@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/generated-ecr-collector-command.js

@@ -0,0 +1,1338 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYFT_COLLECTOR_RELEASES = exports.SYFT_VERSION = void 0;
+exports.renderEcrInspectorCollectorCommand = renderEcrInspectorCollectorCommand;
+const common_js_1 = require("./common.js");
+const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
+exports.SYFT_VERSION = '1.50.0';
+exports.SYFT_COLLECTOR_RELEASES = Object.freeze({
+    'linux-arm64': {
+        archiveFormat: 'tar-gzip',
+        sha256: '887c57cbcc2d0e8c5c110a4571a3fc7150058b24d74f993ee4663516e5c8ce86',
+        source: 'https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_linux_arm64.tar.gz',
+    },
+    'linux-x64': {
+        archiveFormat: 'tar-gzip',
+        sha256: 'bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788',
+        source: 'https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_linux_amd64.tar.gz',
+    },
+});
+function validatedReleases(releases) {
+    if (Object.keys(releases).length === 0 ||
+        Object.entries(releases).some(([platform, release]) => !/^[a-z0-9]+-(?:arm64|x64)$/.test(platform) ||
+            !['binary', 'tar-gzip'].includes(release.archiveFormat) ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(release.sha256) ||
+            !/^https:\/\/github\.com\/anchore\/syft\/releases\/download\/v\d+\.\d+\.\d+\/[A-Za-z0-9._-]+$/.test(release.source))) {
+        throw new Error('Syft collector releases must be exact official integrity-bound assets.');
+    }
+    return releases;
+}
+/**
+ * Render the protected postdeploy collector.
+ *
+ * The current generated SST context-build path is intentionally not accepted:
+ * collection begins only when the release registry declares exact
+ * digest-qualified OCI consumption, and the deployed ECS task definition
+ * itself carries the exact release binding.
+ */
+function renderEcrInspectorCollectorCommand(options = {}) {
+    const moduleSpecifier = options.moduleSpecifier ?? '@empire-builder-kit/nx/supply-chain';
+    const releaseModuleSpecifier = options.releaseModuleSpecifier ?? '@empire-builder-kit/nx/release';
+    const releases = validatedReleases(options.releases ?? exports.SYFT_COLLECTOR_RELEASES);
+    const syftVersion = options.syftVersion ?? exports.SYFT_VERSION;
+    if (!/^(?:@empire-builder-kit\/nx\/supply-chain|file:\/\/\/[^'"\n]+)$/.test(moduleSpecifier) ||
+        !/^(?:@empire-builder-kit\/nx\/release|file:\/\/\/[^'"\n]+)$/.test(releaseModuleSpecifier) ||
+        !/^\d+\.\d+\.\d+$/.test(syftVersion)) {
+        throw new Error('The generated ECR collector configuration is invalid.');
+    }
+    return `import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { tmpdir } from 'node:os';
+import {
+  assessEcrScanApplicability,
+  collectEcrInspectorScanEvidence,
+  collectEcsDeployedImageBinding,
+  createCycloneDxPlatformSbomUnion,
+  resolveContainerReleaseArtifact,
+  validateContainerReleaseBinding,
+  verifyEcrInspectorScanEvidence,
+  verifyEcsDeployedImageBinding,
+} from '${moduleSpecifier}';
+import { validateReleaseManifest } from '${releaseModuleSpecifier}';
+
+const SYFT_VERSION = ${JSON.stringify(syftVersion)};
+const SYFT_RELEASES = Object.freeze(${JSON.stringify(releases)});
+const SHA256 = /^[a-f0-9]{64}$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const REFERENCE = new RegExp(${JSON.stringify((0, safe_reference_1.safeReferencePatternSource)('supply-chain'))});
+const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const MAX_TOOL_BYTES = 100 * 1024 * 1024;
+const MAX_INPUT_BYTES = 5 * 1024 * 1024;
+const MAX_AWS_RESPONSE_BYTES = 8 * 1024 * 1024;
+const MAX_TOTAL_PAGE_BYTES = 64 * 1024 * 1024;
+const MAX_SBOM_BYTES = 64 * 1024 * 1024;
+const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+const MAX_PAGES = 100;
+
+const digestBytes = (value) =>
+  createHash('sha256').update(value).digest('hex');
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(canonical).join(',') + ']';
+  return '{' + Object.entries(value)
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+    .map(([key, child]) => JSON.stringify(key) + ':' + canonical(child))
+    .join(',') + '}';
+};
+const digestValue = (value) => digestBytes(Buffer.from(canonical(value), 'utf8'));
+const requireRecord = (value, message) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(message);
+  }
+  return value;
+};
+const repositoryRoot = realpathSync(
+  execFileSync('git', ['rev-parse', '--show-toplevel'], {
+    encoding: 'utf8',
+  }).trim(),
+);
+const assertNoSymlinkTraversal = (absolute, label, allowMissing = false) => {
+  const fromRoot = relative(repositoryRoot, absolute);
+  if (
+    fromRoot === '..' ||
+    fromRoot.startsWith('..' + sep) ||
+    isAbsolute(fromRoot)
+  ) {
+    throw new Error(label + ' escapes the repository.');
+  }
+  let current = repositoryRoot;
+  for (const segment of fromRoot.split(sep).filter(Boolean)) {
+    current = join(current, segment);
+    if (!existsSync(current)) {
+      if (allowMissing) return;
+      throw new Error(label + ' is absent.');
+    }
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error(label + ' may not traverse symbolic links.');
+    }
+  }
+};
+const safePath = (candidate, label, options = {}) => {
+  if (typeof candidate !== 'string' || candidate.trim() !== candidate || candidate === '') {
+    throw new Error(label + ' must identify one exact path.');
+  }
+  const absolute = resolve(process.cwd(), candidate);
+  if (!options.output && !existsSync(absolute)) {
+    throw new Error(label + ' is absent.');
+  }
+  if (!options.output) {
+    if (lstatSync(absolute).isSymbolicLink()) {
+      throw new Error(label + ' may not be a symbolic link.');
+    }
+    const real = realpathSync(absolute);
+    const realFromRoot = relative(repositoryRoot, real);
+    if (
+      realFromRoot === '..' ||
+      realFromRoot.startsWith('..' + sep) ||
+      isAbsolute(realFromRoot)
+    ) {
+      throw new Error(label + ' resolves outside the repository.');
+    }
+    assertNoSymlinkTraversal(real, label);
+    if (!lstatSync(real).isFile()) {
+      throw new Error(label + ' must identify one regular file.');
+    }
+    return real;
+  }
+  const fromRoot = relative(repositoryRoot, absolute);
+  if (
+    fromRoot === '' ||
+    fromRoot === '..' ||
+    fromRoot.startsWith('..' + sep) ||
+    isAbsolute(fromRoot)
+  ) {
+    throw new Error(label + ' must stay inside the repository.');
+  }
+  assertNoSymlinkTraversal(absolute, label, true);
+  if (
+    options.directory &&
+    existsSync(absolute) &&
+    !lstatSync(absolute).isDirectory()
+  ) {
+    throw new Error(label + ' must identify one output directory.');
+  }
+  return absolute;
+};
+const readBoundedFile = (path, maximum, message) => {
+  const metadata = lstatSync(path);
+  if (
+    !metadata.isFile() ||
+    metadata.isSymbolicLink() ||
+    metadata.size === 0 ||
+    metadata.size > maximum
+  ) {
+    throw new Error(message);
+  }
+  const bytes = readFileSync(path);
+  if (bytes.byteLength === 0 || bytes.byteLength > maximum) {
+    throw new Error(message);
+  }
+  return bytes;
+};
+const readJson = (path, message, maximum = MAX_INPUT_BYTES) => {
+  try {
+    return JSON.parse(readBoundedFile(path, maximum, message).toString('utf8'));
+  } catch (error) {
+    if (error instanceof Error && error.message === message) throw error;
+    throw new Error(message);
+  }
+};
+const immutableWrite = (path, value) => {
+  const target = safePath(path, 'Evidence output', { output: true });
+  const serialized = Buffer.from(
+    typeof value === 'string' ? value : JSON.stringify(value, null, 2) + '\\n',
+    'utf8',
+  );
+  if (serialized.byteLength === 0 || serialized.byteLength > MAX_OUTPUT_BYTES) {
+    throw new Error('Evidence output exceeds its bounded size.');
+  }
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  safePath(dirname(target), 'Evidence output directory', {
+    directory: true,
+    output: true,
+  });
+  writeFileSync(target, serialized, {
+    flag: 'wx',
+    mode: 0o600,
+  });
+};
+const stableName = (maxLength, ...parts) => {
+  const value = parts.join('-').toLowerCase();
+  if (value.length <= maxLength) return value;
+  const suffix = digestBytes(Buffer.from(value, 'utf8')).slice(0, 12);
+  return value.slice(0, maxLength - suffix.length - 1) + '-' + suffix;
+};
+
+const mode = process.argv[2];
+if (mode === 'assess') {
+  const controlsPath = safePath(
+    process.env.EBK_RELEASE_CONTROLS_PATH ?? 'operations/release.json',
+    'EBK_RELEASE_CONTROLS_PATH',
+  );
+  const slice =
+    process.env.EBK_SLICE?.trim() ??
+    basename(process.cwd());
+  const report = assessEcrScanApplicability(
+    readJson(controlsPath, 'Release controls are invalid.'),
+    slice,
+  );
+  const output = safePath(
+    process.env.EBK_ECR_APPLICABILITY_OUTPUT_PATH ??
+      '.ebk/evidence/supply-chain/ecr-applicability.json',
+    'EBK_ECR_APPLICABILITY_OUTPUT_PATH',
+    { output: true },
+  );
+  immutableWrite(output, report);
+  process.stdout.write(JSON.stringify({
+    materialDigest: report.materialDigest,
+    output,
+    unit7Obligation: report.unit7Obligation,
+  }) + '\\n');
+  process.exit(0);
+}
+if (mode !== 'collect') {
+  throw new Error('Usage: ecr-inspector-collect.mjs <assess|collect>');
+}
+
+const inputPath = safePath(
+  process.env.EBK_ECR_SCAN_INPUT_PATH ?? '',
+  'EBK_ECR_SCAN_INPUT_PATH',
+);
+const input = requireRecord(
+  readJson(inputPath, 'ECR collector input is invalid.'),
+  'ECR collector input must be an object.',
+);
+if (
+  input.schemaVersion !== 1 ||
+  Object.keys(input).some(
+    (key) =>
+      ![
+        'accountId',
+        'artifactId',
+        'deployment',
+        'outputDirectory',
+        'region',
+        'releaseManifestPath',
+        'schemaVersion',
+        'stage',
+        'taskDefinitionFamily',
+      ].includes(key),
+  ) ||
+  !/^\\d{12}$/.test(input.accountId ?? '') ||
+  !/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\\d$/.test(input.region ?? '') ||
+  !['production', 'staging'].includes(input.stage) ||
+  typeof input.artifactId !== 'string' ||
+  !REFERENCE.test(input.artifactId) ||
+  typeof input.taskDefinitionFamily !== 'string' ||
+  !/^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$/.test(input.taskDefinitionFamily) ||
+  !input.deployment ||
+  typeof input.deployment !== 'object' ||
+  Array.isArray(input.deployment)
+) {
+  throw new Error('ECR collector input does not match the exact v1 shape.');
+}
+const clusterArnPattern = new RegExp(
+  '^arn:aws(?:-us-gov|-iso(?:-[a-z]+)?)?:ecs:' +
+    input.region +
+    ':' +
+    input.accountId +
+    ':cluster/[A-Za-z0-9_./-]{1,255}$',
+);
+const serviceArnPattern = new RegExp(
+  '^arn:aws(?:-us-gov|-iso(?:-[a-z]+)?)?:ecs:' +
+    input.region +
+    ':' +
+    input.accountId +
+    ':service/[A-Za-z0-9_./-]{1,511}$',
+);
+const taskArnPattern = new RegExp(
+  '^arn:aws(?:-us-gov|-iso(?:-[a-z]+)?)?:ecs:' +
+    input.region +
+    ':' +
+    input.accountId +
+    ':task/[A-Za-z0-9_./-]{1,511}$',
+);
+if (
+  !clusterArnPattern.test(input.deployment.clusterArn ?? '') ||
+  !(
+    (input.deployment.kind === 'service' &&
+      Object.keys(input.deployment).sort().join('\\0') ===
+        ['clusterArn', 'kind', 'serviceArn'].join('\\0') &&
+      serviceArnPattern.test(input.deployment.serviceArn ?? '')) ||
+    (input.deployment.kind === 'task' &&
+      Object.keys(input.deployment).sort().join('\\0') ===
+        ['clusterArn', 'kind', 'taskArn'].join('\\0') &&
+      taskArnPattern.test(input.deployment.taskArn ?? ''))
+  )
+) {
+  throw new Error(
+    'ECR collector deployment must identify one exact ECS service or task.',
+  );
+}
+const manifestPath = safePath(
+  input.releaseManifestPath,
+  'releaseManifestPath',
+);
+const outputDirectory = safePath(
+  input.outputDirectory ??
+    '.ebk/evidence/supply-chain/ecr-scans',
+  'outputDirectory',
+  { directory: true, output: true },
+);
+const manifestBytes = readBoundedFile(
+  manifestPath,
+  MAX_INPUT_BYTES,
+  'Release manifest exceeds its bounded input size.',
+);
+const parsedManifest = requireRecord(
+  JSON.parse(manifestBytes.toString('utf8')),
+  'Release manifest must be an object.',
+);
+const manifest = validateReleaseManifest(parsedManifest, {
+  materialDigest: parsedManifest.materialDigest,
+  sourceCommit: parsedManifest.source?.commit,
+});
+const sliceRoot = realpathSync(process.cwd());
+const slice = basename(sliceRoot);
+if (
+  manifest.kind !== 'ebk-release-manifest' ||
+  manifest.schemaVersion !== 1 ||
+  typeof manifest.releaseId !== 'string' ||
+  !REFERENCE.test(manifest.releaseId) ||
+  typeof manifest.materialDigest !== 'string' ||
+  !SHA256.test(manifest.materialDigest) ||
+  !manifest.source ||
+  !COMMIT.test(manifest.source.commit ?? '') ||
+  !Array.isArray(manifest.projects) ||
+  !manifest.projects.includes(slice) ||
+  relative(repositoryRoot, sliceRoot).split(sep).join('/') !==
+    'packages/' + slice
+) {
+  throw new Error('Release manifest is invalid for the current Slice.');
+}
+if (
+  relative(sliceRoot, manifestPath).split(sep).join('/') !==
+    '.ebk/evidence/release-manifests/' + manifest.releaseId + '.json'
+) {
+  throw new Error(
+    'Release manifest must use its canonical immutable evidence path.',
+  );
+}
+const controlsPath = realpathSync(
+  join(sliceRoot, 'operations/release.json'),
+);
+const releaseControls = requireRecord(
+  readJson(controlsPath, 'Release controls are invalid.'),
+  'Release controls must be an object.',
+);
+const artifactEvidencePath = realpathSync(
+  join(
+    sliceRoot,
+    '.ebk/evidence/release-artifacts',
+    manifest.source.commit + '.json',
+  ),
+);
+const artifacts = requireRecord(
+  readJson(
+    artifactEvidencePath,
+    'Release artifact evidence is invalid.',
+  ),
+  'Release artifact evidence must be an object.',
+);
+if (
+  artifacts.kind !== 'ebk-release-artifact-evidence' ||
+  artifacts.schemaVersion !== 1 ||
+  artifacts.sourceCommit !== manifest.source.commit ||
+  !artifacts.provenance ||
+  !/^[1-9]\\d*$/.test(artifacts.provenance.runAttempt ?? '') ||
+  !/^[1-9]\\d*$/.test(artifacts.provenance.runId ?? '') ||
+  typeof artifacts.provenance.workflow !== 'string' ||
+  artifacts.provenance.runId !== manifest.build?.runId ||
+  artifacts.provenance.workflow !== manifest.build?.workflow ||
+  !Array.isArray(artifacts.artifacts) ||
+  !Array.isArray(manifest.artifacts) ||
+  !Array.isArray(releaseControls.artifactInventory)
+) {
+  throw new Error(
+    'Release manifest and candidate artifact evidence are not exactly bound.',
+  );
+}
+const inventoryDigest = digestBytes(
+  Buffer.from(JSON.stringify(releaseControls.artifactInventory), 'utf8'),
+);
+const capturedByName = new Map(
+  artifacts.artifacts.map((artifact) => [artifact?.name, artifact]),
+);
+const manifestByName = new Map(
+  manifest.artifacts.map((artifact) => [artifact?.name, artifact]),
+);
+if (
+  artifacts.inventoryDigest !== inventoryDigest ||
+  artifacts.artifacts.length !== releaseControls.artifactInventory.length ||
+  manifest.artifacts.length !== releaseControls.artifactInventory.length ||
+  capturedByName.size !== artifacts.artifacts.length ||
+  manifestByName.size !== manifest.artifacts.length ||
+  releaseControls.artifactInventory.some((registered) => {
+    const captured = capturedByName.get(registered.name);
+    const retained = manifestByName.get(registered.name);
+    const capturedDigest =
+      captured?.classification === 'stage-neutral'
+        ? captured.digest
+        : captured?.candidateDigest;
+    const retainedDigest =
+      retained?.classification === 'stage-neutral'
+        ? retained.digest
+        : retained?.candidateDigest;
+    return (
+      !captured ||
+      !retained ||
+      captured.name !== registered.name ||
+      captured.workload !== registered.workload ||
+      captured.classification !== registered.classification ||
+      retained.workload !== registered.workload ||
+      retained.classification !== registered.classification ||
+      capturedDigest !== retainedDigest ||
+      !SHA256.test(capturedDigest ?? '') ||
+      (registered.classification === 'stage-specific' &&
+        (captured.reason !== registered.reason ||
+          captured.providerEvidence !== registered.providerEvidence ||
+          retained.reason !== registered.reason ||
+          retained.providerEvidence !== registered.providerEvidence))
+    );
+  })
+) {
+  throw new Error(
+    'Release controls, candidate evidence, and manifest artifacts do not reconcile exactly.',
+  );
+}
+const applicability = assessEcrScanApplicability(
+  releaseControls,
+  slice,
+);
+const applicable = applicability.artifacts.find(
+  ({ artifactId }) => artifactId === input.artifactId,
+);
+if (!applicable || applicable.status !== 'applicable') {
+  throw new Error(
+    'Artifact is not ECR-scan applicable: ' +
+      (applicable?.status ?? 'unregistered') +
+      '. Current SST context builds remain unsupported.',
+  );
+}
+const declared = releaseControls.artifactInventory.find(
+  ({ id }) => id === input.artifactId,
+);
+if (
+  !declared ||
+  declared.name !== applicable.artifactName ||
+  !['job', 'service'].includes(declared.workload) ||
+  (declared.workload === 'service' && input.deployment.kind !== 'service') ||
+  (declared.workload === 'job' && input.deployment.kind !== 'task')
+) {
+  throw new Error('Applicable OCI artifact registration is inconsistent.');
+}
+const idParts = input.artifactId.split('.');
+if (
+  idParts.length !== 3 ||
+  idParts[0] !== slice ||
+  idParts[1] !== declared.workload ||
+  !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(idParts[2])
+) {
+  throw new Error(
+    'OCI artifacts must use the exact <slice>.<kind>.<workload> identity.',
+  );
+}
+const candidate = capturedByName.get(declared.name);
+const candidateArtifactDigest =
+  candidate?.classification === 'stage-neutral'
+    ? candidate.digest
+    : candidate?.candidateDigest;
+if (
+  !candidate ||
+  !SHA256.test(candidateArtifactDigest ?? '') ||
+  artifacts.artifacts.filter(({ name }) => name === declared.name).length !== 1
+) {
+  throw new Error('Exact release candidate artifact digest is absent.');
+}
+const containerCandidateDigests = Object.fromEntries(
+  releaseControls.artifactInventory.flatMap((registered) => {
+    if (
+      registered?.finalArtifact?.support !== 'supported' ||
+      registered.finalArtifact.family !== 'oci-image'
+    ) {
+      return [];
+    }
+    const captured = capturedByName.get(registered.name);
+    const digest =
+      captured?.classification === 'stage-neutral'
+        ? captured.digest
+        : captured?.candidateDigest;
+    if (typeof registered.id !== 'string' || !SHA256.test(digest ?? '')) {
+      throw new Error('Container release candidate inventory is incomplete.');
+    }
+    return [[registered.id, digest]];
+  }),
+);
+const containerBindingPath = safePath(
+  '../../.ebk/evidence/container-release/' + input.stage +
+    '/packages/' + slice + '/binding.json',
+  'Container release binding',
+);
+const containerBinding = validateContainerReleaseBinding(
+  readJson(containerBindingPath, 'Container release binding is invalid.'),
+  {
+    accountId: input.accountId,
+    candidateDigests: containerCandidateDigests,
+    region: input.region,
+    slice,
+    sourceCommit: manifest.source.commit,
+    stage: input.stage,
+  },
+);
+const containerArtifact = resolveContainerReleaseArtifact(containerBinding, {
+  artifactId: input.artifactId,
+  candidateArtifactDigest,
+});
+const releaseManifestDigest = digestBytes(manifestBytes);
+const expected = {
+  accountId: input.accountId,
+  artifactId: input.artifactId,
+  candidateArtifactDigest,
+  containerBindingDigest: containerBinding.materialDigest,
+  containerImageDigest: containerArtifact.imageDigest,
+  imageReference: containerArtifact.imageReference,
+  region: input.region,
+  releaseId: manifest.releaseId,
+  releaseManifestDigest,
+  releaseManifestMaterialDigest: manifest.materialDigest,
+  repositoryName: containerArtifact.repositoryName,
+  sourceCommit: manifest.source.commit,
+  stage: input.stage,
+  taskDefinitionFamily: input.taskDefinitionFamily,
+  deployment: input.deployment,
+};
+
+const transcriptEntries = [];
+const execute = (command, args, purpose, options = {}) => {
+  const maximumBytes = options.maximumBytes ?? MAX_AWS_RESPONSE_BYTES;
+  let stdout;
+  try {
+    stdout = execFileSync(command, args, {
+      encoding: options.encoding ?? 'utf8',
+      env: { ...process.env, ...(options.env ?? {}) },
+      input: options.input,
+      maxBuffer: maximumBytes,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    throw new Error(
+      purpose + ' failed without complete evidence: ' +
+        String(error?.stderr ?? error?.message ?? error).slice(0, 2_000),
+    );
+  }
+  const bytes =
+    typeof stdout === 'string' ? Buffer.from(stdout, 'utf8') : stdout;
+  if (bytes.byteLength > maximumBytes) {
+    throw new Error(purpose + ' exceeded its response-size bound.');
+  }
+  transcriptEntries.push({
+    args,
+    command: basename(command),
+    purpose,
+    responseBytes: bytes.byteLength,
+    responseSha256: digestBytes(bytes),
+  });
+  return stdout;
+};
+const awsJson = (args, purpose) => {
+  const raw = execute('aws', args, purpose);
+  try {
+    return { raw, value: JSON.parse(raw) };
+  } catch {
+    throw new Error(purpose + ' returned invalid JSON.');
+  }
+};
+const toolVersion = String(
+  execute('aws', ['--version'], 'aws-cli-version'),
+).trim();
+const caller = awsJson(
+  ['sts', 'get-caller-identity', '--output', 'json'],
+  'sts-caller-identity',
+);
+if (caller.value?.Account !== input.accountId) {
+  throw new Error('AWS caller account differs from the collector target.');
+}
+const provenance = {
+  runAttempt: process.env.GITHUB_RUN_ATTEMPT?.trim() ?? '1',
+  runId: process.env.GITHUB_RUN_ID?.trim() ?? '1',
+  tool: 'aws-cli',
+  toolVersion,
+  workflow:
+    process.env.GITHUB_WORKFLOW_REF?.trim() ??
+    'local/ecr-inspector-collector@manual',
+};
+const deploymentRequest = {
+  ...input.deployment,
+  region: input.region,
+};
+const deploymentArgs =
+  input.deployment.kind === 'service'
+    ? [
+        'ecs',
+        'describe-services',
+        '--cluster',
+        input.deployment.clusterArn,
+        '--services',
+        input.deployment.serviceArn,
+        '--region',
+        input.region,
+        '--output',
+        'json',
+      ]
+    : [
+        'ecs',
+        'describe-tasks',
+        '--cluster',
+        input.deployment.clusterArn,
+        '--tasks',
+        input.deployment.taskArn,
+        '--region',
+        input.region,
+        '--output',
+        'json',
+      ];
+const deployedTaskDefinitionArn = (response, label) => {
+  if (!Array.isArray(response?.failures) || response.failures.length !== 0) {
+    throw new Error(label + ' returned deployment failures.');
+  }
+  if (input.deployment.kind === 'service') {
+    if (
+      !Array.isArray(response.services) ||
+      response.services.length !== 1 ||
+      response.services[0]?.clusterArn !== input.deployment.clusterArn ||
+      response.services[0]?.serviceArn !== input.deployment.serviceArn ||
+      response.services[0]?.status !== 'ACTIVE' ||
+      typeof response.services[0]?.taskDefinition !== 'string' ||
+      !Array.isArray(response.services[0]?.deployments) ||
+      response.services[0].deployments.length !== 1 ||
+      response.services[0].deployments[0]?.status !== 'PRIMARY' ||
+      response.services[0].deployments[0]?.rolloutState !== 'COMPLETED' ||
+      response.services[0].deployments[0]?.taskDefinition !==
+        response.services[0].taskDefinition
+    ) {
+      throw new Error(
+        label + ' did not resolve one stable completed primary service deployment.',
+      );
+    }
+    return response.services[0].taskDefinition;
+  }
+  if (
+    !Array.isArray(response.tasks) ||
+    response.tasks.length !== 1 ||
+    response.tasks[0]?.clusterArn !== input.deployment.clusterArn ||
+    response.tasks[0]?.taskArn !== input.deployment.taskArn ||
+    !['RUNNING', 'STOPPED'].includes(response.tasks[0]?.lastStatus) ||
+    typeof response.tasks[0]?.taskDefinitionArn !== 'string'
+  ) {
+    throw new Error(label + ' did not resolve one exact ECS task execution.');
+  }
+  return response.tasks[0].taskDefinitionArn;
+};
+const firstDeployment = awsJson(
+  deploymentArgs,
+  'ecs-deployment-first',
+);
+const taskDefinitionArn = deployedTaskDefinitionArn(
+  firstDeployment.value,
+  'First ECS deployment lookup',
+);
+const taskRequest = {
+  include: ['TAGS'],
+  region: input.region,
+  taskDefinition: taskDefinitionArn,
+};
+const taskArgs = [
+  'ecs',
+  'describe-task-definition',
+  '--task-definition',
+  taskDefinitionArn,
+  '--include',
+  'TAGS',
+  '--region',
+  input.region,
+  '--output',
+  'json',
+];
+const firstTask = awsJson(taskArgs, 'ecs-task-definition-first');
+const firstCall = {
+  request: taskRequest,
+  response: firstTask.value,
+};
+
+const platformKey = process.platform + '-' + process.arch;
+const syftRelease = SYFT_RELEASES[platformKey];
+if (!syftRelease) {
+  throw new Error('No reviewed Syft release exists for ' + platformKey + '.');
+}
+const temporaryDirectory = mkdtempSync(join(tmpdir(), 'ebk-syft-'));
+let syftPath;
+try {
+  const suppliedArchive = process.env.EBK_SYFT_ARCHIVE_PATH?.trim();
+  const archivePath = suppliedArchive
+    ? resolve(process.cwd(), suppliedArchive)
+    : join(temporaryDirectory, 'syft-archive');
+  if (suppliedArchive) {
+    const suppliedMetadata = lstatSync(archivePath);
+    if (
+      !suppliedMetadata.isFile() ||
+      suppliedMetadata.isSymbolicLink() ||
+      suppliedMetadata.size === 0 ||
+      suppliedMetadata.size > MAX_TOOL_BYTES
+    ) {
+      throw new Error('Supplied Syft archive must be one bounded regular file.');
+    }
+  }
+  if (!suppliedArchive) {
+    const response = await fetch(syftRelease.source, {
+      redirect: 'follow',
+      signal: AbortSignal.timeout(120_000),
+    });
+    if (
+      !response.ok ||
+      Number(response.headers.get('content-length') ?? 0) > MAX_TOOL_BYTES
+    ) {
+      throw new Error('Pinned Syft archive download failed or was oversized.');
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.byteLength === 0 || bytes.byteLength > MAX_TOOL_BYTES) {
+      throw new Error('Pinned Syft archive is empty or oversized.');
+    }
+    writeFileSync(archivePath, bytes, { mode: 0o600 });
+  }
+  const archiveBytes = readBoundedFile(
+    archivePath,
+    MAX_TOOL_BYTES,
+    'Pinned Syft archive is empty or oversized.',
+  );
+  if (digestBytes(archiveBytes) !== syftRelease.sha256) {
+    throw new Error('Pinned Syft archive integrity does not match policy.');
+  }
+  if (syftRelease.archiveFormat === 'binary') {
+    syftPath = join(temporaryDirectory, 'syft');
+    writeFileSync(syftPath, archiveBytes, { mode: 0o700 });
+  } else {
+    execute(
+      'tar',
+      ['-xzf', archivePath, '-C', temporaryDirectory, 'syft'],
+      'extract-pinned-syft',
+    );
+    syftPath = join(temporaryDirectory, 'syft');
+    chmodSync(syftPath, 0o700);
+  }
+  const firstTaskDefinition = requireRecord(
+    firstTask.value.taskDefinition,
+    'First ECS task definition is absent.',
+  );
+  const firstContainer = Array.isArray(firstTaskDefinition.containerDefinitions)
+    ? firstTaskDefinition.containerDefinitions[0]
+    : undefined;
+  if (
+    !firstContainer ||
+    typeof firstContainer.image !== 'string' ||
+    !firstContainer.image.includes('@sha256:')
+  ) {
+    throw new Error(
+      'Task definition is tag-only; current SST context builds are unsupported.',
+    );
+  }
+  const imageMatch =
+    /^(\\d{12})\\.dkr\\.ecr\\.([a-z0-9-]+)\\.amazonaws\\.com(?:\\.cn)?\\/([a-z0-9][a-z0-9._/-]*)@(sha256:[a-f0-9]{64})$/.exec(
+      firstContainer.image,
+    );
+  if (
+    !imageMatch ||
+    imageMatch[1] !== input.accountId ||
+    imageMatch[2] !== input.region ||
+    !IMAGE_DIGEST.test(imageMatch[4] ?? '')
+  ) {
+    throw new Error('ECS image is not an exact target-registry digest.');
+  }
+  const repositoryName = imageMatch[3];
+  const imageDigest = imageMatch[4];
+  if (
+    firstContainer.image !== containerArtifact.imageReference ||
+    repositoryName !== containerArtifact.repositoryName ||
+    imageDigest !== containerArtifact.imageDigest
+  ) {
+    throw new Error(
+      'Deployed ECS image differs from the exact predeploy ECR repository and image reference.',
+    );
+  }
+  const describeExactImage = (digest, label) => {
+    const details = awsJson(
+      [
+        'ecr',
+        'describe-images',
+        '--registry-id',
+        input.accountId,
+        '--repository-name',
+        repositoryName,
+        '--image-ids',
+        'imageDigest=' + digest,
+        '--region',
+        input.region,
+        '--output',
+        'json',
+      ],
+      label,
+    );
+    if (
+      !Array.isArray(details.value?.imageDetails) ||
+      details.value.imageDetails.length !== 1 ||
+      details.value.imageDetails[0]?.registryId !== input.accountId ||
+      details.value.imageDetails[0]?.repositoryName !== repositoryName ||
+      details.value.imageDetails[0]?.imageDigest !== digest
+    ) {
+      throw new Error('Exact bound ECR image is absent or ambiguous.');
+    }
+  };
+  describeExactImage(imageDigest, 'ecr-exact-index-image');
+  for (const platform of containerArtifact.platforms) {
+    describeExactImage(
+      platform.imageDigest,
+      'ecr-exact-platform-image-' + platform.platform.replace('/', '-'),
+    );
+  }
+  const registryAuthority = imageMatch[1] + '.dkr.ecr.' + imageMatch[2] +
+    '.amazonaws.com' + (imageMatch[2].startsWith('cn-') ? '.cn' : '');
+  const registryToken = String(
+    execute(
+      'aws',
+      ['ecr', 'get-login-password', '--region', input.region],
+      'ecr-registry-auth-token',
+      { maximumBytes: 64 * 1024 },
+    ),
+  );
+  if (registryToken.trim().length === 0) {
+    throw new Error('ECR registry authentication returned an empty token.');
+  }
+  const dockerConfig = join(temporaryDirectory, 'docker-config');
+  mkdirSync(dockerConfig, { mode: 0o700 });
+  execute(
+    'docker',
+    ['login', '--username', 'AWS', '--password-stdin', registryAuthority],
+    'ecr-registry-authentication',
+    {
+      env: { DOCKER_CONFIG: dockerConfig },
+      input: registryToken,
+      maximumBytes: 1024 * 1024,
+    },
+  );
+  const syftVersionOutput = String(
+    execute(syftPath, ['version'], 'syft-version'),
+  );
+  if (
+    !new RegExp('(?:Version|version):?\\\\s*' + SYFT_VERSION.replaceAll('.', '\\\\.')).test(
+      syftVersionOutput,
+    )
+  ) {
+    throw new Error('Syft runtime version differs from reviewed policy.');
+  }
+  const platformSboms = [...containerArtifact.platforms]
+    .sort((left, right) =>
+      left.platform < right.platform
+        ? -1
+        : left.platform > right.platform
+          ? 1
+          : 0,
+    )
+    .map((platform) => {
+      const platformToken = platform.platform.replace('/', '-');
+      const raw = String(
+        execute(
+          syftPath,
+          ['scan', platform.imageReference, '--output', 'cyclonedx-json'],
+          'syft-platform-' + platformToken + '-scan',
+          {
+            env: {
+              DOCKER_CONFIG: dockerConfig,
+              SYFT_CHECK_FOR_APP_UPDATE: 'false',
+            },
+            maximumBytes: MAX_SBOM_BYTES,
+          },
+        ),
+      );
+      let sbom;
+      try {
+        sbom = JSON.parse(raw);
+      } catch {
+        throw new Error(
+          'Syft returned invalid CycloneDX JSON for ' + platform.platform + '.',
+        );
+      }
+      if (
+        sbom?.bomFormat !== 'CycloneDX' ||
+        sbom.specVersion !== '1.6' ||
+        sbom.version !== 1 ||
+        typeof sbom.serialNumber !== 'string' ||
+        !/^urn:uuid:[a-fA-F0-9-]{36}$/.test(sbom.serialNumber) ||
+        !Array.isArray(sbom.components) ||
+        sbom.components.length === 0 ||
+        !Array.isArray(sbom.dependencies) ||
+        !sbom.metadata ||
+        typeof sbom.metadata !== 'object'
+      ) {
+        throw new Error(
+          'Syft output is not complete CycloneDX 1.6 evidence for ' +
+            platform.platform + '.',
+        );
+      }
+      const serialized = JSON.stringify(sbom, null, 2) + '\\n';
+      return {
+        binding: platform,
+        digest: digestBytes(Buffer.from(serialized, 'utf8')),
+        platform: platform.platform,
+        sbom,
+        serialized,
+      };
+    });
+  const configuration = awsJson(
+    [
+      'ecr',
+      'get-registry-scanning-configuration',
+      '--region',
+      input.region,
+      '--output',
+      'json',
+    ],
+    'ecr-enhanced-scan-configuration',
+  );
+  const platformPages = [];
+  let totalPageBytes = 0;
+  for (const platform of [...containerArtifact.platforms].sort((left, right) =>
+    left.platform < right.platform
+      ? -1
+      : left.platform > right.platform
+        ? 1
+        : 0,
+  )) {
+    const pages = [];
+    let nextToken;
+    for (let page = 0; page < MAX_PAGES; page += 1) {
+      const request = {
+        imageId: { imageDigest: platform.imageDigest },
+        maxResults: 1000,
+        ...(nextToken === undefined ? {} : { nextToken }),
+        region: input.region,
+        registryId: input.accountId,
+        repositoryName,
+      };
+      const apiInput = {
+        imageId: request.imageId,
+        maxResults: request.maxResults,
+        ...(nextToken === undefined ? {} : { nextToken }),
+        registryId: request.registryId,
+        repositoryName: request.repositoryName,
+      };
+      const args = [
+        'ecr',
+        'describe-image-scan-findings',
+        '--cli-input-json',
+        JSON.stringify(apiInput),
+        '--no-paginate',
+        '--region',
+        input.region,
+        '--output',
+        'json',
+      ];
+      const platformToken = platform.platform.replace('/', '-');
+      const response = awsJson(
+        args,
+        'ecr-enhanced-findings-' + platformToken + '-page-' + String(page + 1),
+      );
+      totalPageBytes += Buffer.byteLength(response.raw, 'utf8');
+      if (totalPageBytes > MAX_TOTAL_PAGE_BYTES) {
+        throw new Error('ECR findings exceeded the cumulative response-size bound.');
+      }
+      pages.push({ request, response: response.value });
+      nextToken =
+        typeof response.value?.nextToken === 'string' &&
+        response.value.nextToken.length > 0
+          ? response.value.nextToken
+          : undefined;
+      if (
+        nextToken !== undefined &&
+        (nextToken.length > 2_048 ||
+          !/^[A-Za-z0-9._:/+=-]+$/.test(nextToken))
+      ) {
+        throw new Error('ECR findings returned an invalid bounded pagination token.');
+      }
+      if (nextToken === undefined) break;
+    }
+    if (nextToken !== undefined) {
+      throw new Error('ECR findings exceeded the bounded pagination limit.');
+    }
+    platformPages.push({ pages, platform });
+  }
+  const revalidatedDeployment = awsJson(
+    deploymentArgs,
+    'ecs-deployment-revalidated',
+  );
+  if (
+    deployedTaskDefinitionArn(
+      revalidatedDeployment.value,
+      'Revalidated ECS deployment lookup',
+    ) !== taskDefinitionArn
+  ) {
+    throw new Error(
+      'ECS deployment changed while the image identity was being collected.',
+    );
+  }
+  const revalidatedTask = awsJson(
+    taskArgs,
+    'ecs-task-definition-revalidated',
+  );
+  const collectedAt = new Date().toISOString();
+  const deploymentBinding = collectEcsDeployedImageBinding({
+    collectedAt,
+    deployment: {
+      request: deploymentRequest,
+      response: firstDeployment.value,
+    },
+    expected,
+    first: firstCall,
+    provenance,
+    revalidatedDeployment: {
+      request: deploymentRequest,
+      response: revalidatedDeployment.value,
+    },
+    revalidated: {
+      request: taskRequest,
+      response: revalidatedTask.value,
+    },
+  });
+  verifyEcsDeployedImageBinding(deploymentBinding, expected);
+  if (
+    deploymentBinding.imageDigest !== imageDigest ||
+    deploymentBinding.repositoryName !== repositoryName
+  ) {
+    throw new Error('ECS and ECR image discovery produced different identities.');
+  }
+
+  const prefix =
+    manifest.releaseId + '-' + declared.name.replaceAll('/', '-');
+  const sbom = createCycloneDxPlatformSbomUnion({
+    artifact: {
+      'bom-ref': deploymentBinding.imageReference,
+      hashes: [{ alg: 'SHA-256', content: imageDigest.slice(7) }],
+      name: declared.name,
+      type: 'container',
+      version: imageDigest,
+    },
+    generatedAt: collectedAt,
+    platforms: platformSboms.map(({ platform, sbom: platformSbom }) => ({
+      platform,
+      sbom: platformSbom,
+    })),
+    properties: [
+      { name: 'ebk:artifact:candidate-digest', value: candidateArtifactDigest },
+      { name: 'ebk:artifact:id', value: declared.name },
+      {
+        name: 'ebk:container:binding-digest',
+        value: containerBinding.materialDigest,
+      },
+      {
+        name: 'ebk:container:platform-parity-digest',
+        value: containerArtifact.sbomParityDigest,
+      },
+      ...platformSboms.flatMap(({ binding, digest, platform, sbom: child }) => {
+        const token = platform.replace('/', '-');
+        return [
+          {
+            name: 'ebk:container:platform:' + token + ':image-digest',
+            value: binding.imageDigest,
+          },
+          {
+            name: 'ebk:container:platform:' + token + ':image-reference',
+            value: binding.imageReference,
+          },
+          {
+            name: 'ebk:container:platform:' + token + ':predeploy-sbom-sha256',
+            value: binding.sbom.sha256,
+          },
+          {
+            name: 'ebk:container:platform:' + token + ':sbom-path',
+            value: prefix + '.sbom-' + token + '.cdx.json',
+          },
+          {
+            name: 'ebk:container:platform:' + token + ':sbom-serial-number',
+            value: child.serialNumber.toLowerCase(),
+          },
+          {
+            name: 'ebk:container:platform:' + token + ':sbom-sha256',
+            value: digest,
+          },
+        ];
+      }),
+      { name: 'ebk:deployment:coverage', value: 'deployed-artifact' },
+      { name: 'ebk:image:digest', value: imageDigest },
+      { name: 'ebk:image:reference', value: deploymentBinding.imageReference },
+      { name: 'ebk:inventory:scope', value: 'final-oci-contents' },
+      { name: 'ebk:release:id', value: manifest.releaseId },
+      { name: 'ebk:release:manifest-digest', value: releaseManifestDigest },
+      { name: 'ebk:source:commit', value: manifest.source.commit },
+    ],
+  });
+  const serializedSbom = JSON.stringify(sbom, null, 2) + '\\n';
+  const sbomDigest = digestBytes(Buffer.from(serializedSbom, 'utf8'));
+
+  const transcriptUnsigned = {
+    entries: transcriptEntries,
+    kind: 'ebk-ecr-collector-raw-transcript',
+    schemaVersion: 1,
+    target: {
+      accountId: input.accountId,
+      artifactId: declared.name,
+      region: input.region,
+      releaseId: manifest.releaseId,
+      sourceCommit: manifest.source.commit,
+      stage: input.stage,
+    },
+  };
+  const transcript = {
+    ...transcriptUnsigned,
+    materialDigest: digestValue(transcriptUnsigned),
+  };
+  const sharedTarget = {
+    accountId: input.accountId,
+    artifactId: declared.name,
+    candidateArtifactDigest,
+    collectorTranscriptDigest: transcript.materialDigest,
+    deploymentBindingDigest: deploymentBinding.materialDigest,
+    region: input.region,
+    releaseId: manifest.releaseId,
+    releaseManifestDigest,
+    releaseManifestMaterialDigest: manifest.materialDigest,
+    repositoryName,
+    sbomInventoryScope: 'final-oci-contents',
+    sourceCommit: manifest.source.commit,
+    stage: input.stage,
+  };
+  const target = {
+    ...sharedTarget,
+    imageDigest,
+    sbomDigest,
+    sbomSerialNumber: sbom.serialNumber.toLowerCase(),
+  };
+  const platformScans = platformPages.map(({ pages, platform }) => {
+    const platformSbom = platformSboms.find(
+      (candidate) => candidate.platform === platform.platform,
+    );
+    if (!platformSbom || platformSbom.binding.imageDigest !== platform.imageDigest) {
+      throw new Error('Platform SBOM scan is absent or cross-paired.');
+    }
+    const platformTarget = {
+      ...sharedTarget,
+      imageDigest: platform.imageDigest,
+      sbomDigest: platformSbom.digest,
+      sbomSerialNumber: platformSbom.sbom.serialNumber.toLowerCase(),
+    };
+    const evidence = collectEcrInspectorScanEvidence({
+      collectedAt,
+      configuration: {
+        request: { region: input.region },
+        response: configuration.value,
+      },
+      pages,
+      provenance,
+      target: platformTarget,
+    });
+    verifyEcrInspectorScanEvidence(evidence, platformTarget);
+    return {
+      evidence,
+      platform: platform.platform,
+      sbom: platformSbom,
+      target: platformTarget,
+    };
+  });
+  if (
+    platformScans.length !== 2 ||
+    platformScans[0]?.platform !== 'linux/amd64' ||
+    platformScans[1]?.platform !== 'linux/arm64'
+  ) {
+    throw new Error('Inspector evidence must cover both bound OCI child manifests.');
+  }
+  const scanEvidenceUnsigned = {
+    collectedAt,
+    kind: 'ebk-ecr-inspector-platform-scan-set',
+    platformScans: platformScans.map(({ evidence, platform, sbom: child, target }) => ({
+      imageDigest: target.imageDigest,
+      platform,
+      predeploySbomDigest: child.binding.sbom.sha256,
+      sbomDigest: target.sbomDigest,
+      sbomPath: prefix + '.sbom-' + platform.replace('/', '-') + '.cdx.json',
+      scanEvidenceDigest: evidence.materialDigest,
+    })),
+    schemaVersion: 1,
+    status: 'complete',
+    target,
+  };
+  const scanEvidence = {
+    ...scanEvidenceUnsigned,
+    materialDigest: digestValue(scanEvidenceUnsigned),
+  };
+  const impactUnsigned = {
+    artifact: {
+      candidateDigest: candidateArtifactDigest,
+      id: declared.name,
+      imageDigest,
+      repositoryName,
+    },
+    components: sbom.components
+      .map((component) => ({
+        name: component.name,
+        purl: component.purl,
+        type: component.type,
+        version: component.version,
+      }))
+      .sort((left, right) =>
+        String(left.purl ?? left.name) < String(right.purl ?? right.name)
+          ? -1
+          : String(left.purl ?? left.name) > String(right.purl ?? right.name)
+            ? 1
+            : 0,
+      ),
+    findings: platformScans.flatMap(({ evidence, platform }) =>
+      evidence.findings.map((finding) => ({
+        findingArn: finding.findingArn,
+        packageNames: finding.packageNames,
+        platform,
+        severity: finding.severity,
+        status: finding.status,
+        vulnerabilityId: finding.vulnerabilityId,
+      })),
+    ),
+    kind: 'ebk-production-release-component-impact',
+    release: {
+      id: manifest.releaseId,
+      manifestDigest: releaseManifestDigest,
+      manifestMaterialDigest: manifest.materialDigest,
+      sourceCommit: manifest.source.commit,
+      stage: input.stage,
+    },
+    sbom: {
+      digest: sbomDigest,
+      inventoryScope: 'final-oci-contents',
+      serialNumber: sbom.serialNumber.toLowerCase(),
+    },
+    schemaVersion: 1,
+  };
+  const impact = {
+    ...impactUnsigned,
+    materialDigest: digestValue(impactUnsigned),
+  };
+  immutableWrite(join(outputDirectory, prefix + '.raw.json'), transcript);
+  immutableWrite(
+    join(outputDirectory, prefix + '.deployment.json'),
+    deploymentBinding,
+  );
+  immutableWrite(join(outputDirectory, prefix + '.cdx.json'), serializedSbom);
+  for (const child of platformSboms) {
+    immutableWrite(
+      join(
+        outputDirectory,
+        prefix + '.sbom-' + child.platform.replace('/', '-') + '.cdx.json',
+      ),
+      child.serialized,
+    );
+  }
+  for (const { evidence, platform } of platformScans) {
+    immutableWrite(
+      join(
+        outputDirectory,
+        prefix + '.scan-' + platform.replace('/', '-') + '.json',
+      ),
+      evidence,
+    );
+  }
+  immutableWrite(join(outputDirectory, prefix + '.scan.json'), scanEvidence);
+  immutableWrite(join(outputDirectory, prefix + '.impact.json'), impact);
+  process.stdout.write(JSON.stringify({
+    artifactId: declared.name,
+    deploymentBindingDigest: deploymentBinding.materialDigest,
+    imageDigest,
+    impactDigest: impact.materialDigest,
+    releaseId: manifest.releaseId,
+    platformScanEvidenceDigests: scanEvidence.platformScans,
+    scanEvidenceDigest: scanEvidence.materialDigest,
+    sbomDigest,
+    transcriptDigest: transcript.materialDigest,
+  }) + '\\n');
+} finally {
+  rmSync(temporaryDirectory, { force: true, recursive: true });
+}
+`;
+}
+//# sourceMappingURL=generated-ecr-collector-command.js.map