@xemahq/xema 0.53.0 → 0.55.0

package/edition/develop-snapshot-inputs.mjs

@@ -17,6 +17,7 @@
 
 import { execFileSync } from 'node:child_process';
 
+import { RefusalError } from './collected-refusals.mjs';
 import { dataRoot, deployRoot, editionsRoot, kernelRepoDir, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
 import { buildIndexesAtPins } from './indexes-at-pins.mjs';
 import {
@@ -45,14 +46,14 @@ function git(dir, args) {
  */
 export function assertFrozenCheckout({ dir, pins, key }) {
   const pinned = pins[key];
-  if (pinned === undefined) {throw new Error(`the snapshot has no pin "${key}" for ${dir}`);}
+  if (pinned === undefined) {throw new RefusalError(`the snapshot has no pin "${key}" for ${dir}`);}
   const head = git(dir, ['rev-parse', 'HEAD']);
   if (head !== pinned) {
-    throw new Error(`${dir} is at ${head}, but the snapshot pins "${key}" at ${pinned}`);
+    throw new RefusalError(`${dir} is at ${head}, but the snapshot pins "${key}" at ${pinned}`);
   }
   const dirty = git(dir, ['status', '--porcelain']);
   if (dirty.length > 0) {
-    throw new Error(`${dir} is not clean, so it is not the frozen commit ${pinned} ("${key}"):\n${dirty}`);
+    throw new RefusalError(`${dir} is not clean, so it is not the frozen commit ${pinned} ("${key}"):\n${dirty}`);
   }
 }
 

package/edition/develop-verify-image-record.mjs

@@ -58,8 +58,28 @@ function producerMember(producer) {
  * @param {string} request.registry the registry root that holds `build-records/<repo>`
  * @returns {Promise<{image: string, digest: string, producer: string, commit: string}>}
  */
-export async function verifyImageRecord({ image, producer, registry, dataRootRepositoryUrl, kernel, clientFor, runCosign, cosignEnvFor, trustedRootPath }) {
+export async function verifyImageRecord({ image, producer, ...verifier }) {
   const { name, digest } = parseImageReference(image);
+  const record = await findVerifiedProducerImageRecord({
+    producer,
+    ...verifier,
+    wanted: `lists ${name}@${digest}`,
+    matches: (candidate) => candidate.images.some((listed) => listed.name === name && listed.digest === digest),
+  });
+  return { image: name, digest, producer, commit: record.commit };
+}
+
+/**
+ * The newest verified develop ci.yaml record of `producer` (newest run first) for which `matches(record)` holds.
+ * Every record read on the way is cosign-verified, so a newer bad record refuses before an older one is read.
+ * Refused, naming `wanted`, when no verified ci.yaml record matches.
+ *
+ * @param {object} request
+ * @param {string} request.producer `<owner>/<repo>`
+ * @param {(record: object) => boolean} request.matches
+ * @param {string} request.wanted what a match is, for the refusal ("lists <name>@<digest>")
+ */
+export async function findVerifiedProducerImageRecord({ producer, matches, wanted, registry, dataRootRepositoryUrl, kernel, clientFor, runCosign, cosignEnvFor, trustedRootPath }) {
   const member = producerMember(producer);
   const branch = VERIFY_IMAGE_RECORD_BRANCH;
   const { repository, authority, client, runs } = await listBuildRecordRuns({ kernel, clientFor, registry, member, branch });
@@ -69,10 +89,9 @@ export async function verifyImageRecord({ image, producer, registry, dataRootRep
       repository, member, branch, dataRootRepositoryUrl, tag,
     });
     if (record.producer.workflow !== PRODUCER_IMAGE_WORKFLOW) {continue;}
-    if (!record.images.some((listed) => listed.name === name && listed.digest === digest)) {continue;}
-    return { image: name, digest, producer, commit: record.commit };
+    if (matches(record)) {return record;}
   }
-  throw new RecordRefused(producer, `no verified ${PRODUCER_IMAGE_WORKFLOW} build record of ${repository} for branch ${branch} lists ${name}@${digest}`);
+  throw new RecordRefused(producer, `no verified ${PRODUCER_IMAGE_WORKFLOW} build record of ${repository} for branch ${branch} ${wanted}`);
 }
 
 /** The `verify-image-record` verb. */

package/edition/dist-check.mjs

@@ -50,6 +50,7 @@ import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import { describeEditionHolds } from './edition-source-pins.mjs';
 import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, dataRoot, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath, workspaceArgv } from './edition-workspace.mjs';
 import { checkEvidenceTrustPolicy } from './evidence-trust-policy.mjs';
+import { imageSubjectIdentity } from './image-subject-identity.mjs';
 import {
   compareIndexEntries,
   comparableDistributionLock,
@@ -58,6 +59,7 @@ import {
   loadKernelDistributionSchemas,
   parseResolvedDistributionLock,
   serializeJson,
+  sha256Hex,
   validateImmutableBiomeIndex,
   validateImmutableDistributionLock,
   validateImmutableImageLock,
@@ -69,6 +71,8 @@ import {
   resolveDistributionDeclaredSources,
   resolveDistributionRequiredPlatforms,
   externalSourceTrees,
+  carryComposedForwardStructurally,
+  readCommittedPreviousLock,
   resolveImages,
   resolveComposedProcessStructure,
   resolveImageStructure,
@@ -237,6 +241,24 @@ async function checkAuthorizationLock(id, kernel, index) {
  * with the same structure ship the same images and bundle the same web biomes,
  * regardless of current source content (which the build re-hashes anyway).
  */
+/**
+ * The committed lock with a stand-in `imageDigest` on every UNSEALED composed artifact, so the kernel can carry it forward.
+ * The kernel's v5 parse refuses two composed artifacts sharing one imageDigest, so each stand-in is unique to its subject:
+ * the sha256 of its identity (`imageSubjectIdentity`: `composed-process:<imageRef>:<contentHash>`, unique per lock).
+ * It equals a real manifest digest only by a sha256 preimage, and it never reaches a verdict: both sides of every
+ * comparison drop `imageDigest` (`withoutSealedDigests`).
+ */
+export function withStandInDigests(lock, schemas) {
+  return {
+    ...lock,
+    subjects: lock.subjects.map((subject) =>
+      subject.kind === schemas.RuntimeImageSubjectKind.ComposedProcess && subject.imageDigest === undefined
+        ? { ...subject, imageDigest: `sha256:${sha256Hex(imageSubjectIdentity(subject))}` }
+        : subject,
+    ),
+  };
+}
+
 function imageStructure(lock) {
   return serializeJson({
     distributionId: lock.distributionId,
@@ -315,12 +337,6 @@ export async function checkImagesLock(id, checkSourceEvidence) {
       schemas,
       requiredPlatforms,
     );
-    const fresh = {
-      distributionId: id,
-      contractAuthority: runtimeSourceIndex.contractAuthority,
-      ...structure,
-      subjects: structureSubjects(structure),
-    };
     if (!existsSync(imageLockPath)) {
       console.error(
         `[dist:check] ${id}: images.lock.json is missing. Run \`${commandFor('resolve-images.mjs', id)}\`.`,
@@ -328,9 +344,29 @@ export async function checkImagesLock(id, checkSourceEvidence) {
       return false;
     }
     const committed = validateImmutableImageLock(
-      schemas.parseImageLock(JSON.parse(readFileSync(imageLockPath, 'utf8'))),
+      (await readCommittedPreviousLock(id, imageLockPath)),
       schemas,
     );
+    // The committed lock is the previous lock of the fresh resolve, so the fresh view carries the composed artifacts forward
+    // exactly as a reseal does (generation, member keys, one artifact per live generation). Its digests are compared away
+    // below, so a committed lock that predates sealing is given one stand-in digest per subject to be carried.
+    const previousLock = withStandInDigests(committed, schemas);
+    let freshSubjects;
+    try {
+      freshSubjects = carryComposedForwardStructurally({ subjects: structureSubjects(structure), previousLock, schemas });
+    } catch (error) {
+      console.error(
+        `[dist:check] ${id}: images.lock.json is structurally out of date (its composed artifacts do not cover the declared composed processes: ${error.message}). ` +
+          `Run \`${commandFor('resolve-images.mjs', id)}\`.`,
+      );
+      return false;
+    }
+    const fresh = {
+      distributionId: id,
+      contractAuthority: runtimeSourceIndex.contractAuthority,
+      ...structure,
+      subjects: freshSubjects,
+    };
     if (
       serializeJson(committed.contractAuthority) !==
       serializeJson(runtimeSourceIndex.contractAuthority)
@@ -350,12 +386,12 @@ export async function checkImagesLock(id, checkSourceEvidence) {
       return false;
     }
     if (checkSourceEvidence) {
-      const { imageLock: sourceResolved } = await resolveImages(id);
+      const { imageLock: sourceResolved } = await resolveImages(id, { previousLock });
       // The same subtraction as the structural view above: the source resolve
       // carries no digest, and the committed lock may.
       if (
         normalize(withoutSealedDigests(committed)) !==
-        normalize(sourceResolved)
+        normalize(withoutSealedDigests(sourceResolved))
       ) {
         console.error(
           `[dist:check] ${id}: images.lock.json source content hashes are out of date. ` +

package/edition/distribution-evidence-set.mjs

@@ -56,6 +56,7 @@ import {
   sha256Digest,
   sourceIdentity,
 } from './image-evidence.mjs';
+import { completenessImageKey } from './image-subject-identity.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import { compareStrings } from './lib.mjs';
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
@@ -133,7 +134,7 @@ export { compareCompletenessImages as compareEvidenceSubjects };
  * Keyed by the same `kind\0id` identity `image-evidence.mjs` uses everywhere
  * else, so two subjects can never collide and one subject can never move.
  */
-function subjectStem(subject) {
+export function subjectStem(subject) {
   return createHash('sha256')
     .update(sourceIdentity(subject))
     .digest('hex');
@@ -315,10 +316,9 @@ function indexOneEvidenceDirectory({
       });
       continue;
     }
-    const subjectKey = sourceIdentity({
-      kind: entry.subjectKind,
-      id: entry.subjectId,
-    });
+    // Only named in a defect: the record is indexed by the statement's own source coordinate, which already
+    // tells the generations of a composed artifact apart (its sourceTreeHash).
+    const subjectKey = `${entry.subjectKind}:${entry.subjectId}`;
     const descriptor = entry.evidence;
     let statementBytes;
     let bundleBytes;
@@ -691,12 +691,17 @@ export function buildDistributionImagesStatement({
   // Refusing here as well means an incomplete set can never be SIGNED, rather
   // than being signed and rejected days later at a customer install.
   const expectedIdentities = imageLock.subjects
-    .map((subject) => sourceIdentity(subject))
+    .map((subject) =>
+      completenessImageKey({
+        subjectKind: subject.kind,
+        subjectId: subject.id,
+        imageRepository: subject.imageRef,
+        manifestDigest: subject.imageDigest,
+      }),
+    )
     .sort(compareStrings);
   const actualIdentities = images
-    .map((image) =>
-      sourceIdentity({ kind: image.subjectKind, id: image.subjectId }),
-    )
+    .map((image) => completenessImageKey(image))
     .sort(compareStrings);
   if (
     new Set(actualIdentities).size !== actualIdentities.length ||

package/edition/edition-artifact.mjs

@@ -290,7 +290,7 @@ export function canonicalSourceImages(sourceImages = new Map()) {
 }
 
 /**
- * The tag of an edition resolved from a snapshot (a develop edition, a customer release edition): sha256 of the canonical `{ cli, engine, pins, sourceImages }`. Every input of
+ * The tag of an edition resolved from a snapshot (a develop edition, a customer release edition): sha256 of the canonical `{ cli, engine, pins, sourceImages }`, plus `imageBuildRecord` (the record's digest) for a develop resolve --images-from. Every input of
  * the bytes the artifact records is inside it. The pins fix the locks and the descriptor's pins: a vendor edition's
  * commits fix its definitions; a customer edition's pins carry its sources' commits, the catalogue digest and the
  * digest of its canonical definition (`definition`: vendor selection, image registry mirror, Store publisher anchors); the
@@ -300,25 +300,35 @@ export function canonicalSourceImages(sourceImages = new Map()) {
  * only refuse the existing one (`check-existing`) or reuse a stale one. `provenance.workflow` (the run that
  * wrote the bytes) is the one recorded field outside it: a fact about the artifact, not an input to it.
  */
-export function snapshotEditionTag({ pins, engineImage, sourceImages = new Map(), version = cliVersion() }) {
+export function snapshotEditionTag({ pins, engineImage, sourceImages = new Map(), imageBuildRecordDigest, version = cliVersion() }) {
   return sha256Hex(
     serializeJson({
       cli: version,
       engine: assertEngineImage(engineImage),
       pins: sortedSnapshotPins(pins),
       sourceImages: canonicalSourceImages(sourceImages),
+      // A develop resolve from an image build record (--images-from): the record fixes the image rows, and a satellite
+      // digest changes independently of the pins. Absent on the probe path, whose tag inputs are unchanged.
+      ...(imageBuildRecordDigest === undefined ? {} : { imageBuildRecord: assertImageBuildRecordDigest(imageBuildRecordDigest) }),
     }),
   );
 }
 
+function assertImageBuildRecordDigest(digest) {
+  if (typeof digest !== 'string' || !/^[0-9a-f]{64}$/.test(digest)) {
+    throw new Error(`an image build record digest must be 64 lowercase hex; got ${JSON.stringify(digest)}`);
+  }
+  return digest;
+}
+
 /** The target of an edition resolved from a snapshot of pins, on either channel: the tag is `snapshotEditionTag`. */
-export function snapshotEditionTarget(channel, distributionId, pins, { registry, engineImage, sourceImages }) {
-  return editionTarget(distributionId, registry, channel, snapshotEditionTag({ pins, engineImage, sourceImages }));
+export function snapshotEditionTarget(channel, distributionId, pins, { registry, engineImage, sourceImages, imageBuildRecordDigest }) {
+  return editionTarget(distributionId, registry, channel, snapshotEditionTag({ pins, engineImage, sourceImages, imageBuildRecordDigest }));
 }
 
-/** A develop edition's target: the tag is `snapshotEditionTag` of the pins, the engine and the source images. */
-export function developEditionTarget(distributionId, pins, { registry, engineImage, sourceImages }) {
-  return snapshotEditionTarget(EditionChannel.Develop, distributionId, pins, { registry, engineImage, sourceImages });
+/** A develop edition's target: the tag is `snapshotEditionTag` of the pins, the engine, the source images and any image build record. */
+export function developEditionTarget(distributionId, pins, { registry, engineImage, sourceImages, imageBuildRecordDigest }) {
+  return snapshotEditionTarget(EditionChannel.Develop, distributionId, pins, { registry, engineImage, sourceImages, imageBuildRecordDigest });
 }
 
 function realpathOfPlanned(path) {

package/edition/edition-image-seal.mjs

@@ -19,6 +19,7 @@ import { developImageRef } from './develop-image-coordinate.mjs';
 import { notBuiltYetError } from './develop-image-probe.mjs';
 import { EditionChannel } from './edition-channel.mjs';
 import { editionsRoot } from './edition-workspace.mjs';
+import { imageSubjectIdentity } from './image-subject-identity.mjs';
 import { validateImmutableImageLock, loadKernelDistributionSchemas, } from './lib.mjs';
 import { isNotPublishedYet, planDigestSeal } from './seal-image-digests.mjs';
 import { imageSubjectKey, pinnedManifestDigests, thirdPartyImagePins } from './third-party-image-pins.mjs';
@@ -86,7 +87,7 @@ export async function sealImageSubjects({
   const digests = new Map([...writes, ...unchanged].map(({ key, digest }) => [key, digest]));
   return channelSubjects.map((subject) => ({
     ...subject,
-    imageDigest: digests.get(`${subject.kind}:${subject.id}`),
+    imageDigest: digests.get(imageSubjectIdentity(subject)),
   }));
 }
 

package/edition/edition-protocol.mjs

@@ -26,28 +26,17 @@
 
 import { realpathSync } from 'node:fs';
 
+import { RefusalError } from './collected-refusals.mjs';
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 
 /** The edition protocols this library interprets: version -> content digest. A protocol is listed only
- * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`):
- * v27 and older kernels lack `serviceImageSubjects` (first exported by the v28 kernel), so they are not listed.
- * No published kernel declares v29 (0.110.2 is v28, 0.110.3 is v30, 0.111.0 is v31, XEMA-2070 kernel is v32; v33 is the kernel's
- * bundle-signer protocol (`bundleSigner` on every OCI bundle row); v34 is the kernel's output-mapping, JSON Pointer and
- * handoff-repair-turns closure additions (XEMA-2122); v35 is the kernel's independent releases on a resolved deployment (XEMA-2244);
- * v36 is the kernel's JobFailureReason workflow closure addition (XEMA-2282);
- * v37 is the kernel's DistributionLock.catalogueContentDigest and effective-timeout wording (XEMA-2254, XEMA-2282); v38 is the kernel's optionalPeers service-manifest field (XEMA-2315); v33 to v38 are not yet published: their identities and contracts are captured from the
- * linked kernel), so v29 is not listed either. */
+ * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`).
+ * Only v45 is listed (contracts 0.119.0: image-lock v5, build record `members`, and an idempotent
+ * `carryForwardComposedArtifacts`). A v44 kernel's carry-forward bumps the generation on every call, so dist-check could never
+ * be green on its seals; v43 cannot carry build record members; v42 and older lack `DEFAULT_COMPOSED_IMAGE_CLASS` and
+ * `dedicatedServiceImageSubjects`. No legacy row is kept. */
 export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
-  Object.freeze({ version: 28, contentDigest: 'f7795478b1bfe9a41bcbea9efe496011fcd209a56c90294029a08801e84cf92c' }),
-  Object.freeze({ version: 30, contentDigest: '91e3cdff255778b5aa94b64ca9316d031be549ead2267a9a9311ff06d4f1db2c' }),
-  Object.freeze({ version: 31, contentDigest: 'b2026847fdd202e7b9e05815cdc2c9819b60be7007c789cc5b5f291c9c682fdd' }),
-  Object.freeze({ version: 32, contentDigest: 'a4ca824486052ca7f61b9a68f759b798defb620b6b3e9cbaab2c701bee2c6700' }),
-  Object.freeze({ version: 33, contentDigest: 'b070713e7abeeefad6da3a9053843b0f7420a466f6d504f60aaa00ef196b2b05' }),
-  Object.freeze({ version: 34, contentDigest: '370ceef5956d66035265ddbf7b9c46aa686cd10c1e95171c806c0d590ef5f49c' }),
-  Object.freeze({ version: 35, contentDigest: '3e616e532c45ecbd6277dde31c0d9c12a12139abe06cc0f56329d1ffe9813f8d' }),
-  Object.freeze({ version: 36, contentDigest: 'b6b0c8ec3fc4182c6c3b623685af6293cfed1321f8d7c1891a83652d864c3df0' }),
-  Object.freeze({ version: 37, contentDigest: 'f10adca1ca5b6f51f3971756261032eeddd60e372ebfcff06a2a9d8a796d0fef' }),
-  Object.freeze({ version: 38, contentDigest: 'f670cb922c989fd40ac03703a612e7a6df2937233a1a20a394a859ec835d47d4' }),
+  Object.freeze({ version: 45, contentDigest: '54eb2f7d40e966e6efd5bc2ef0f4751b1121786300f4c50066e8add10c3ecb6a' }),
 ]);
 
 /** Where a kernel package publishes its identity and its contract, package-relative. */
@@ -86,7 +75,7 @@ export const EditionProtocolMismatchReason = Object.freeze({
   NotOnDevelop: 'not-on-develop',
 });
 
-export class EditionProtocolMismatchError extends Error {
+export class EditionProtocolMismatchError extends RefusalError {
   constructor(reason, message) {
     super(message);
     this.name = 'EditionProtocolMismatchError';

package/edition/image-evidence.mjs

@@ -20,6 +20,7 @@ import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs'
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { effectiveRepositoryPins, manifestSourcePins } from './edition-source-pins.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
+import { evidenceSubjectKey } from './image-subject-identity.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import {
   compareStrings,
@@ -165,7 +166,7 @@ export function assertProducerTtlCeiling({ issuedAt, expiresAt, maxTtlSeconds, l
 }
 
 export function sourceIdentity(subject) {
-  return `${subject.kind}\0${subject.id}`;
+  return evidenceSubjectKey(subject);
 }
 
 /** Root of the committed evidence tree, in every producing repository. */
@@ -424,7 +425,10 @@ export function validateProducerStatementBinding({
 export function compareCompletenessImages(left, right) {
   return (
     compareStrings(left.subjectKind, right.subjectKind) ||
-    compareStrings(left.subjectId, right.subjectId)
+    compareStrings(left.subjectId, right.subjectId) ||
+    // The generations of one composed artifact share kind and id: they order by image, then manifest.
+    compareStrings(left.imageRepository, right.imageRepository) ||
+    compareStrings(left.manifestDigest, right.manifestDigest)
   );
 }
 

package/edition/image-lock-service-rows.mjs

@@ -13,14 +13,14 @@ function isOwnedByBiome(subject, biomeId, enums) {
 /**
  * The subject carrying the image of `kind:id` for the biome `biomeId`, or undefined.
  * A service is served by (a) a Service subject with that id owned by the biome, or (b) a subject owned by the biome
- * whose `members[]` names the service. The member-to-subject step is the kernel's `serviceImageSubjects`
- * (`enums.serviceImageSubjects`), the same rule the launcher's `loadImageLock` applies; this file adds only the
+ * whose `members[]` names the service. The member-to-subject step is the kernel's `dedicatedServiceImageSubjects`
+ * (`enums.dedicatedServiceImageSubjects`), applied to the lock's `schemaVersion` and the biome's subjects; the same rule the launcher's `loadImageLock` applies; this file adds only the
  * biome-owner filter. The biome's own `services` list supplies `id`.
  */
-export function subjectServingBiome(subjects, biomeId, kind, id, enums) {
+export function subjectServingBiome(schemaVersion, subjects, biomeId, kind, id, enums) {
   const owned = subjects.filter((subject) => isOwnedByBiome(subject, biomeId, enums));
   if (kind !== enums.RuntimeImageSubjectKind.Service) {
     return owned.find((subject) => subject.kind === kind && subject.id === id);
   }
-  return enums.serviceImageSubjects(owned).get(id);
+  return enums.dedicatedServiceImageSubjects({ schemaVersion, subjects: owned }).get(id);
 }

package/edition/image-subject-identity.mjs

@@ -0,0 +1,24 @@
+// The identity of a subject of an images lock, as the kernel's image-lock v5 uniqueness rule defines it
+// (`parseImageLock`): a subject is `kind:id`, except a composed-process ARTIFACT, which is `imageRef:contentHash` — the
+// generations of one composed artifact share one id and differ by that coordinate. Every map keyed by subject (digest
+// plans, the seal, the lock validation) uses this one function, so two live generations never collapse onto one key.
+
+const COMPOSED_PROCESS_KIND = 'composed-process';
+
+/** The printable identity of a lock subject (or of a verification entry carrying `kind`, `id`, `imageRef`, `contentHash`). */
+export function imageSubjectIdentity({ kind, id, imageRef, contentHash }) {
+  return kind === COMPOSED_PROCESS_KIND ? `${kind}:${imageRef}:${contentHash}` : `${kind}:${id}`;
+}
+
+/**
+ * The key of a subject in the evidence lane: `kind\0id` for every kind but a composed-process artifact, which is its
+ * `imageSubjectIdentity` (so two live generations of one composed artifact get distinct producer stems and index keys).
+ */
+export function evidenceSubjectKey({ kind, id, imageRef, contentHash }) {
+  return kind === COMPOSED_PROCESS_KIND ? imageSubjectIdentity({ kind, id, imageRef, contentHash }) : `${kind}\0${id}`;
+}
+
+/** The key of one image of a completeness statement, which names its image by repository and manifest digest, not by content hash. */
+export function completenessImageKey({ subjectKind, subjectId, imageRepository, manifestDigest }) {
+  return subjectKind === COMPOSED_PROCESS_KIND ? `${subjectKind}:${imageRepository}@${manifestDigest}` : `${subjectKind}\0${subjectId}`;
+}