors.some(
+      ({ digest, platform }) =>
+        !IMAGE_DIGEST.test(digest) ||
+        !CONTAINER_RELEASE_PLATFORMS.includes(platform),
+    ) ||
+    descriptors.some(
+      (descriptor, index) =>
+        descriptor.platform !== evidence[index]?.platform ||
+        descriptor.digest !== evidence[index]?.imageDigest,
+    )
+  ) {
+    throw new Error('OCI index does not contain exactly the two proven platform images.');
+  }
+  artifacts.push({
+    artifactId: input.declared.id,
+    artifactName: input.declared.name,
+    candidateArtifactDigest: input.candidateArtifactDigest,
+    dockerfileDigest,
+    imageDigest,
+    imageReference,
+    platforms: evidence,
+    repositoryName,
+    sbomParityDigest: supplyChainDigest(
+      evidence.map((entry) => ({
+        componentSetDigest: entry.sbom.componentSetDigest,
+        platform: entry.platform,
+        productionClosureDigest: entry.productionClosureDigest,
+        runProof: entry.runProof,
+      })),
+    ),
+  });
+}
+const builtAtInput = process.env.EBK_CONTAINER_BUILT_AT?.trim();
+const builtAt = builtAtInput ?? new Date().toISOString();
+if (!Number.isFinite(Date.parse(builtAt)) || new Date(builtAt).toISOString() !== builtAt) {
+  throw new Error('EBK_CONTAINER_BUILT_AT must be canonical ISO-8601 when set.');
+}
+const binding = createContainerReleaseBinding({
+  accountId,
+  artifacts,
+  builtAt,
+  provenance: { runAttempt, runId, workflow },
+  region,
+  slice,
+  sourceCommit,
+  stage,
+});
+const output = resolve(
+  repositoryRoot,
+  '.ebk/evidence/container-release',
+  stage,
+  'packages',
+  slice,
+  'binding.json',
+);
+immutableWrite(output, binding);
+process.stdout.write(
+  JSON.stringify({
+    artifactCount: artifacts.length,
+    bindingDigest: binding.materialDigest,
+    evidencePath: output,
+    schemaVersion: 1,
+    stage,
+  }) + '\\n',
+);
+} finally {
+  if (assemblyCrane) {
+    rmSync(assemblyCrane.temporary, { force: true, recursive: true });
+  }
+}
+`;
+}
+//# sourceMappingURL=generated-container-release-command.js.map