export function deterministicSupplyChainGeneratedAt(input: Readonly<{
  generatedAt: string;
  sourceDateEpoch: string | null;
}>): string {
  const generatedAtMs = Date.parse(input.generatedAt);
  if (!Number.isFinite(generatedAtMs)) {
    throw new TypeError("build manifest generatedAt must be an ISO timestamp");
  }
  if (input.sourceDateEpoch !== null) {
    if (!/^(?:0|[1-9]\d*)$/u.test(input.sourceDateEpoch)) {
      throw new TypeError("SOURCE_DATE_EPOCH must be whole seconds");
    }
    const epoch = Number(input.sourceDateEpoch);
    if (
      !Number.isSafeInteger(epoch) ||
      new Date(epoch * 1000).toISOString() !== input.generatedAt
    ) {
      throw new TypeError(
        "build manifest generatedAt must match SOURCE_DATE_EPOCH",
      );
    }
  }
  return new Date(generatedAtMs).toISOString();
}