External dependency declaration keys - Agent Volumes

External dependency declaration keys use the av-extdep-v1 prefix and an OCI-style SHA-256 digest syntax.

av-extdep-v1:sha256:<lowercase-hex-sha256>

The digest input is the JCS canonical UTF-8 JSON object with exactly purl, purpose, and scope.

Canonical input

Volume scope is encoded as { "kind": "volume" }.
Component scope is encoded as { "components": [...] } with sorted component names.
The input includes purl, purpose, and scope only.
The input excludes constraint, warning payloads, advisory matches, resolved evidence, carrier wrapper fields, array positions, comments, and whitespace.