@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/supply-chain/build-output.js

@@ -11,17 +11,37 @@ const validation_js_1 = require("../validation.js");
 const common_js_1 = require("./common.js");
 const errors_js_1 = require("./errors.js");
 const license_expression_js_1 = require("./license-expression.js");
+const build_output_bounds_js_1 = require("./build-output-bounds.js");
 exports.NEXTJS_BUILD_OUTPUT_INVENTORY_KIND = 'ebk-nextjs-build-output-inventory';
-exports.NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION = 1;
+exports.NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION = 2;
 const MAX_FILES = 50_000;
-const MAX_DIRECTORIES = 4_096;
 const MAX_FILE_BYTES = 100 * 1024 * 1024;
 const MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
 const MAX_MATERIAL_PATHS = 64;
 const MAX_TRACE_REFERENCES = MAX_FILES;
+const MAX_LINKS = 4_096;
+const MAX_LINK_TARGET_BYTES = 4_096;
 function npmPurl(name, version) {
     return `pkg:npm/${encodeURIComponent(name)}@${version}`;
 }
+function sameFilesystemIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function filesystemIdentity(path, pointer) {
+    try {
+        const metadata = (0, node_fs_1.lstatSync)(path, { bigint: true });
+        if (metadata.ino === 0n)
+            throw new Error();
+        return { dev: metadata.dev, ino: metadata.ino };
+    }
+    catch {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify one stable build-output filesystem object');
+    }
+}
+function filesystemIdentityKey(path, pointer) {
+    const identity = filesystemIdentity(path, pointer);
+    return `${identity.dev}:${identity.ino}`;
+}
 function normalizedChild(root, path, pointer) {
     const child = (0, node_path_1.relative)(root, path);
     if (child === '' ||
@@ -32,6 +52,34 @@ function normalizedChild(root, path, pointer) {
     }
     return child.split(node_path_1.sep).join('/');
 }
+function normalizedRealChild(rootIdentity, path, pointer) {
+    const segments = [];
+    let current = path;
+    for (let depth = 0; depth <= 1024; depth += 1) {
+        let identity;
+        try {
+            identity = (0, node_fs_1.lstatSync)(current, { bigint: true });
+        }
+        catch {
+            break;
+        }
+        if (identity.dev === rootIdentity.dev &&
+            identity.ino === rootIdentity.ino) {
+            if (segments.length === 0)
+                break;
+            return segments.reverse().join('/');
+        }
+        const parent = (0, node_path_1.dirname)(current);
+        if (parent === current)
+            break;
+        const segment = (0, node_path_1.basename)(current);
+        if (!segment || segment === '.' || segment === '..')
+            break;
+        segments.push(segment);
+        current = parent;
+    }
+    throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'resolves outside the build-output repository boundary');
+}
 function repositoryRelativePath(repositoryRoot, value, pointer) {
     if (typeof value !== 'string' ||
         value === '' ||
@@ -66,7 +114,7 @@ function repositoryRelativePath(repositoryRoot, value, pointer) {
     }
     return { absolute, path };
 }
-function readJsonEvidence(repositoryRoot, absoluteInput, pointer) {
+function readJsonEvidence(repositoryRootIdentity, absoluteInput, pointer) {
     let absolute;
     try {
         absolute = (0, node_fs_1.realpathSync)(absoluteInput);
@@ -74,7 +122,7 @@ function readJsonEvidence(repositoryRoot, absoluteInput, pointer) {
     catch {
         throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify readable build-output evidence');
     }
-    const path = normalizedChild(repositoryRoot, absolute, pointer);
+    const path = normalizedRealChild(repositoryRootIdentity, absolute, pointer);
     let metadata;
     try {
         metadata = (0, node_fs_1.lstatSync)(absolute);
@@ -171,17 +219,91 @@ function createNextJsBuildOutputInventory(input) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'buildOutput', 'must identify one exact release candidate and nonempty material boundary');
     }
     let repositoryRoot;
+    let repositoryRootIdentity;
     try {
         repositoryRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.repositoryRoot));
+        const identity = (0, node_fs_1.lstatSync)(repositoryRoot, { bigint: true });
+        if (!identity.isDirectory() || identity.ino === 0n)
+            throw new Error();
+        repositoryRootIdentity = { dev: identity.dev, ino: identity.ino };
     }
     catch {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'repositoryRoot', 'must identify one existing repository root');
     }
     const files = new Map();
+    const links = new Map();
     const materialFiles = new Map();
+    const compilerCacheDirectories = new Set();
     let visitedDirectories = 0;
     let discoveredBytes = 0;
+    const addLink = (absoluteInput, pointer) => {
+        let metadata;
+        let targetText;
+        let absolute;
+        try {
+            metadata = (0, node_fs_1.lstatSync)(absoluteInput);
+            targetText = (0, node_fs_1.readlinkSync)(absoluteInput, 'utf8');
+            absolute = (0, node_fs_1.realpathSync)(absoluteInput);
+        }
+        catch {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify one readable build-output symbolic link');
+        }
+        if (!metadata.isSymbolicLink() ||
+            Buffer.byteLength(targetText, 'utf8') > MAX_LINK_TARGET_BYTES) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'must identify one bounded build-output symbolic link');
+        }
+        const path = normalizedChild(repositoryRoot, absoluteInput, pointer);
+        const target = normalizedRealChild(repositoryRootIdentity, absolute, pointer);
+        const targetMetadata = (0, node_fs_1.lstatSync)(absolute);
+        const targetKind = targetMetadata.isDirectory()
+            ? 'directory'
+            : targetMetadata.isFile()
+                ? 'file'
+                : undefined;
+        if (!targetKind) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'must resolve to one regular file or directory in the repository');
+        }
+        const record = {
+            path,
+            target,
+            targetKind,
+            targetTextSha256: (0, node_crypto_1.createHash)('sha256')
+                .update(targetText, 'utf8')
+                .digest('hex'),
+        };
+        const existing = links.get(path);
+        if (existing && (0, common_js_1.supplyChainDigest)(existing) !== (0, common_js_1.supplyChainDigest)(record)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'aliases one build-output link to multiple targets');
+        }
+        if (!existing && links.size >= MAX_LINKS) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'exceeds the bounded build-output link inventory');
+        }
+        links.set(path, record);
+        return { absolute, targetKind };
+    };
+    const capturePathLinks = (absoluteInput, pointer) => {
+        const path = normalizedChild(repositoryRoot, absoluteInput, pointer);
+        let current = repositoryRoot;
+        let finalIsSymbolicLink = false;
+        const segments = path.split('/');
+        for (const [index, segment] of segments.entries()) {
+            current = (0, node_path_1.join)(current, segment);
+            let metadata;
+            try {
+                metadata = (0, node_fs_1.lstatSync)(current);
+            }
+            catch {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify a readable build-output path');
+            }
+            if (metadata.isSymbolicLink()) {
+                addLink(current, pointer);
+                finalIsSymbolicLink = index === segments.length - 1;
+            }
+        }
+        return finalIsSymbolicLink;
+    };
     const addFile = (absoluteInput, pointer) => {
+        const finalIsSymbolicLink = capturePathLinks(absoluteInput, pointer);
         let absolute;
         try {
             absolute = (0, node_fs_1.realpathSync)(absoluteInput);
@@ -189,7 +311,7 @@ function createNextJsBuildOutputInventory(input) {
         catch {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify a readable build-output file');
         }
-        const path = normalizedChild(repositoryRoot, absolute, pointer);
+        const path = normalizedRealChild(repositoryRootIdentity, absolute, pointer);
         let metadata;
         try {
             metadata = (0, node_fs_1.lstatSync)(absolute);
@@ -197,7 +319,10 @@ function createNextJsBuildOutputInventory(input) {
         catch {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify a readable build-output file');
         }
+        const identity = filesystemIdentity(absolute, pointer);
         const existing = files.get(path);
+        if (metadata.isDirectory() && finalIsSymbolicLink)
+            return undefined;
         if (!metadata.isFile() || metadata.size > MAX_FILE_BYTES) {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'must be a bounded regular build-output file');
         }
@@ -208,11 +333,12 @@ function createNextJsBuildOutputInventory(input) {
             }
             discoveredBytes += metadata.size;
         }
-        else if (existing !== absolute) {
+        else if (!sameFilesystemIdentity(existing.identity, identity)) {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'aliases one build-output path to multiple files');
         }
-        files.set(path, absolute);
-        return { absolute, path };
+        const record = existing ?? { absolute, identity };
+        files.set(path, record);
+        return { absolute: record.absolute, path };
     };
     const visitMaterial = (absolute, pointer) => {
         let metadata;
@@ -222,20 +348,31 @@ function createNextJsBuildOutputInventory(input) {
         catch {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify an existing build-output material path');
         }
+        // Only Next's direct compiler cache is outside emitted build material.
+        // Traces are still resolved through addFile, so a runtime reference into
+        // this directory cannot escape the normal bounds or content inventory.
+        if (compilerCacheDirectories.has(absolute)) {
+            if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'Next.js compiler cache must be a real directory');
+            }
+            return;
+        }
         if (metadata.isSymbolicLink()) {
-            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'material paths may not traverse symbolic links');
+            addLink(absolute, pointer);
+            return;
         }
         if (metadata.isDirectory()) {
             visitedDirectories += 1;
-            if (visitedDirectories > MAX_DIRECTORIES) {
-                throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'exceeds the bounded build-output directory inventory');
-            }
+            (0, build_output_bounds_js_1.assertBuildOutputDirectoryInventoryBound)(visitedDirectories, pointer);
             for (const child of (0, node_fs_1.readdirSync)(absolute).sort()) {
                 visitMaterial((0, node_path_1.join)(absolute, child), pointer);
             }
             return;
         }
         const file = addFile(absolute, pointer);
+        if (!file) {
+            throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'must identify a regular build-output file');
+        }
         materialFiles.set(file.path, file);
     };
     const materialPaths = input.materialPaths.map((path, index) => repositoryRelativePath(repositoryRoot, path, `materialPaths[${index}]`));
@@ -245,6 +382,11 @@ function createNextJsBuildOutputInventory(input) {
     if (materialPaths.some(({ path }, index) => materialPaths.some(({ path: other }, otherIndex) => index !== otherIndex && other.startsWith(`${path}/`)))) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'materialPaths', 'must contain disjoint non-overlapping build-output boundaries');
     }
+    for (const { absolute } of materialPaths) {
+        if ((0, node_path_1.basename)(absolute) === '.next') {
+            compilerCacheDirectories.add((0, node_path_1.join)(absolute, 'cache'));
+        }
+    }
     materialPaths.forEach(({ absolute }, index) => visitMaterial(absolute, `materialPaths[${index}]`));
     const traces = [...materialFiles.values()].filter(({ path }) => path.endsWith('.nft.json'));
     if (traces.length === 0) {
@@ -252,7 +394,7 @@ function createNextJsBuildOutputInventory(input) {
     }
     const packages = new Map();
     for (const trace of traces) {
-        const document = readJsonEvidence(repositoryRoot, trace.absolute, trace.path).value;
+        const document = readJsonEvidence(repositoryRootIdentity, trace.absolute, trace.path).value;
         if (!(0, validation_js_1.isRecord)(document) ||
             document.version !== 1 ||
             !Array.isArray(document.files) ||
@@ -268,11 +410,13 @@ function createNextJsBuildOutputInventory(input) {
         }
         for (const [index, reference] of document.files.entries()) {
             const traced = addFile((0, node_path_1.resolve)((0, node_path_1.dirname)(trace.absolute), reference), `${trace.path}#files[${index}]`);
+            if (!traced)
+                continue;
             const packageRoot = packageRootForFile(traced.absolute);
             if (!packageRoot)
                 continue;
             const manifestPath = (0, node_path_1.join)(packageRoot, 'package.json');
-            const manifestFile = readJsonEvidence(repositoryRoot, manifestPath, `${trace.path}#files[${index}].package`);
+            const manifestFile = readJsonEvidence(repositoryRootIdentity, manifestPath, `${trace.path}#files[${index}].package`);
             const manifest = manifestFile.value;
             if (!(0, validation_js_1.isRecord)(manifest) ||
                 typeof manifest.name !== 'string' ||
@@ -282,20 +426,24 @@ function createNextJsBuildOutputInventory(input) {
                 throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', manifestFile.path, 'must identify one exact traced npm package');
             }
             const identity = `${manifest.name}@${manifest.version}`;
+            const rootIdentity = filesystemIdentity(packageRoot, manifestFile.path);
             const previous = packages.get(identity);
-            if (previous && previous.root !== packageRoot) {
+            if (previous &&
+                !sameFilesystemIdentity(previous.rootIdentity, rootIdentity)) {
                 throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', manifestFile.path, `contains ambiguous package bytes for ${identity}`);
             }
-            packages.set(identity, { manifest, root: packageRoot });
+            if (!previous) {
+                packages.set(identity, { manifest, root: packageRoot, rootIdentity });
+            }
         }
     }
     if (packages.size === 0) {
         throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'buildOutput.components', 'the final bundle trace contains no attributable npm package bytes');
     }
     const importerPath = repositoryRelativePath(repositoryRoot, input.importerManifestPath, 'importerManifestPath');
-    const importerManifest = readJsonEvidence(repositoryRoot, importerPath.absolute, 'importerManifestPath').value;
+    const importerManifest = readJsonEvidence(repositoryRootIdentity, importerPath.absolute, 'importerManifestPath').value;
     const includedByManifest = new Map([...packages].map(([identity, record]) => [
-        (0, node_fs_1.realpathSync)((0, node_path_1.join)(record.root, 'package.json')),
+        filesystemIdentityKey((0, node_fs_1.realpathSync)((0, node_path_1.join)(record.root, 'package.json')), 'buildOutput.components'),
         identity,
     ]));
     const directIdentity = new Map();
@@ -310,7 +458,7 @@ function createNextJsBuildOutputInventory(input) {
             const manifestPath = dependencyManifest((0, node_path_1.dirname)(importerPath.absolute), name);
             const identity = manifestPath === undefined
                 ? undefined
-                : includedByManifest.get(manifestPath);
+                : includedByManifest.get(filesystemIdentityKey(manifestPath, 'importerManifestPath'));
             if (identity)
                 directIdentity.set(identity, scope);
         }
@@ -328,7 +476,7 @@ function createNextJsBuildOutputInventory(input) {
                 const manifestPath = dependencyManifest(record.root, name);
                 const dependencyIdentity = manifestPath === undefined
                     ? undefined
-                    : includedByManifest.get(manifestPath);
+                    : includedByManifest.get(filesystemIdentityKey(manifestPath, `buildOutput.components.${identity}`));
                 if (dependencyIdentity) {
                     const dependency = packages.get(dependencyIdentity);
                     if (!dependency)
@@ -353,8 +501,8 @@ function createNextJsBuildOutputInventory(input) {
     let totalBytes = 0;
     const fileInventory = [...files.entries()]
         .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
-        .map(([path, absolute]) => {
-        const content = (0, node_fs_1.readFileSync)(absolute);
+        .map(([path, record]) => {
+        const content = (0, node_fs_1.readFileSync)(record.absolute);
         totalBytes += content.byteLength;
         if (totalBytes > MAX_TOTAL_BYTES) {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'buildOutput.files', 'exceeds the bounded build-output byte inventory');
@@ -365,14 +513,19 @@ function createNextJsBuildOutputInventory(input) {
             size: content.byteLength,
         };
     });
+    const linkInventory = [...links.values()].sort(({ path: left }, { path: right }) => (0, deterministic_order_js_1.compareUtf16)(left, right));
     const normalized = {
         artifactFamily: 'nextjs-build-output',
         artifactId: input.artifactId,
         candidateDigest: input.candidateDigest,
         components,
-        contentDigest: (0, common_js_1.supplyChainDigest)(fileInventory),
+        contentDigest: (0, common_js_1.supplyChainDigest)({
+            files: fileInventory,
+            links: linkInventory,
+        }),
         files: fileInventory,
         kind: exports.NEXTJS_BUILD_OUTPUT_INVENTORY_KIND,
+        links: linkInventory,
         schemaVersion: exports.NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION,
         sourceCommit: input.sourceCommit,
     };
@@ -386,7 +539,7 @@ function validateNextJsBuildOutputInventory(value, input) {
         value.kind !== exports.NEXTJS_BUILD_OUTPUT_INVENTORY_KIND ||
         value.schemaVersion !== exports.NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION ||
         typeof value.materialDigest !== 'string') {
-        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'buildOutput', 'must be an EBK Next.js build-output inventory v1');
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', 'buildOutput', 'must be an EBK Next.js build-output inventory v2');
     }
     const current = createNextJsBuildOutputInventory(input);
     if ((0, common_js_1.supplyChainDigest)(value) !== (0, common_js_1.supplyChainDigest)(current) ||

package/src/supply-chain/ecr-scanning.d.ts

@@ -6,9 +6,11 @@ export interface EcrInspectorScanTargetV1 {
     deploymentBindingDigest: string;
     imageDigest: string;
     region: string;
-    releaseId: string;
-    releaseManifestDigest: string;
-    releaseManifestMaterialDigest: string;
+    releaseCandidateArtifactDigest: string;
+    releaseCandidateArtifactId: string;
+    releaseCandidateDigest: string;
+    releaseCandidateProducerRunAttempt: string;
+    releaseCandidateProducerRunId: string;
     repositoryName: string;
     sbomDigest: string;
     sbomInventoryScope: 'final-oci-contents';

package/src/supply-chain/ecr-scanning.js

@@ -46,9 +46,11 @@ function validateTarget(value) {
         'deploymentBindingDigest',
         'imageDigest',
         'region',
-        'releaseId',
-        'releaseManifestDigest',
-        'releaseManifestMaterialDigest',
+        'releaseCandidateArtifactDigest',
+        'releaseCandidateArtifactId',
+        'releaseCandidateDigest',
+        'releaseCandidateProducerRunAttempt',
+        'releaseCandidateProducerRunId',
         'repositoryName',
         'sbomDigest',
         'sbomInventoryScope',
@@ -64,9 +66,11 @@ function validateTarget(value) {
         deploymentBindingDigest: reference(value.deploymentBindingDigest, 'target.deploymentBindingDigest', common_js_1.SUPPLY_CHAIN_SHA256),
         imageDigest: reference(value.imageDigest, 'target.imageDigest', IMAGE_DIGEST),
         region: reference(value.region, 'target.region', REGION),
-        releaseId: reference(value.releaseId, 'target.releaseId'),
-        releaseManifestDigest: reference(value.releaseManifestDigest, 'target.releaseManifestDigest', common_js_1.SUPPLY_CHAIN_SHA256),
-        releaseManifestMaterialDigest: reference(value.releaseManifestMaterialDigest, 'target.releaseManifestMaterialDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseCandidateArtifactDigest: reference(value.releaseCandidateArtifactDigest, 'target.releaseCandidateArtifactDigest', /^sha256:[a-f0-9]{64}$/),
+        releaseCandidateArtifactId: reference(value.releaseCandidateArtifactId, 'target.releaseCandidateArtifactId', /^[1-9]\d*$/),
+        releaseCandidateDigest: reference(value.releaseCandidateDigest, 'target.releaseCandidateDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseCandidateProducerRunAttempt: reference(value.releaseCandidateProducerRunAttempt, 'target.releaseCandidateProducerRunAttempt', /^[1-9]\d*$/),
+        releaseCandidateProducerRunId: reference(value.releaseCandidateProducerRunId, 'target.releaseCandidateProducerRunId', /^[1-9]\d*$/),
         repositoryName: reference(value.repositoryName, 'target.repositoryName', REPOSITORY),
         sbomDigest: reference(value.sbomDigest, 'target.sbomDigest', common_js_1.SUPPLY_CHAIN_SHA256),
         sbomInventoryScope: value.sbomInventoryScope === 'final-oci-contents'
@@ -309,7 +313,7 @@ function verifyEcrInspectorScanEvidence(value, expected) {
         value.kind !== 'ebk-ecr-inspector-scan-evidence' ||
         value.schemaVersion !== 1 ||
         value.status !== 'complete') {
-        fail('ecrScanEvidence', 'does not bind the exact expected release image and SBOM', 'supply-chain-artifact-mismatch');
+        fail('ecrScanEvidence', 'does not bind the exact expected release candidate, image, and SBOM', 'supply-chain-artifact-mismatch');
     }
     const { materialDigest, ...unsigned } = value;
     if (!common_js_1.SUPPLY_CHAIN_SHA256.test(materialDigest) ||

package/src/supply-chain/ecs-deployed-image.d.ts

@@ -10,9 +10,11 @@ export interface EcsDeployedImageExpectedV1 {
     deployment: EcsDeploymentSelectorV1;
     imageReference: string;
     region: string;
-    releaseId: string;
-    releaseManifestDigest: string;
-    releaseManifestMaterialDigest: string;
+    releaseCandidateArtifactDigest: string;
+    releaseCandidateArtifactId: string;
+    releaseCandidateDigest: string;
+    releaseCandidateProducerRunAttempt: string;
+    releaseCandidateProducerRunId: string;
     repositoryName: string;
     sourceCommit: string;
     stage: 'production' | 'staging';

package/src/supply-chain/ecs-deployed-image.js

@@ -43,9 +43,11 @@ function validateExpected(value) {
         deployment: validateDeploymentSelector(value.deployment, accountId, region),
         imageReference: expectedImageReference,
         region,
-        releaseId: exactReference(value.releaseId, 'expected.releaseId'),
-        releaseManifestDigest: exactReference(value.releaseManifestDigest, 'expected.releaseManifestDigest', common_js_1.SUPPLY_CHAIN_SHA256),
-        releaseManifestMaterialDigest: exactReference(value.releaseManifestMaterialDigest, 'expected.releaseManifestMaterialDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseCandidateArtifactDigest: exactReference(value.releaseCandidateArtifactDigest, 'expected.releaseCandidateArtifactDigest', /^sha256:[a-f0-9]{64}$/),
+        releaseCandidateArtifactId: exactReference(value.releaseCandidateArtifactId, 'expected.releaseCandidateArtifactId', /^[1-9]\d*$/),
+        releaseCandidateDigest: exactReference(value.releaseCandidateDigest, 'expected.releaseCandidateDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseCandidateProducerRunAttempt: exactReference(value.releaseCandidateProducerRunAttempt, 'expected.releaseCandidateProducerRunAttempt', /^[1-9]\d*$/),
+        releaseCandidateProducerRunId: exactReference(value.releaseCandidateProducerRunId, 'expected.releaseCandidateProducerRunId', /^[1-9]\d*$/),
         repositoryName,
         sourceCommit: exactReference(value.sourceCommit, 'expected.sourceCommit', COMMIT),
         stage: value.stage === 'production' || value.stage === 'staging'
@@ -187,7 +189,7 @@ function repositoryFromImage(image, expected) {
 }
 function environmentMap(value) {
     if (!Array.isArray(value)) {
-        return fail('taskDefinition.containerDefinitions[0].environment', 'must retain exact release identity environment values', 'supply-chain-artifact-mismatch');
+        return fail('taskDefinition.containerDefinitions[0].environment', 'must retain exact release-candidate identity environment values', 'supply-chain-artifact-mismatch');
     }
     const result = new Map();
     for (const [index, entry] of value.entries()) {

package/src/supply-chain/generated-blueprint-trust-command.js

@@ -774,9 +774,26 @@ function preflightRetainedReceiptPaths(paths) {
   }
 }
 
+function serializeRetainedReceipt(receipt) {
+  let output = JSON.stringify(receipt, null, 2);
+  // These are the receipt schema's only primitive-array fields. Match the
+  // generated JSON format without loading mutable workspace formatter code or
+  // configuration in this protected execution child. Object arrays stay multiline.
+  for (const field of ['containerRegistries', 'verificationRoots']) {
+    const values = receipt[field];
+    const compact = '  ' + JSON.stringify(field) + ': [' +
+      values.map((value) => JSON.stringify(value)).join(', ') + ']';
+    if (compact.length + 1 <= 80) {
+      const expanded = JSON.stringify({ [field]: values }, null, 2).slice(2, -2);
+      output = output.replace(expanded, compact);
+    }
+  }
+  return output + '\n';
+}
+
 function writeRetainedReceipts(receipts) {
   const prepared = receipts.map(({ reference, receipt }) => {
-    const output = JSON.stringify(receipt, null, 2) + '\n';
+    const output = serializeRetainedReceipt(receipt);
     if (Buffer.byteLength(output, 'utf8') > MAX_OUTPUT_BYTES) {
       throw receiptRetentionError(
         'Blueprint verification receipt exceeds 256 KiB.',

package/src/supply-chain/generated-command.js

@@ -260,6 +260,7 @@ const ignoredDirectories = new Set([
   '.nx',
   '.open-next',
   '.sst',
+  '.venv',
   'coverage',
   'dist',
   'node_modules',