@xemahq/xema 0.59.0 → 0.60.1

package/edition/assemble-producer-input.mjs

@@ -1,1414 +0,0 @@
-#!/usr/bin/env node
-// assemble-producer-input — producer-input assembly for detached image-source
-// evidence.
-//
-//   xema edition evidence assemble-input \
-//     --output <absolute-path> \
-//     --image-repository <registry>/<namespace>/<service> \
-//     --manifest-digest sha256:<64-hex> \
-//     --subject-kind service --subject-id <service> \
-//     --source-repo repos/<repo> \
-//     --source-path repos/<repo>/<biome-or-package-path> \
-//     --source-commit <40-hex> \
-//     --provenance <absolute-predicate-json> \
-//     [--ttl-seconds <1..policy-max>] \
-//     [--source-manifest-hash <64-hex>] [--source-tree-hash <64-hex>]
-//
-// Emits the EXACT producer input manifest `produce-image-source-evidence.mjs`
-// accepts. The assembled manifest is validated with the producer's own gates —
-// `assertProducerInput`, the full kernel statement schema, and (from the
-// GITHUB_* environment) `assertGitHubProducerContext` — BEFORE it is written:
-// the assembler never emits a manifest the producer would reject.
-//
-// Field derivation:
-//   * contractAuthority   — the verifier-embedded kernel contract authority
-//                           (single source of truth; the offline verifier only
-//                           ever accepts that exact object).
-//   * sourceHashAlgorithm — read from `@xemahq/distribution-source-hash` via
-//                           lib.mjs `imageInputSourceHashAlgorithm()` — the one
-//                           algorithm an image lock may name.
-//   * producerWorkflowSha — GITHUB_SHA of the running producer workflow.
-//   * signer              — derived from the running workflow's context:
-//                           certificateIdentity is exactly
-//                           https://github.com/<repo>/<workflow-path>@<ref>.
-//   * builder             — builderId is the building workflow; buildType and
-//                           the definition/parameters digests are read off the
-//                           BuildKit SLSA v1 predicate the build exported
-//                           (`--provenance`) — the same bytes the workflow
-//                           cosign-attests, so the evidence cannot describe a
-//                           different build than the one that ran.
-//   * sourceManifestHash  — the kernel computeBiomeSourceManifestHash of the git-blob-at-commit,
-//                           the exact runtime-image-source-index algorithm
-//                           (lib.mjs `readGitJsonAtCommit` + `serializeJson`).
-//   * sourceTreeHash      — computed here with lib.mjs `hashImageBuildInputs`
-//                           under `imageInputSourceHashAlgorithm()` — the SAME
-//                           functions and package the lock resolver and every
-//                           producer's `compute-image-tag.mjs` use. The request
-//                           is reconstructed exactly as the producing build saw
-//                           it: the service directory comes from the subject's
-//                           own manifest at the build commit
-//                           (resolve-images `subjectServicePath`), and the
-//                           vendored cross-repo inputs + build-step directories
-//                           come from the producing checkout's committed
-//                           `tooling/release/cross-repo-build-inputs.json` AT
-//                           THAT COMMIT — never the live distribution index,
-//                           which may already pin newer source revisions.
-//   * manifestDigest cross-check, manifestMediaType, platforms — read from the
-//     registry with the fail-closed OCI client at the canonical
-//     `<imageRepository>:<sourceTreeHash>` coordinate: the digest served there
-//     must be exactly the caller's `--manifest-digest`, and platforms are
-//     proven by their hash-verified image configs (verify-image-platforms
-//     `resolvePublishedPlatforms`).
-//   * sbomDigest, provenanceDigest — the cosign attestation artifacts the
-//     producing workflow attached to the delivered manifest digest: the
-//     `sha256-<digest>.att` manifest's DSSE envelope layers, classified by
-//     their `predicateType` annotation and bound to the delivered digest
-//     through their decoded in-toto statement subject. A missing attestation
-//     fails fast naming the cosign `--type` flag that emits it.
-//     MULTIPLICITY IS EXPECTED: a multi-arch index is the product of one
-//     build per platform, and lanes attest accordingly — one SLSA + one SBOM
-//     attestation per architecture, all bound to the index digest (plus
-//     further copies whenever a lane re-runs, because cosign attest APPENDS).
-//     The assembler therefore selects ONE deterministic witness per type:
-//     the provenance layer whose statement names the PRIMARY build's own
-//     builder id + invocation id (the identity of the caller's `--provenance`
-//     predicate, so the statement's artifact section and build section
-//     describe the SAME build), and — no caller-side SBOM reference exists —
-//     the smallest SBOM layer digest. A subject with no layer describing the
-//     primary build fails fast.
-//
-// The runtime image source index, the registry credential declaration and the
-// declared trust policy are read from the data root (`--data-root`), and the
-// subject's source objects from the source checkouts under `--sources-root`
-// at their aggregator-relative paths.
-//
-// Registry credentials come from image-registry-credentials.json (the file
-// names environment variables, never secrets).
-
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-
-import { editionWorkspaceConfig } from './edition-config.mjs';
-import {
-  WorkspaceRoot,
-  configureEditionWorkspaceFromArgv,
-  dataRoot,
-  isEntryModule,
-  sourcePath as sourceCheckoutPath,
-} from './edition-workspace.mjs';
-import { COMMIT_PATTERN, GITHUB_REF_PATTERN, GITHUB_REPOSITORY_PATTERN, SHA256_DIGEST_PATTERN, SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
-import { firstPartySourceId } from './first-party-source-ids.mjs';
-import { canonicalJson } from './image-evidence.mjs';
-import { oidcCertificateSignerKind } from './kernel-signer-kind.mjs';
-import {
-  assertGitCommitExists,
-  compareStrings,
-  hashImageBuildInputs,
-  imageInputSourceHashAlgorithm,
-  loadKernelDistributionSchemas,
-  readGitJsonAtCommit,
-  serializeJson,
-  sha256Hex,
-} from './lib.mjs';
-import { OrasRegistry } from './oras.mjs';
-import { assertGitHubProducerContext, assertProducerInput, buildImageSourceStatements, readPinnedContractAuthority, sandboxedGit } from './produce-image-source-evidence.mjs';
-import {
-  loadRegistryCredentialDeclarations,
-  resolveRegistryCredential,
-  splitImageRef,
-} from './registry-credentials.mjs';
-import {
-  COMPOSED_PROCESS_DECLARATION_FILE,
-  COMPOSED_PROCESS_IMAGE_PATH,
-  composedProcessSubjectId,
-  subjectServicePath,
-} from './resolve-images.mjs';
-import {
-  platformIdentity,
-  resolvePublishedPlatforms,
-} from './verify-image-platforms.mjs';
-
-const SOURCE_REPO_PATTERN = /^(?:repos|submodules)\/[a-zA-Z0-9_.-]+$/;
-// The kernel's `CanonicalIdentifierSchema` shape (runId / subject id).
-const CANONICAL_IDENTIFIER_PATTERN =
-  /^[a-zA-Z0-9](?:[a-zA-Z0-9._:/@+-]{0,254}[a-zA-Z0-9])?$/;
-/** `--subject-id` has the kernel's `CanonicalIdentifierSchema` shape. */
-export function assertCanonicalSubjectId(subjectId) {
-  if (!CANONICAL_IDENTIFIER_PATTERN.test(subjectId ?? '')) {
-    throw new Error(`--subject-id ${JSON.stringify(subjectId ?? null)} is not a canonical identifier`);
-  }
-}
-
-// cosign v2 attaches every attestation of a subject as one layer of the
-// single `sha256-<subject-digest>.att` manifest; each layer is a DSSE
-// envelope whose `predicateType` annotation names the attestation.
-const ATTESTATION_TAG_SUFFIX = '.att';
-const DSSE_ENVELOPE_LAYER_MEDIA_TYPE = 'application/vnd.dsse.envelope.v1+json';
-const IN_TOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json';
-const PREDICATE_TYPE_ANNOTATION = 'predicateType';
-const SBOM_PREDICATE_TYPE = 'https://spdx.dev/Document';
-const PROVENANCE_PREDICATE_TYPE = 'https://slsa.dev/provenance/v1';
-// The third mandatory deploy predicate (see the producing workflows). It
-// legitimately shares the `.att` manifest but occupies no producer-input slot.
-const DEPLOY_SOURCE_PREDICATE_TYPE =
-  'https://xema.dev/attestations/deploy-source/v1';
-const MAX_ATTESTATION_LAYER_BYTES = 64 * 1024 * 1024;
-// The vendoring record the producing workflow consumed — committed in the
-// producing repository, read AT THE BUILD COMMIT (see header).
-const CROSS_REPO_RECORD_PATH = 'tooling/release/cross-repo-build-inputs.json';
-
-function canonicalRelativePath(value, label) {
-  if (
-    typeof value !== 'string' ||
-    value.length === 0 ||
-    value !== value.normalize('NFC') ||
-    value.startsWith('/') ||
-    value.endsWith('/') ||
-    value
-      .split('/')
-      .some((segment) => segment === '' || segment === '.' || segment === '..')
-  ) {
-    throw new Error(
-      `${label} must be an NFC-normalized repository-relative path without traversal`,
-    );
-  }
-  return value;
-}
-
-export function assertWorkflowContext(env) {
-  const repository = env.GITHUB_REPOSITORY;
-  const ref = env.GITHUB_REF;
-  const sha = env.GITHUB_SHA;
-  const workflowRef = env.GITHUB_WORKFLOW_REF;
-  if (!GITHUB_REPOSITORY_PATTERN.test(repository ?? '')) {
-    throw new Error('GITHUB_REPOSITORY is not an exact owner/repo slug');
-  }
-  if (!GITHUB_REF_PATTERN.test(ref ?? '')) {
-    throw new Error('GITHUB_REF is not an exact branch or tag ref');
-  }
-  if (!COMMIT_PATTERN.test(sha ?? '')) {
-    throw new Error('GITHUB_SHA is not an exact 40-hex commit');
-  }
-  const prefix = `${repository}/`;
-  const suffix = `@${ref}`;
-  if (
-    typeof workflowRef !== 'string' ||
-    !workflowRef.startsWith(prefix) ||
-    !workflowRef.endsWith(suffix) ||
-    workflowRef.length <= prefix.length + suffix.length
-  ) {
-    throw new Error(
-      `GITHUB_WORKFLOW_REF "${workflowRef}" is not exactly <repository>/<workflow-path>@<ref> for this run`,
-    );
-  }
-  const path = workflowRef.slice(
-    prefix.length,
-    workflowRef.length - suffix.length,
-  );
-  if (
-    !path.startsWith('.github/workflows/') ||
-    path.split('/').some((segment) => !segment || segment === '..')
-  ) {
-    throw new Error(
-      `GITHUB_WORKFLOW_REF names "${path}", which is not an exact workflow file under .github/workflows/`,
-    );
-  }
-  const runId = env.GITHUB_RUN_ID;
-  if (!CANONICAL_IDENTIFIER_PATTERN.test(runId ?? '')) {
-    throw new Error('GITHUB_RUN_ID is not a usable run identifier');
-  }
-  const runAttempt = Number(env.GITHUB_RUN_ATTEMPT);
-  if (
-    !Number.isSafeInteger(runAttempt) ||
-    runAttempt < 1 ||
-    String(runAttempt) !== env.GITHUB_RUN_ATTEMPT
-  ) {
-    throw new Error('GITHUB_RUN_ATTEMPT is not a positive integer');
-  }
-  return { repository, ref, sha, path, workflowRef, runId, runAttempt };
-}
-
-/**
- * The build identity section of the producer input. `buildType` and the two
- * digests are read off the BuildKit SLSA v1 predicate the producing workflow
- * exported from the image it just pushed — the same bytes it cosign-attests
- * and the deploy plane re-verifies — so the evidence can never describe a
- * different build than the one that ran.
- */
-export function deriveBuilder({ provenancePath, sourceCommit }) {
-  if (!isAbsolute(provenancePath)) {
-    throw new Error('--provenance must be an absolute path');
-  }
-  let predicate;
-  try {
-    predicate = JSON.parse(readFileSync(provenancePath, 'utf8'));
-  } catch (error) {
-    throw new Error(
-      `cannot read the exported BuildKit provenance predicate at ${provenancePath}: ${error.message}`,
-    );
-  }
-  const label = 'exported BuildKit SLSA v1 provenance predicate';
-  if (
-    typeof predicate !== 'object' ||
-    predicate === null ||
-    Array.isArray(predicate)
-  ) {
-    throw new Error(`${label} is not a JSON object`);
-  }
-  const buildDefinition = predicate.buildDefinition;
-  if (
-    typeof buildDefinition !== 'object' ||
-    buildDefinition === null ||
-    Array.isArray(buildDefinition)
-  ) {
-    throw new Error(
-      `${label} has no buildDefinition object — SLSA v1 (BuildKit >= v0.28) is required; ` +
-        'pin the BuildKit image and pass provenance: mode=max,version=v1 to docker/build-push-action',
-    );
-  }
-  // SLSA v1 names the build type INSIDE buildDefinition; a top-level buildType
-  // is the retired v0.2 shape.
-  const buildType = buildDefinition.buildType;
-  if (typeof buildType !== 'string' || buildType.length === 0) {
-    throw new Error(
-      `${label} names no buildDefinition.buildType — is this SLSA v1 output?`,
-    );
-  }
-  const revision =
-    predicate.runDetails?.metadata?.buildkit_metadata?.vcs?.revision;
-  if (revision !== sourceCommit) {
-    throw new Error(
-      `${label} records VCS revision "${String(revision)}", not source commit ${sourceCommit} — ` +
-        'the exported predicate must describe exactly the build this evidence names',
-    );
-  }
-  const parameters = {};
-  if ('externalParameters' in buildDefinition) {
-    parameters.externalParameters = buildDefinition.externalParameters;
-  }
-  if ('internalParameters' in buildDefinition) {
-    parameters.internalParameters = buildDefinition.internalParameters;
-  }
-  if (Object.keys(parameters).length === 0) {
-    throw new Error(
-      `${label} carries neither externalParameters nor internalParameters — nothing binds the build's inputs`,
-    );
-  }
-  return {
-    buildType,
-    buildDefinitionDigest: `sha256:${sha256Hex(canonicalJson(buildDefinition))}`,
-    parametersDigest: `sha256:${sha256Hex(canonicalJson(parameters))}`,
-    // The parsed predicate itself: the registry scan below binds the
-    // statement's provenance witness to this exact build's identity.
-    predicate,
-  };
-}
-
-/**
- * The identity the PRIMARY build's SLSA attestation must carry: builder id +
- * invocation id, read off a decoded SLSA v1 predicate. Both spellings of the
- * invocation key occur in the wild — BuildKit's own rendering writes
- * `invocationId`, lanes whose predicates passed through other renderings
- * carry `invocationID` — so both are read, never rewritten.
- */
-function slsaBuildIdentity(predicate, label) {
-  const builderId = predicate?.runDetails?.builder?.id;
-  if (typeof builderId !== 'string' || builderId.length === 0) {
-    throw new Error(`${label} records no runDetails.builder.id — the builder identity is what binds an attestation to one build`);
-  }
-  const metadata = predicate?.runDetails?.metadata;
-  const invocationId =
-    typeof metadata?.invocationId === 'string'
-      ? metadata.invocationId
-      : typeof metadata?.invocationID === 'string'
-        ? metadata.invocationID
-        : undefined;
-  if (invocationId === undefined || invocationId.length === 0) {
-    throw new Error(
-      `${label} records no runDetails.metadata.invocationId/invocationID — without an invocation id one build's attestation cannot be told from another's`,
-    );
-  }
-  return { builderId, invocationId };
-}
-
-/**
- * The vendoring record the producing checkout committed — read at the BUILD
- * commit, because it pins the cross-repo bytes the build actually consumed.
- * Absent record (a repository with no cross-repo inputs) returns null.
- *
- * EVERY field this function returns is validated HERE, before any consumer
- * filters it. An entry that drops out of the source-hash closure does not fail
- * — it produces a DIFFERENT `sourceTreeHash`, and the only symptom is the
- * registry cross-check reporting "the image was not published from this source
- * identity" hundreds of lines later, naming neither the record nor the entry.
- * A malformed vendoring record is unusable, full stop; it must say so here.
- */
-export function readCrossRepoRecord(repoDir, commit, repo) {
-  const label = `${repo}@${commit}:${CROSS_REPO_RECORD_PATH}`;
-  let present = true;
-  try {
-    sandboxedGit(repoDir, [
-      'cat-file',
-      '-e',
-      `${commit}:${CROSS_REPO_RECORD_PATH}`,
-    ]);
-  } catch {
-    present = false;
-  }
-  if (!present) {return null;}
-  let record;
-  try {
-    record = readGitJsonAtCommit(repoDir, CROSS_REPO_RECORD_PATH, commit);
-  } catch (error) {
-    throw new Error(`${label} is not readable JSON: ${error.message}`);
-  }
-  if (record?.schemaVersion !== 1 || !Array.isArray(record.inputs)) {
-    throw new Error(`${label} is not a schemaVersion 1 cross-repo record`);
-  }
-  // Build-step context directories ride straight into `hashImageBuildInputs`.
-  // They were consumed with `?? []` and NO validation at all, so a record
-  // carrying a non-array (or a traversing path) silently hashed a different
-  // closure than the build consumed.
-  const buildStepContextDirectories = record.buildStepContextDirectories ?? [];
-  if (!Array.isArray(buildStepContextDirectories)) {
-    throw new Error(
-      `${label} buildStepContextDirectories must be an array of repository-relative directories`,
-    );
-  }
-  for (const directory of buildStepContextDirectories) {
-    canonicalRelativePath(
-      directory,
-      `${label} buildStepContextDirectories entry`,
-    );
-  }
-  // Shape FIRST, selection second. The `consumerService` filter used to run
-  // BEFORE this validation, so an entry MISSING `consumerService` compared
-  // `undefined !== null && undefined !== id` — true — and was silently skipped
-  // by the very check that exists to reject it.
-  for (const input of record.inputs) {
-    if (
-      input === null ||
-      typeof input !== 'object' ||
-      Array.isArray(input) ||
-      (input.consumerService !== null &&
-        typeof input.consumerService !== 'string') ||
-      (typeof input.consumerService === 'string' &&
-        input.consumerService.length === 0) ||
-      typeof input.sourceRepo !== 'string' ||
-      !SOURCE_REPO_PATTERN.test(input.sourceRepo) ||
-      !COMMIT_PATTERN.test(input.sourceCommit ?? '') ||
-      typeof input.sourcePath !== 'string' ||
-      typeof input.destinationPath !== 'string'
-    ) {
-      throw new Error(`${label} carries a malformed input ${serializeJson(input ?? null)}`);
-    }
-    canonicalRelativePath(input.sourcePath, `${label} input sourcePath`);
-    canonicalRelativePath(
-      input.destinationPath,
-      `${label} input destinationPath`,
-    );
-  }
-  return { inputs: record.inputs, buildStepContextDirectories };
-}
-
-/**
- * The subject's source identity, computed with the exact lock algorithms:
- * sourceManifestHash (the runtime-image-source-index algorithm),
- * sourceTreeHash (the ImageInputV2 build-input closure), and the
- * repositoryUrl the verifier binds (the runtime-image-source-index pin).
- */
-/**
- * The `platform-service-index.json` entry a `platform`-kind subject is built
- * from.
- *
- * `platform` subjects are the fleet's only repository-ROOT subjects: their lock
- * entry is synthesized in `resolve-images.mjs` from
- * `distributionLock.platformServices[].source`, with `path === repo` and
- * `sourceManifestPath === '<repo>/package.json'` — they are whole repositories
- * (the five generic submodules), not biome directories.
- *
- * `deriveSubjectSourceIdentity` recognized only two shapes: a supplemental
- * subject declared in the runtime index, or a biome subject whose path names a
- * directory inside the repository. A `platform` subject is neither, so EVERY one
- * of them failed deterministically — before any registry hop — on "is not a
- * supplemental subject, so its source path must name a biome directory". All
- * five generic submodules were therefore unable to produce image-source evidence
- * at all.
- *
- * The index is the SAME authority `resolve-images.mjs` resolved the lock's
- * platform subjects from, so resolving through it here is what makes the
- * assembler's `sourceTreeHash` equal the lock's `contentHash` — the equality the
- * whole producer contract rests on. `imageKey` (not `name`) is the subject id,
- * because that is the field `resolve-images.mjs` uses for `subjectId`.
- */
-function findPlatformServiceSource({ readPlatformServiceIndex, kind, id, repo }) {
-  if (typeof readPlatformServiceIndex !== 'function') {
-    throw new Error(
-      `subject ${kind}:${id} is a platform subject, which is resolved from ` +
-        'platform-service-index.json, but no reader for that index was provided',
-    );
-  }
-  const matches = readPlatformServiceIndex().services.filter(
-    (candidate) => candidate.imageKey === id && candidate.repo === repo,
-  );
-  if (matches.length !== 1) {
-    throw new Error(
-      `subject ${kind}:${id} matches ${matches.length} entries of ` +
-        `platform-service-index.json for repository "${repo}"; exactly one is ` +
-        'required — a platform subject is resolved from that index, which is the ' +
-        'same authority resolve-images.mjs built the lock from',
-    );
-  }
-  return matches[0];
-}
-
-export async function deriveSubjectSourceIdentity({
-  runtimeIndex,
-  // Lazy on purpose: platform-service-index.json is needed ONLY to resolve a
-  // `platform` subject, and requiring it for every subject made the file an
-  // unconditional input of a derivation that mostly does not read it.
-  readPlatformServiceIndex,
-  // The kernel enum member, passed in rather than written as a literal: the
-  // subject kind is a closed set the kernel owns, and a local copy is a second
-  // source of truth waiting to drift.
-  platformSubjectKind,
-  // The kernel's `RuntimeImageSubjectKind.ComposedProcess`, passed in for the
-  // reason `platformSubjectKind` is. Undefined: no subject is a composed one.
-  composedProcessSubjectKind = undefined,
-  declaration,
-}) {
-  const { kind, id, repo, path, sourceCommit } = declaration;
-  if (typeof platformSubjectKind !== 'string' || !platformSubjectKind) {
-    throw new Error(
-      'the kernel platform subject kind is required to resolve a source identity',
-    );
-  }
-  const pin = runtimeIndex.repositoryPins.find(
-    (candidate) => candidate.repo === repo,
-  );
-  if (!pin) {
-    throw new Error(
-      `subject ${kind}:${id} names source repository "${repo}", which has no ` +
-        'repository pin in runtime-image-source-index.json — it is not an image source repository',
-    );
-  }
-  const repoDir = sourceCheckoutPath(repo);
-  assertGitCommitExists(repoDir, sourceCommit);
-  // Supplemental subjects (host shell, independently sourced platform images)
-  // declare their source manifest in the runtime index; biome subjects carry
-  // `<biome>/xema-biome.json`.
-  const supplemental = runtimeIndex.supplementalSubjects.find(
-    (candidate) => candidate.kind === kind && candidate.id === id,
-  );
-  let manifestRepoRelativePath;
-  let subjectForServicePath = { kind, id, repo, path };
-  if (supplemental) {
-    if (supplemental.repo !== repo || supplemental.path !== path) {
-      throw new Error(
-        `subject ${kind}:${id} is a supplemental subject of ${supplemental.repo}:${supplemental.path} ` +
-          `in runtime-image-source-index.json, not of ${repo}:${path}`,
-      );
-    }
-    if (!supplemental.sourceManifestPath.startsWith(`${repo}/`)) {
-      throw new Error(
-        `subject ${kind}:${id} sourceManifestPath "${supplemental.sourceManifestPath}" ` +
-          `escapes its repository "${repo}"`,
-      );
-    }
-    manifestRepoRelativePath = supplemental.sourceManifestPath.slice(
-      repo.length + 1,
-    );
-    subjectForServicePath = {
-      ...subjectForServicePath,
-      sourceManifestPath: manifestRepoRelativePath,
-    };
-  } else if (composedProcessSubjectKind !== undefined && kind === composedProcessSubjectKind) {
-    // The composed-process image of one build: a Dockerfile-only image at the
-    // repository's `infra/composed-process/`, whose declaration is its
-    // `image-build-inputs.json` — exactly the shape resolve-images.mjs names
-    // in the lock (`readComposedProcessDeclarations`).
-    if (path !== `${repo}/${COMPOSED_PROCESS_IMAGE_PATH}`) {
-      throw new Error(
-        `subject ${kind}:${id} declares source path "${path}", but a composed-process ` +
-          `image is built from "${repo}/${COMPOSED_PROCESS_IMAGE_PATH}"`,
-      );
-    }
-    const expectedId = composedProcessSubjectId(firstPartySourceId(repo));
-    if (id !== expectedId) {
-      throw new Error(
-        `subject ${kind}:${id} is not the composed-process subject of "${repo}" ("${expectedId}")`,
-      );
-    }
-    manifestRepoRelativePath = `${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
-    subjectForServicePath = {
-      ...subjectForServicePath,
-      sourceManifestPath: manifestRepoRelativePath,
-    };
-  } else if (kind === platformSubjectKind) {
-    // The third shape: a whole-repository platform service. See
-    // `findPlatformServiceSource`.
-    const service = findPlatformServiceSource({
-      readPlatformServiceIndex,
-      kind,
-      id,
-      repo,
-    });
-    if (path !== repo) {
-      throw new Error(
-        `subject ${kind}:${id} declares source path "${path}", but a platform ` +
-          `subject is the whole repository "${repo}" — resolve-images.mjs sets ` +
-          'path === repo for it, and any other path hashes a closure the lock never named',
-      );
-    }
-    if (!service.path.startsWith(`${repo}/`)) {
-      throw new Error(
-        `subject ${kind}:${id} platform-service-index path "${service.path}" ` +
-          `escapes its repository "${repo}"`,
-      );
-    }
-    manifestRepoRelativePath = service.path.slice(repo.length + 1);
-    // Setting `sourceManifestPath` is what makes `subjectServicePath` return the
-    // repository ROOT instead of reading a `xema-biome.json` that does not
-    // exist — exactly the path whose build-input closure produced the lock's
-    // contentHash.
-    subjectForServicePath = {
-      ...subjectForServicePath,
-      sourceManifestPath: manifestRepoRelativePath,
-    };
-  } else {
-    if (path === repo) {
-      throw new Error(
-        `subject ${kind}:${id} is not a supplemental subject, so its source path ` +
-          'must name a biome directory inside the repository, not the repository root',
-      );
-    }
-    manifestRepoRelativePath = `${path.slice(repo.length + 1)}/xema-biome.json`;
-  }
-  const { computeBiomeSourceManifestHash } = await loadKernelDistributionSchemas();
-  const sourceManifestHash = await computeBiomeSourceManifestHash(
-    readGitJsonAtCommit(repoDir, manifestRepoRelativePath, sourceCommit),
-  );
-  const servicePath = subjectServicePath(subjectForServicePath, sourceCommit);
-  // Vendored cross-repo inputs EXACTLY as the build consumed them: the record
-  // committed in the producing checkout at the build commit. A `null`
-  // consumerService vendors for EVERY service of the consumer repository.
-  // `readCrossRepoRecord` has already proven EVERY entry well-formed, so the
-  // filter below can only ever narrow a valid set — it can no longer be the
-  // thing that hides an invalid one.
-  const record = readCrossRepoRecord(repoDir, sourceCommit, repo);
-  const crossRepoInputs = [];
-  for (const input of record?.inputs ?? []) {
-    // A composed image carries EVERY service of its build, so it vendors every
-    // input the record declares — the same set resolve-images.mjs hashes.
-    const composed =
-      composedProcessSubjectKind !== undefined && kind === composedProcessSubjectKind;
-    if (!composed && input.consumerService !== null && input.consumerService !== id) {
-      continue;
-    }
-    const sourceRepoDir = sourceCheckoutPath(input.sourceRepo);
-    assertGitCommitExists(sourceRepoDir, input.sourceCommit);
-    crossRepoInputs.push({
-      destinationPath: input.destinationPath,
-      sourceRepoDir,
-      sourcePath: input.sourcePath,
-      sourceCommit: input.sourceCommit,
-    });
-  }
-  const sourceTreeHash = hashImageBuildInputs(
-    {
-      repoDir,
-      service: id,
-      servicePath,
-      commit: sourceCommit,
-      crossRepoInputs,
-      buildStepDirectories: [...(record?.buildStepContextDirectories ?? [])],
-    },
-    imageInputSourceHashAlgorithm(),
-  );
-  return {
-    repositoryUrl: pin.repositoryUrl,
-    sourceManifestHash,
-    sourceTreeHash,
-  };
-}
-
-/**
- * The SBOM + provenance digests carried by the subject's cosign attestation
- * manifest (`sha256-<digest>.att`): the DSSE envelope layer digests, bound to
- * the delivered digest through their decoded statement subject. Fail-closed on
- * every gap, naming the pipeline step that must emit the missing artifact.
- *
- * A merged multi-arch index legitimately carries SEVERAL attestations of each
- * type — one per platform build, plus one more per lane re-run, because
- * `cosign attest` appends. Every candidate is validated (envelope shape,
- * predicate type, subject binding) and then ONE witness per type is selected
- * deterministically:
- *
- *   * SLSA provenance — the candidate whose statement names the SAME build as
- *     the caller's exported `--provenance` predicate (equal builder id AND
- *     invocation id), so the statement's artifact and build sections describe
- *     one and the same build. Ties (identical re-attestations of that build)
- *     resolve to the smallest layer digest; no match fails loudly.
- *   * SBOM — no caller-side reference exists, so the smallest layer digest
- *     among the validated candidates. Content-addressed, stable, and every
- *     candidate already proved it is an SBOM attestation bound to the
- *     delivered digest.
- */
-async function resolveCosignAttestationDigests({
-  client,
-  repository,
-  imageRepository,
-  manifestDigest,
-  label,
-  referenceProvenance,
-}) {
-  const attestationTag = `sha256-${manifestDigest.slice('sha256:'.length)}${ATTESTATION_TAG_SUFFIX}`;
-  let attestation;
-  try {
-    attestation = await client.getManifestByTag(repository, attestationTag);
-  } catch (error) {
-    throw new Error(
-      `${label} has no cosign attestation manifest at tag ${attestationTag}: ${error.message}. ` +
-        'The producing workflow must `cosign attest` the SBOM (--type spdxjson) and the SLSA ' +
-        `provenance (--type slsaprovenance1) against the exact delivered digest ${manifestDigest}. ` +
-        'If this digest is a multi-arch index merged AFTER the build attested the pre-merge image ' +
-        '(a separate multi-arch merge workflow), the merge step must re-run those attest calls on the merged ' +
-        'index.',
-    );
-  }
-  if (attestation.isIndex) {
-    throw new Error(
-      `${label} attestation tag ${attestationTag} resolved to an index; the assembler expects the ` +
-        'single-manifest / multi-layer shape cosign v2.6.3 writes',
-    );
-  }
-  const layers = Array.isArray(attestation.document.layers)
-    ? attestation.document.layers
-    : [];
-  if (layers.length === 0) {
-    throw new Error(
-      `${label} attestation manifest ${attestation.digest} carries no layers`,
-    );
-  }
-  const deliveredHex = manifestDigest.slice('sha256:'.length);
-  const sbomCandidates = [];
-  const provenanceCandidates = [];
-  for (const layer of layers) {
-    if (layer?.mediaType !== DSSE_ENVELOPE_LAYER_MEDIA_TYPE) {
-      throw new Error(
-        `${label} attestation manifest ${attestation.digest} carries a ` +
-          `"${String(layer?.mediaType)}" layer; only ${DSSE_ENVELOPE_LAYER_MEDIA_TYPE} ` +
-          'layers are admissible',
-      );
-    }
-    const predicateType = layer.annotations?.[PREDICATE_TYPE_ANNOTATION];
-    if (typeof predicateType !== 'string' || predicateType.length === 0) {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} has no "${PREDICATE_TYPE_ANNOTATION}" annotation`,
-      );
-    }
-    if (predicateType === DEPLOY_SOURCE_PREDICATE_TYPE) {continue;}
-    if (
-      predicateType !== SBOM_PREDICATE_TYPE &&
-      predicateType !== PROVENANCE_PREDICATE_TYPE
-    ) {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} has unrecognized predicate type ` +
-          `"${predicateType}" — only ${SBOM_PREDICATE_TYPE}, ${PROVENANCE_PREDICATE_TYPE} and ` +
-          `${DEPLOY_SOURCE_PREDICATE_TYPE} may hang off a producer subject`,
-      );
-    }
-    // Fetching the envelope proves it is stored and content-addressed, and the
-    // decoded statement must bind EXACTLY the delivered digest: an attestation
-    // that names any other subject describes a different image.
-    const bytes = await client.getBlob(
-      repository,
-      layer.digest,
-      MAX_ATTESTATION_LAYER_BYTES,
-    );
-    let envelope;
-    try {
-      envelope = JSON.parse(bytes.toString('utf8'));
-    } catch {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} is not valid JSON`,
-      );
-    }
-    if (envelope?.payloadType !== IN_TOTO_PAYLOAD_TYPE) {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} is not an ${IN_TOTO_PAYLOAD_TYPE} DSSE envelope`,
-      );
-    }
-    let statement;
-    try {
-      statement = JSON.parse(
-        Buffer.from(String(envelope.payload), 'base64').toString('utf8'),
-      );
-    } catch {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} carries no decodable in-toto statement`,
-      );
-    }
-    if (statement?.predicateType !== predicateType) {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} annotates "${predicateType}" ` +
-          `but its statement declares "${String(statement?.predicateType)}"`,
-      );
-    }
-    const expectedSubject = {
-      name: imageRepository,
-      digest: { sha256: deliveredHex },
-    };
-    if (
-      !Array.isArray(statement.subject) ||
-      statement.subject.length !== 1 ||
-      JSON.stringify(statement.subject[0]) !== JSON.stringify(expectedSubject)
-    ) {
-      throw new Error(
-        `${label} attestation layer ${layer.digest} binds ` +
-          `${serializeJson(statement.subject ?? null)}, not the delivered subject ` +
-          `${serializeJson(expectedSubject)} — the producing workflow must attest the exact ` +
-          'digest the canonical coordinate serves',
-      );
-    }
-    if (predicateType === SBOM_PREDICATE_TYPE) {
-      sbomCandidates.push({ digest: layer.digest, statement });
-    } else {
-      provenanceCandidates.push({ digest: layer.digest, statement });
-    }
-  }
-  if (sbomCandidates.length === 0) {
-    throw new Error(
-      `${label} carries no SBOM attestation (${SBOM_PREDICATE_TYPE}) — the producing workflow must run ` +
-        `cosign attest --yes --type spdxjson --predicate <spdx.json> ${imageRepository}@${manifestDigest}`,
-    );
-  }
-  if (provenanceCandidates.length === 0) {
-    throw new Error(
-      `${label} carries no SLSA provenance attestation (${PROVENANCE_PREDICATE_TYPE}) — the producing ` +
-        `workflow must run cosign attest --yes --type slsaprovenance1 --predicate <slsa-provenance.json> ` +
-        `${imageRepository}@${manifestDigest}`,
-    );
-  }
-  // The provenance witness must describe the SAME build the statement's build
-  // section describes — the caller's exported predicate. A multi-platform
-  // index carries one attestation per platform build; picking any other
-  // build's would attest the index with a different source's provenance.
-  const referenceIdentity = slsaBuildIdentity(
-    referenceProvenance,
-    'the exported --provenance predicate',
-  );
-  const matches = provenanceCandidates.filter((candidate) => {
-    try {
-      const identity = slsaBuildIdentity(
-        candidate.statement.predicate,
-        `attestation layer ${candidate.digest}`,
-      );
-      return (
-        identity.builderId === referenceIdentity.builderId &&
-        identity.invocationId === referenceIdentity.invocationId
-      );
-    } catch {
-      // A candidate whose predicate names no build identity can never be the
-      // primary build's witness; it stays admissible for nothing.
-      return false;
-    }
-  });
-  if (matches.length === 0) {
-    throw new Error(
-      `${label} carries ${provenanceCandidates.length} SLSA provenance attestation(s) but none ` +
-        `describes the primary build (builder "${referenceIdentity.builderId}", invocation ` +
-        `"${referenceIdentity.invocationId}") — the lane must re-attest the merged index with ` +
-        'that build\'s own predicate (mirror release-arm64-host-web.yaml\'s attest step)',
-    );
-  }
-  matches.sort((left, right) => compareStrings(left.digest, right.digest));
-  const provenanceDigest = matches[0].digest;
-  const sbomsByDigest = [...sbomCandidates].sort((left, right) =>
-    compareStrings(left.digest, right.digest),
-  );
-  const sbomDigest = sbomsByDigest[0].digest;
-  return { sbomDigest, provenanceDigest };
-}
-
-/**
- * Registry side of one subject, resolved at the canonical
- * `<imageRepository>:<sourceTreeHash>` coordinate: the served manifest digest
- * (which must be exactly the caller's), its media type, the hash-proven
- * platform set, and the SBOM/provenance attestation digests.
- * `referenceProvenance` is the caller's parsed exported BuildKit predicate —
- * the identity anchor the provenance-witness selection binds to.
- */
-export async function resolveImageArtifactEvidence({
-  imageRepository,
-  manifestDigest,
-  sourceTreeHash,
-  referenceProvenance,
-  distributionsRoot = dataRoot(),
-  env = process.env,
-  fetchImpl = globalThis.fetch,
-  registryFor = null,
-}) {
-  if (!SHA256_DIGEST_PATTERN.test(manifestDigest ?? '')) {
-    throw new Error('--manifest-digest must be an exact sha256:<64-hex> digest');
-  }
-  if (!SHA256_HEX_PATTERN.test(sourceTreeHash ?? '')) {
-    throw new Error('sourceTreeHash must be 64 lowercase sha256 hex characters');
-  }
-  assertReferenceProvenance(referenceProvenance);
-  const { authority, repository } = splitImageRef(imageRepository);
-  const declarations = loadRegistryCredentialDeclarations(distributionsRoot);
-  const credential = resolveRegistryCredential({ authority, declarations, env });
-  const client = registryFor
-    ? registryFor({ authority, credential })
-    : new OrasRegistry({ credential, fetchImpl });
-  return publishedArtifactEvidence({
-    client,
-    repository,
-    imageRepository,
-    read: { tag: sourceTreeHash },
-    expectedDigest: manifestDigest,
-    coordinate: `${imageRepository}:${sourceTreeHash}`,
-    referenceProvenance,
-  });
-}
-
-/**
- * The artifact section of a producer subject read BY DIGEST: the manifest at
- * `<imageRepository>@<manifestDigest>` (its bytes must hash to that digest),
- * its hash-proven platforms and its cosign SBOM + SLSA attestation digests. A
- * third-party publisher's image carries no `:<sourceTreeHash>` tag
- * (`evidence assemble-third-party-input`), so nothing is read by tag.
- */
-export async function resolveImageArtifactEvidenceByDigest({
-  client,
-  imageRepository,
-  manifestDigest,
-  referenceProvenance,
-}) {
-  if (!SHA256_DIGEST_PATTERN.test(manifestDigest ?? '')) {
-    throw new Error('the image manifest digest must be an exact sha256:<64-hex> digest');
-  }
-  assertReferenceProvenance(referenceProvenance);
-  const { repository } = splitImageRef(imageRepository);
-  return publishedArtifactEvidence({
-    client,
-    repository,
-    imageRepository,
-    read: { digest: manifestDigest },
-    expectedDigest: manifestDigest,
-    coordinate: `${imageRepository}@${manifestDigest}`,
-    referenceProvenance,
-  });
-}
-
-function assertReferenceProvenance(referenceProvenance) {
-  if (
-    typeof referenceProvenance !== 'object' ||
-    referenceProvenance === null ||
-    Array.isArray(referenceProvenance)
-  ) {
-    throw new Error(
-      'referenceProvenance (the parsed exported BuildKit SLSA v1 predicate) is required — ' +
-        'it is what binds the selected provenance attestation to the primary build',
-    );
-  }
-}
-
-/** The artifact evidence of the manifest `read` names (exactly one of `{tag}` or `{digest}`), which must be `expectedDigest`. */
-async function publishedArtifactEvidence({
-  client,
-  repository,
-  imageRepository,
-  read,
-  expectedDigest,
-  coordinate,
-  referenceProvenance,
-}) {
-  const top =
-    read.tag === undefined
-      ? await client.getManifestByDigest(repository, read.digest)
-      : await client.getManifestByTag(repository, read.tag);
-  if (top.digest !== expectedDigest) {
-    throw new Error(
-      read.tag === undefined
-        ? `${coordinate} was served as ${top.digest}: the registry returned a manifest that is not the digest it was read by`
-        : `${coordinate} serves ${top.digest}, not the caller-declared ${expectedDigest} — ` +
-            'the image was not published from this source identity (wrong build commit, ' +
-            'or the cross-repo record at the build commit differs from the one this source carries)',
-    );
-  }
-  // Proves EVERY platform by its own hash-verified image config and refuses
-  // attestation children as platforms — exactly the evidence the producer
-  // input carries.
-  const published = await resolvePublishedPlatforms({
-    client,
-    repository,
-    ...read,
-    coordinate,
-  });
-  if (published.indexDigest !== top.digest) {
-    throw new Error(
-      `${coordinate} did not resolve to the exact published manifest this evidence names`,
-    );
-  }
-  const label = `${imageRepository}@${top.digest}`;
-  const { sbomDigest, provenanceDigest } =
-    await resolveCosignAttestationDigests({
-      client,
-      repository,
-      imageRepository,
-      manifestDigest: top.digest,
-      label,
-      referenceProvenance,
-    });
-  const platforms = published.platforms
-    .map((entry) => ({
-      ...entry.platform,
-      manifestDigest: entry.manifestDigest,
-    }))
-    // The kernel's canonical platform order: os/architecture/variant,
-    // code-point comparison (assertPlatforms re-checks this on verification).
-    .sort((left, right) =>
-      compareStrings(platformIdentity(left), platformIdentity(right)),
-    );
-  return {
-    manifestDigest: top.digest,
-    manifestMediaType: top.mediaType,
-    platforms,
-    sbomDigest,
-    provenanceDigest,
-  };
-}
-
-/**
- * The producer's DECLARED evidence lifetime, in seconds.
- *
- * This used to default to the trust policy's `maxProducerTtlSeconds` (the
- * CEILING), which is wrong in two independent ways:
- *
- *  1. It collapses two numbers that must move independently. The ceiling is the
- *     VERIFIER's tolerance; this is the PRODUCER's intent. With them equal,
- *     `assertTimeWindow`'s `expires - issued > maxTtlSeconds` sits exactly on
- *     the boundary, so lowering the policy ceiling by one second retroactively
- *     invalidates every bundle ever signed — the ceiling could never be
- *     tightened without re-producing the entire fleet's evidence.
- *  2. "As long as permitted" is not a decision. The offline verifier has NO
- *     revocation channel, so this TTL *is* the revocation window for a
- *     mis-issued or leaked bundle. Taking the maximum by default makes that
- *     window as wide as the policy allows, by omission rather than by choice.
- *
- * 72h is the shortest value that still spans a weekend: a bundle produced late
- * Friday is still valid Monday morning, so a release or delivery that slips
- * over a weekend never needs an out-of-band refresh. Everything shorter buys
- * marginal revocation latency and pays for it in operational surprise.
- *
- * A producer that genuinely needs a different lifetime passes `--ttl-seconds`;
- * the ceiling still bounds it, and the value is asserted against the ceiling
- * below so this constant can never quietly exceed the policy.
- */
-export const DEFAULT_PRODUCER_TTL_SECONDS = 3 * 24 * 60 * 60;
-
-/** Where the ceiling on a producer lifetime is held: the closed set of producer kinds. */
-export const ProducerTtlCeilingSource = Object.freeze({
-  /** First party: the data root's trust policy `maxProducerTtlSeconds`, read here. */
-  TrustPolicy: 'trust-policy',
-  /**
-   * A third-party publisher on public inputs: the vendor policy's `maxProducerTtlSeconds`, enforced by
-   * the third-party pin writer (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`.
-   */
-  VendorAdmission: 'vendor-admission',
-});
-
-/** The latest instant an RFC 3339 `expiresAt` (four-digit year) can name. */
-const LATEST_EXPIRES_AT = Date.UTC(9999, 11, 31, 23, 59, 59);
-
-/** `--ttl-seconds` as given, or undefined when it is not. */
-export const producerTtlSecondsFlag = (value) => (value === undefined ? undefined : Number(value));
-
-/**
- * The producer lifetime of an input issued at `now`. The default is DEFAULT_PRODUCER_TTL_SECONDS, bowed to the
- * ceiling when it is read here (`ceiling.source` TrustPolicy, `ceiling.maxTtlSeconds`); an explicit value above that
- * ceiling is refused. With VendorAdmission the ceiling is the vendor policy's, enforced by the third-party pin writer
- * (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`; this CLI holds no second one. Either way a value that is not a positive integer, or whose `expiresAt` is past the last
- * instant RFC 3339 can name, is refused by name.
- */
-export function resolveProducerTtlSeconds({ ttlSeconds, now, ceiling }) {
-  let maxTtlSeconds;
-  if (ceiling?.source === ProducerTtlCeilingSource.TrustPolicy) {
-    ({ maxTtlSeconds } = ceiling);
-    if (!Number.isSafeInteger(maxTtlSeconds) || maxTtlSeconds < 1) {
-      throw new Error(`the trust policy's maxProducerTtlSeconds ${String(maxTtlSeconds)} is not a positive integer`);
-    }
-  } else if (ceiling?.source === ProducerTtlCeilingSource.VendorAdmission) {
-    maxTtlSeconds = null;
-  } else {
-    throw new Error(`a producer TTL ceiling source is one of ${Object.values(ProducerTtlCeilingSource).join(', ')}`);
-  }
-  // The DEFAULT bows to the policy ceiling; an EXPLICIT `--ttl-seconds` above
-  // it still fails below. Tightening `maxProducerTtlSeconds` is a legitimate
-  // operator decision, and it must not break every producer until someone
-  // edits a constant in this file — but a caller who NAMES a lifetime the
-  // verifier will reject has made a mistake, and gets told so.
-  const effective =
-    ttlSeconds ?? (maxTtlSeconds === null ? DEFAULT_PRODUCER_TTL_SECONDS : Math.min(DEFAULT_PRODUCER_TTL_SECONDS, maxTtlSeconds));
-  if (maxTtlSeconds !== null && (!Number.isSafeInteger(effective) || effective < 1 || effective > maxTtlSeconds)) {
-    throw new Error(
-      `--ttl-seconds must be an integer between 1 and the trust policy's maxProducerTtlSeconds (${maxTtlSeconds})`,
-    );
-  }
-  if (!Number.isSafeInteger(effective) || effective < 1) {
-    throw new Error(
-      `--ttl-seconds must be a positive integer number of seconds (got ${String(ttlSeconds)}); the vendor policy's ` +
-        'maxProducerTtlSeconds is its ceiling, enforced by the pin writer and verify-evidence',
-    );
-  }
-  if (now + effective * 1000 > LATEST_EXPIRES_AT) {
-    throw new Error(
-      `--ttl-seconds ${effective} puts expiresAt past ${new Date(LATEST_EXPIRES_AT).toISOString()}, the last instant an ` +
-        'RFC 3339 time can name',
-    );
-  }
-  return effective;
-}
-
-function readProducerTtlSeconds(distributionsRoot) {
-  const declared = editionWorkspaceConfig().evidenceTrustPolicy.policy;
-  if (declared === null) {
-    throw new Error(
-      `${distributionsRoot} declares no evidenceTrustPolicy in edition-workspace.json; the producer TTL ceiling comes from it`,
-    );
-  }
-  const policyPath = join(distributionsRoot, declared);
-  let policy;
-  try {
-    policy = JSON.parse(readFileSync(policyPath, 'utf8'));
-  } catch (error) {
-    throw new Error(
-      `cannot read the committed trust policy at ${policyPath}: ${error.message}`,
-    );
-  }
-  if (
-    policy?.schemaVersion !== 1 ||
-    !Number.isSafeInteger(policy.maxProducerTtlSeconds) ||
-    policy.maxProducerTtlSeconds < 1
-  ) {
-    throw new Error(
-      `${policyPath} does not declare a positive integer maxProducerTtlSeconds`,
-    );
-  }
-  return policy.maxProducerTtlSeconds;
-}
-
-function rfc3339(timestamp) {
-  return new Date(timestamp).toISOString().replace(/\.\d{3}Z$/, 'Z');
-}
-
-/**
- * Assemble the complete producer input manifest for ONE image subject and
- * prove — before anything is written — that it satisfies the producer's exact
- * field contract, the kernel statement schema, and the running GitHub context
- * the producer action will compare it against.
- */
-export async function assembleProducerInput({
-  imageRepository,
-  manifestDigest,
-  subjectKind,
-  subjectId,
-  sourceRepo,
-  sourcePath,
-  sourceCommit,
-  provenancePath,
-  sourceManifestHash: declaredSourceManifestHash,
-  sourceTreeHash: declaredSourceTreeHash,
-  ttlSeconds,
-  distributionsRoot = dataRoot(),
-  env = process.env,
-  fetchImpl = globalThis.fetch,
-  registryFor = null,
-  now = Date.now(),
-}) {
-  const schemas = await loadKernelDistributionSchemas();
-  const contractAuthority = readPinnedContractAuthority({
-    dataRoot: distributionsRoot,
-    schemas,
-  });
-  const subjectKinds = Object.values(schemas.RuntimeImageSubjectKind);
-  if (!subjectKinds.includes(subjectKind)) {
-    throw new Error(
-      `--subject-kind "${String(subjectKind)}" must be one of ${subjectKinds.join(', ')}`,
-    );
-  }
-  assertCanonicalSubjectId(subjectId);
-  if (!SOURCE_REPO_PATTERN.test(sourceRepo ?? '')) {
-    throw new Error(
-      `--source-repo "${String(sourceRepo)}" must be an aggregator-plane repository (repos/<name> or submodules/<name>)`,
-    );
-  }
-  canonicalRelativePath(sourcePath, '--source-path');
-  if (sourcePath !== sourceRepo && !sourcePath.startsWith(`${sourceRepo}/`)) {
-    throw new Error(`--source-path must stay inside ${sourceRepo}`);
-  }
-  if (!COMMIT_PATTERN.test(sourceCommit ?? '')) {
-    throw new Error('--source-commit must be an exact 40-hex commit');
-  }
-  const context = assertWorkflowContext(env);
-  const runtimeIndex = schemas.parseRuntimeImageSourceIndex(
-    JSON.parse(
-      readFileSync(
-        join(distributionsRoot, 'runtime-image-source-index.json'),
-        'utf8',
-      ),
-    ),
-  );
-  const source = await deriveSubjectSourceIdentity({
-    runtimeIndex,
-    // Parsed through the kernel schema, not read raw: a `platform` subject's
-    // whole source identity is resolved from this index, so a malformed index
-    // must fail rather than produce a subtly wrong closure.
-    readPlatformServiceIndex: () =>
-      schemas.parsePlatformServiceSourceIndex(
-        JSON.parse(
-          readFileSync(
-            join(distributionsRoot, 'platform-service-index.json'),
-            'utf8',
-          ),
-        ),
-      ),
-    platformSubjectKind: schemas.RuntimeImageSubjectKind.Platform,
-    composedProcessSubjectKind: schemas.RuntimeImageSubjectKind.ComposedProcess,
-    declaration: {
-      kind: subjectKind,
-      id: subjectId,
-      repo: sourceRepo,
-      path: sourcePath,
-      sourceCommit,
-    },
-  });
-  if (
-    declaredSourceManifestHash !== undefined &&
-    declaredSourceManifestHash !== source.sourceManifestHash
-  ) {
-    throw new Error(
-      `--source-manifest-hash "${String(declaredSourceManifestHash)}" does not match the ` +
-        `${source.sourceManifestHash} computed from ${sourceRepo}@${sourceCommit} — ` +
-        'the declared source identity is not the one this manifest hashes',
-    );
-  }
-  if (
-    declaredSourceTreeHash !== undefined &&
-    declaredSourceTreeHash !== source.sourceTreeHash
-  ) {
-    throw new Error(
-      `--source-tree-hash "${String(declaredSourceTreeHash)}" does not match the ` +
-        `${source.sourceTreeHash} computed from the build-input closure of ` +
-        `${sourceRepo}@${sourceCommit} — the declared coordinate is not the one this source builds`,
-    );
-  }
-  const builder = deriveBuilder({ provenancePath, sourceCommit });
-  const artifact = await resolveImageArtifactEvidence({
-    imageRepository,
-    manifestDigest,
-    sourceTreeHash: source.sourceTreeHash,
-    referenceProvenance: builder.predicate,
-    distributionsRoot,
-    env,
-    fetchImpl,
-    registryFor,
-  });
-  const effectiveTtlSeconds = resolveProducerTtlSeconds({
-    ttlSeconds,
-    now,
-    ceiling: { source: ProducerTtlCeilingSource.TrustPolicy, maxTtlSeconds: readProducerTtlSeconds(distributionsRoot) },
-  });
-  const input = producerInputDocument({
-    contractAuthority,
-    context,
-    builder,
-    now,
-    ttlSeconds: effectiveTtlSeconds,
-    subject: {
-      kind: subjectKind,
-      id: subjectId,
-      repositoryUrl: source.repositoryUrl,
-      repo: sourceRepo,
-      path: sourcePath,
-      sourceCommit,
-      sourceManifestHash: source.sourceManifestHash,
-      sourceTreeHash: source.sourceTreeHash,
-      imageRepository,
-      ...artifact,
-    },
-  });
-  assertAssembledProducerInput({ input, schemas, contractAuthority, context });
-  return input;
-}
-
-/**
- * The producer input of ONE subject, in the exact shape
- * `produce-image-source-evidence.mjs` accepts. `context` is
- * {@link assertWorkflowContext}'s and `builder` {@link deriveBuilder}'s; the
- * subject carries every per-subject field (source identity and artifact).
- */
-export function producerInputDocument({ contractAuthority, context, builder, now, ttlSeconds, subject }) {
-  return {
-    schemaVersion: 1,
-    contractAuthority: { ...contractAuthority },
-    sourceHashAlgorithm: imageInputSourceHashAlgorithm(),
-    producerWorkflowSha: context.sha,
-    signer: {
-      kind: oidcCertificateSignerKind(),
-      certificateIdentity: `https://github.com/${context.repository}/${context.path}@${context.ref}`,
-      oidcIssuer: 'https://token.actions.githubusercontent.com',
-      githubWorkflow: {
-        repository: context.repository,
-        ref: context.ref,
-        path: context.path,
-      },
-    },
-    builder: {
-      builderId: `https://github.com/${context.repository}/${context.path}`,
-      buildType: builder.buildType,
-      buildDefinitionDigest: builder.buildDefinitionDigest,
-      parametersDigest: builder.parametersDigest,
-    },
-    runId: context.runId,
-    runAttempt: context.runAttempt,
-    issuedAt: rfc3339(now),
-    expiresAt: rfc3339(now + ttlSeconds * 1000),
-    expectedSubjects: [`${subject.kind}:${subject.id}`],
-    subjects: [
-      {
-        kind: subject.kind,
-        id: subject.id,
-        repositoryUrl: subject.repositoryUrl,
-        repo: subject.repo,
-        path: subject.path,
-        sourceCommit: subject.sourceCommit,
-        sourceManifestHash: subject.sourceManifestHash,
-        sourceTreeHash: subject.sourceTreeHash,
-        imageRepository: subject.imageRepository,
-        manifestDigest: subject.manifestDigest,
-        manifestMediaType: subject.manifestMediaType,
-        platforms: subject.platforms,
-        sbomDigest: subject.sbomDigest,
-        provenanceDigest: subject.provenanceDigest,
-      },
-    ],
-  };
-}
-
-/**
- * Prove an assembled input satisfies the producer BEFORE anything reads it:
- * the exact field contract, then the kernel statement schema the producer
- * builds (the same parse produce-image-source-evidence.mjs runs before
- * signing), then the GitHub context the producer compares against.
- */
-export function assertAssembledProducerInput({ input, schemas, contractAuthority, context }) {
-  assertProducerInput(input, contractAuthority);
-  buildImageSourceStatements(input, schemas, contractAuthority);
-  assertGitHubProducerContext(input, {
-    repository: context.repository,
-    ref: context.ref,
-    sha: context.sha,
-    workflowRef: context.workflowRef,
-  });
-}
-
-/**
- * The `--name value` pairs of an assembler's argv: each flag once, each with a
- * value, none outside `known`.
- */
-export function readAssemblerFlags(args, known) {
-  const flags = new Map();
-  for (let index = 0; index < args.length; index += 2) {
-    const flag = args[index];
-    if (!flag.startsWith('--')) {
-      throw new Error(`unexpected argument "${flag}"`);
-    }
-    const name = flag.slice(2);
-    const value = args[index + 1];
-    if (value === undefined || value.startsWith('--')) {
-      throw new Error(`--${name} requires a value`);
-    }
-    if (flags.has(name)) {
-      throw new Error(`--${name} was given twice`);
-    }
-    flags.set(name, value);
-  }
-  for (const name of flags.keys()) {
-    if (!known.has(name)) {
-      throw new Error(`unknown option "--${name}"`);
-    }
-  }
-  return flags;
-}
-
-/**
- * Write an assembled input to `output`. The output directory is caller scratch
- * space — created deterministically (the producer action's input-manifest
- * must be repository-relative, so the caller cannot sidestep this by pointing
- * at RUNNER_TEMP). `wx` refuses to overwrite an existing manifest.
- */
-export function writeProducerInputFile(output, input) {
-  mkdirSync(dirname(output), { recursive: true });
-  writeFileSync(output, serializeJson(input), { flag: 'wx', mode: 0o600 });
-}
-
-function requireValue(flags, name) {
-  const value = flags.get(name);
-  if (value === undefined) {
-    throw new Error(`--${name} is required`);
-  }
-  return value;
-}
-
-async function main() {
-  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
-    WorkspaceRoot.Data,
-    WorkspaceRoot.Sources,
-    WorkspaceRoot.Kernel,
-  ]);
-  const known = new Set([
-    'output',
-    'image-repository',
-    'manifest-digest',
-    'subject-kind',
-    'subject-id',
-    'source-repo',
-    'source-path',
-    'source-commit',
-    'source-manifest-hash',
-    'source-tree-hash',
-    'provenance',
-    'ttl-seconds',
-  ]);
-  const flags = readAssemblerFlags(args, known);
-  const output = resolve(requireValue(flags, 'output'));
-  const input = await assembleProducerInput({
-    imageRepository: requireValue(flags, 'image-repository'),
-    manifestDigest: requireValue(flags, 'manifest-digest'),
-    subjectKind: requireValue(flags, 'subject-kind'),
-    subjectId: requireValue(flags, 'subject-id'),
-    sourceRepo: requireValue(flags, 'source-repo'),
-    sourcePath: requireValue(flags, 'source-path'),
-    sourceCommit: requireValue(flags, 'source-commit'),
-    provenancePath: resolve(requireValue(flags, 'provenance')),
-    sourceManifestHash: flags.get('source-manifest-hash'),
-    sourceTreeHash: flags.get('source-tree-hash'),
-    ttlSeconds: producerTtlSecondsFlag(flags.get('ttl-seconds')),
-  });
-  writeProducerInputFile(output, input);
-  console.log(
-    `[assemble-producer-input] wrote ${output} for subject ` +
-      `${input.subjects[0].kind}:${input.subjects[0].id} ` +
-      `(${input.subjects[0].imageRepository}@${input.subjects[0].manifestDigest})`,
-  );
-}
-
-if (isEntryModule(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`[assemble-producer-input] ${error.message}`);
-    process.exitCode = 1;
-  });
-}