@aopslabs/aops-server 0.2.0

package/build/server/chunks/commercial-admission-loader-V_vXHdVa.js

@@ -0,0 +1,2077 @@
+import { v as verifyEntitlementLease, b as buildAdmittedDomainSnapshot, R as RELEASE_MANIFEST_PURPOSE, a as verifyReleaseManifestEnvelope, c as canonicalCommercialJson, E as ENTITLEMENT_LEASE_PURPOSE, d as ENTITLEMENT_LEASE_ALGORITHM, C as CommercialArtifactError, e as assertCommercialRuntimeCompatible, s as sha256Commercial } from './admission-snapshot-C2wGfTWE.js';
+import { randomBytes, randomUUID, createPrivateKey, sign, createPublicKey, verify, createHmac, timingSafeEqual, createHash } from 'node:crypto';
+import { readFileSync, existsSync, rmSync, lstatSync, realpathSync, mkdirSync, statSync, writeFileSync, renameSync, chmodSync } from 'node:fs';
+import path from 'node:path';
+import { gunzipSync } from 'node:zlib';
+import { c as compareCanonicalText } from './canonical-text-order-DbXJJnFD.js';
+import { homedir } from 'node:os';
+
+const BASE64URL$1 = /^[A-Za-z0-9_-]+$/;
+function fail$3(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function isRecord$3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys$2(value, expected, stage) {
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (actual.length !== sortedExpected.length || actual.some((key, index) => key !== sortedExpected[index]))
+    fail$3(stage, "offline_activation_schema_invalid");
+}
+function digest(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function publicJwk$1(value) {
+  if (!isRecord$3(value))
+    fail$3("offline-challenge-schema", "offline_activation_schema_invalid");
+  exactKeys$2(value, ["crv", "kty", "x"], "offline-challenge-schema");
+  if (value.kty !== "OKP" || value.crv !== "Ed25519" || typeof value.x !== "string" || !BASE64URL$1.test(value.x))
+    fail$3("offline-challenge-schema", "offline_activation_key_invalid");
+  try {
+    const key = createPublicKey({
+      key: { kty: "OKP", crv: "Ed25519", x: value.x },
+      format: "jwk"
+    });
+    if (key.asymmetricKeyType !== "ed25519") {
+      fail$3("offline-challenge-schema", "offline_activation_key_invalid");
+    }
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail$3("offline-challenge-schema", "offline_activation_key_invalid");
+  }
+  return Object.freeze({ kty: "OKP", crv: "Ed25519", x: value.x });
+}
+function offlineActivationKeyThumbprint(jwk) {
+  const normalized = publicJwk$1(jwk);
+  return digest(JSON.stringify({ crv: normalized.crv, kty: normalized.kty, x: normalized.x }));
+}
+function installationPublicJwkFromPrivateKey(privateKeyPem) {
+  try {
+    const privateKey = createPrivateKey(privateKeyPem);
+    if (privateKey.asymmetricKeyType !== "ed25519") {
+      fail$3("offline-challenge-signature", "offline_activation_key_invalid");
+    }
+    return publicJwk$1(createPublicKey(privateKey).export({ format: "jwk" }));
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail$3("offline-challenge-signature", "offline_activation_key_invalid");
+  }
+}
+class ManagedInstallationLayoutError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "ManagedInstallationLayoutError";
+    this.code = code;
+  }
+}
+const verifiedLayouts = /* @__PURE__ */ new WeakSet();
+function fail$2(code) {
+  throw new ManagedInstallationLayoutError(code);
+}
+function supportedPlatform(value) {
+  if (value === "win32" || value === "darwin" || value === "linux")
+    return value;
+  return fail$2("managed_layout_platform_unsupported");
+}
+function pathApi(platform) {
+  return platform === "win32" ? path.win32 : path.posix;
+}
+function absoluteBase(value, api, reason) {
+  if (typeof value !== "string" || !value || value.trim() !== value || !api.isAbsolute(value)) {
+    return fail$2(reason);
+  }
+  const normalized = api.resolve(api.normalize(value));
+  if (normalized === api.parse(normalized).root)
+    return fail$2(reason);
+  if (api === path.win32 && !/^[A-Za-z]:\\/.test(normalized))
+    return fail$2(reason);
+  return normalized;
+}
+function environmentBase(environment, key, fallback, api) {
+  return Object.prototype.hasOwnProperty.call(environment, key) ? absoluteBase(environment[key], api, `managed_layout_${key.toLowerCase()}_invalid`) : fallback;
+}
+function confined(root, candidate, api) {
+  const relative = api.relative(root, candidate);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+function resolveManagedInstallationLayout(options = {}) {
+  const platform = supportedPlatform(options.platform ?? process.platform);
+  const api = pathApi(platform);
+  const environment = options.environment ?? process.env;
+  const home = absoluteBase(options.homeDirectory ?? homedir(), api, "managed_layout_home_invalid");
+  let dataRoot;
+  let stateBase;
+  let configBase;
+  let cacheBase;
+  let logsBase;
+  if (platform === "win32") {
+    const localAppData = environmentBase(environment, "LOCALAPPDATA", api.join(home, "AppData", "Local"), api);
+    dataRoot = api.join(localAppData, "AopsLab", "Aops");
+    stateBase = dataRoot;
+    configBase = dataRoot;
+    cacheBase = dataRoot;
+    logsBase = dataRoot;
+  } else if (platform === "darwin") {
+    dataRoot = api.join(home, "Library", "Application Support", "AopsLab", "Aops");
+    stateBase = dataRoot;
+    configBase = dataRoot;
+    cacheBase = api.join(home, "Library", "Caches", "AopsLab", "Aops");
+    logsBase = api.join(home, "Library", "Logs", "AopsLab", "Aops");
+  } else {
+    dataRoot = api.join(environmentBase(environment, "XDG_DATA_HOME", api.join(home, ".local", "share"), api), "aopslab", "aops");
+    stateBase = api.join(environmentBase(environment, "XDG_STATE_HOME", api.join(home, ".local", "state"), api), "aopslab", "aops");
+    configBase = api.join(environmentBase(environment, "XDG_CONFIG_HOME", api.join(home, ".config"), api), "aopslab", "aops");
+    cacheBase = api.join(environmentBase(environment, "XDG_CACHE_HOME", api.join(home, ".cache"), api), "aopslab", "aops");
+    logsBase = stateBase;
+  }
+  const instancesRoot = api.join(dataRoot, "instances");
+  const instanceRoot = api.join(instancesRoot, "default");
+  const stateRoot = platform === "win32" || platform === "darwin" ? api.join(instanceRoot, "state") : api.join(stateBase, "instances", "default");
+  const configRoot = platform === "win32" || platform === "darwin" ? api.join(instanceRoot, "config") : api.join(configBase, "instances", "default");
+  const cacheRoot = api.join(cacheBase, "instances", "default", "cache");
+  const logsRoot = platform === "win32" ? api.join(instanceRoot, "logs") : api.join(logsBase, "instances", "default", "logs");
+  const binding = Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-managed-installation-layout-binding-v1",
+    instanceId: "default",
+    platform,
+    source: "canonical-user",
+    dataRoot,
+    instancesRoot,
+    instanceRoot,
+    storeRoot: api.join(instanceRoot, "store"),
+    stagingRoot: api.join(instanceRoot, "staging"),
+    stateRoot,
+    configRoot,
+    cacheRoot,
+    logsRoot,
+    layoutManifestPath: api.join(stateRoot, "layout-manifest.json"),
+    currentReleasePointerPath: api.join(stateRoot, "current-release.json"),
+    installerLockPath: api.join(stateRoot, "installer.lock")
+  });
+  const managedChildren = [
+    binding.instancesRoot,
+    binding.instanceRoot,
+    binding.storeRoot,
+    binding.stagingRoot
+  ];
+  if (managedChildren.some((candidate) => !confined(binding.dataRoot, candidate, api))) {
+    return fail$2("managed_layout_data_escape");
+  }
+  for (const [root, candidates] of [
+    [stateRoot, [binding.layoutManifestPath, binding.currentReleasePointerPath, binding.installerLockPath]],
+    [configRoot, []],
+    [cacheRoot, []],
+    [logsRoot, []]
+  ]) {
+    if (!api.isAbsolute(root) || candidates.some((candidate) => !confined(root, candidate, api))) {
+      return fail$2("managed_layout_mutable_escape");
+    }
+  }
+  const layout = Object.freeze({
+    ...binding,
+    secretStorage: Object.freeze({
+      authority: "os-credential-store",
+      fileFallback: null
+    }),
+    runtime: Object.freeze({
+      immutableAuthority: "commercial-artifact-store",
+      activationAuthority: "store-active-receipt",
+      bundledNode: "verified-release-closure",
+      globalNodeNpmPnpm: "forbidden"
+    })
+  });
+  verifiedLayouts.add(layout);
+  return layout;
+}
+const STORE_FORMAT_VERSION = 1;
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+const IDENTITY = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/;
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+const MAX_ARCHIVE_FILES = 1e5;
+const MAX_FILE_BYTES = 128 * 1024 * 1024;
+function fail$1(stage, reason, decision = "deny") {
+  throw new CommercialArtifactError(stage, reason, decision);
+}
+function isRecord$2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseJsonFile$1(filePath, stage, reason) {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    fail$1(stage, reason);
+  }
+}
+function assertIdentity(value, reason) {
+  if (!IDENTITY.test(value))
+    fail$1("store-identity", reason);
+}
+function assertAbsoluteSafeRoot(rootPath, create) {
+  if (!path.isAbsolute(rootPath))
+    fail$1("store-path", "store_root_not_absolute");
+  const resolved = path.resolve(rootPath);
+  if (path.parse(resolved).root === resolved)
+    fail$1("store-path", "store_root_too_broad");
+  if (!existsSync(resolved)) {
+    fail$1("store-path", "store_root_missing");
+    mkdirSync(resolved, { recursive: true, mode: 448 });
+  }
+  const stat = lstatSync(resolved);
+  if (stat.isSymbolicLink() || !stat.isDirectory())
+    fail$1("store-path", "store_root_unsafe");
+  const real = realpathSync.native(resolved);
+  if (path.relative(resolved, real) !== "")
+    fail$1("store-path", "store_root_reparse_refused");
+  return real;
+}
+function safeChild(root, ...segments) {
+  for (const segment of segments) {
+    if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\")) {
+      fail$1("store-path", "unsafe_managed_segment");
+    }
+  }
+  const candidate = path.join(root, ...segments);
+  const relative = path.relative(root, candidate);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
+    fail$1("store-path", "managed_path_escape");
+  return candidate;
+}
+function ensureManagedDirectory(root, ...segments) {
+  let cursor = root;
+  for (const segment of segments) {
+    cursor = safeChild(cursor, segment);
+    if (!existsSync(cursor))
+      mkdirSync(cursor, { mode: 448 });
+    const stat = lstatSync(cursor);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+      fail$1("store-path", "managed_directory_unsafe");
+    if (path.relative(cursor, realpathSync.native(cursor)) !== "")
+      fail$1("store-path", "managed_directory_reparse_refused");
+  }
+  return cursor;
+}
+function assertRegularFile(filePath, stage, reason) {
+  const stat = lstatSync(filePath);
+  if (stat.isSymbolicLink() || !stat.isFile())
+    fail$1(stage, reason);
+  return realpathSync.native(filePath);
+}
+function digestBytes(bytes) {
+  return sha256Commercial(bytes);
+}
+function integrityBytes(bytes) {
+  return `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
+}
+function atomicWrite(filePath, bytes, mode = 384) {
+  const parent = path.dirname(filePath);
+  const tempPath = path.join(parent, `.${path.basename(filePath)}.${randomUUID()}.tmp`);
+  writeFileSync(tempPath, bytes, { mode, flag: "wx" });
+  renameSync(tempPath, filePath);
+  try {
+    chmodSync(filePath, mode);
+  } catch {
+  }
+}
+function trimTarText(bytes) {
+  const nul = bytes.indexOf(0);
+  return bytes.subarray(0, nul === -1 ? bytes.length : nul).toString("utf8").trim();
+}
+function tarNumber(bytes, reason) {
+  if ((bytes[0] & 128) !== 0)
+    fail$1("archive-safety", reason);
+  const text2 = trimTarText(bytes).replace(/\0/g, "").trim();
+  if (!text2)
+    return 0;
+  if (!/^[0-7]+$/.test(text2))
+    fail$1("archive-safety", reason);
+  const value = Number.parseInt(text2, 8);
+  if (!Number.isSafeInteger(value) || value < 0)
+    fail$1("archive-safety", reason);
+  return value;
+}
+function parsePax(bytes) {
+  const fields = {};
+  let offset = 0;
+  while (offset < bytes.length) {
+    const space = bytes.indexOf(32, offset);
+    if (space < 0)
+      fail$1("archive-safety", "pax_record_invalid");
+    const length = Number.parseInt(bytes.subarray(offset, space).toString("ascii"), 10);
+    if (!Number.isSafeInteger(length) || length <= 0 || offset + length > bytes.length) {
+      fail$1("archive-safety", "pax_record_invalid");
+    }
+    const record = bytes.subarray(space + 1, offset + length - 1).toString("utf8");
+    const equals = record.indexOf("=");
+    if (equals <= 0)
+      fail$1("archive-safety", "pax_record_invalid");
+    const key = record.slice(0, equals);
+    if (Object.hasOwn(fields, key))
+      fail$1("archive-safety", "pax_duplicate_field");
+    fields[key] = record.slice(equals + 1);
+    offset += length;
+  }
+  return fields;
+}
+function safeArchivePath(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (!normalized.startsWith("package/") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized) || normalized.length > 4096)
+    fail$1("archive-safety", "archive_path_invalid");
+  const relative = normalized.slice("package/".length);
+  if (!relative || relative.endsWith("/") || relative.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+    fail$1("archive-safety", "archive_path_invalid");
+  }
+  return relative.normalize("NFC");
+}
+function inspectNpmTarball(bytes) {
+  if (bytes.byteLength <= 0 || bytes.byteLength > MAX_ARCHIVE_BYTES)
+    fail$1("archive-safety", "archive_size_invalid");
+  let tar;
+  try {
+    tar = gunzipSync(bytes, { maxOutputLength: MAX_ARCHIVE_BYTES });
+  } catch {
+    fail$1("archive-safety", "archive_gzip_invalid");
+  }
+  const rows = [];
+  const contents = /* @__PURE__ */ new Map();
+  let offset = 0;
+  let pax = {};
+  let longName = null;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0))
+      break;
+    const storedChecksum = tarNumber(header.subarray(148, 156), "archive_checksum_invalid");
+    let checksum = 0;
+    for (let index = 0; index < 512; index += 1) {
+      checksum += index >= 148 && index < 156 ? 32 : header[index];
+    }
+    if (storedChecksum !== checksum)
+      fail$1("archive-safety", "archive_checksum_mismatch");
+    const baseName = trimTarText(header.subarray(0, 100));
+    const prefix = trimTarText(header.subarray(345, 500));
+    const headerName = prefix ? `${prefix}/${baseName}` : baseName;
+    const mode = tarNumber(header.subarray(100, 108), "archive_mode_invalid") & 511;
+    const headerSize = tarNumber(header.subarray(124, 136), "archive_entry_size_invalid");
+    if (headerSize > MAX_FILE_BYTES)
+      fail$1("archive-safety", "archive_entry_too_large");
+    const type = String.fromCharCode(header[156] || 0);
+    const contentOffset = offset + 512;
+    const contentEnd = contentOffset + headerSize;
+    if (contentEnd > tar.length)
+      fail$1("archive-safety", "archive_truncated");
+    const content = tar.subarray(contentOffset, contentEnd);
+    offset = contentOffset + Math.ceil(headerSize / 512) * 512;
+    if (type === "x" || type === "g") {
+      const next = parsePax(content);
+      const unsupported = Object.keys(next).filter((key) => !["path", "size", "mtime"].includes(key));
+      if (unsupported.some((key) => key === "linkpath"))
+        fail$1("archive-safety", "archive_link_refused");
+      pax = type === "g" ? { ...pax, ...next } : next;
+      continue;
+    }
+    if (type === "L") {
+      longName = trimTarText(content);
+      continue;
+    }
+    if (type === "5") {
+      pax = {};
+      longName = null;
+      continue;
+    }
+    if (type !== "\0" && type !== "0")
+      fail$1("archive-safety", "archive_special_entry_refused");
+    const entryName = pax.path ?? longName ?? headerName;
+    const declaredSize = pax.size === void 0 ? headerSize : Number.parseInt(pax.size, 10);
+    if (!Number.isSafeInteger(declaredSize) || declaredSize !== headerSize)
+      fail$1("archive-safety", "archive_entry_size_mismatch");
+    const relative = safeArchivePath(entryName);
+    if (contents.has(relative))
+      fail$1("archive-safety", "archive_duplicate_path");
+    const copy = Buffer.from(content);
+    contents.set(relative, copy);
+    rows.push(Object.freeze({
+      path: relative,
+      size: copy.byteLength,
+      mode,
+      sha256: digestBytes(copy)
+    }));
+    if (rows.length > MAX_ARCHIVE_FILES)
+      fail$1("archive-safety", "archive_file_limit_exceeded");
+    pax = {};
+    longName = null;
+  }
+  rows.sort((left, right) => compareCanonicalText(left.path, right.path));
+  const packageBytes = contents.get("package.json");
+  if (!packageBytes)
+    fail$1("archive-preflight", "package_json_missing");
+  let packageJson;
+  try {
+    packageJson = JSON.parse(packageBytes.toString("utf8"));
+  } catch {
+    fail$1("archive-preflight", "package_json_invalid");
+  }
+  if (!isRecord$2(packageJson) || typeof packageJson.name !== "string" || typeof packageJson.version !== "string") {
+    fail$1("archive-preflight", "package_identity_invalid");
+  }
+  const optionalPeerNames = /* @__PURE__ */ new Set();
+  if (packageJson.peerDependenciesMeta !== void 0) {
+    if (!isRecord$2(packageJson.peerDependenciesMeta)) {
+      fail$1("archive-preflight", "package_dependencies_invalid");
+    }
+    for (const [dependencyName, metadata] of Object.entries(packageJson.peerDependenciesMeta)) {
+      if (!isRecord$2(metadata) || typeof metadata.optional !== "boolean") {
+        fail$1("archive-preflight", "package_dependencies_invalid");
+      }
+      if (metadata.optional)
+        optionalPeerNames.add(dependencyName);
+    }
+  }
+  const runtimeDependencyNames = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies"]) {
+    const dependencies = packageJson[field];
+    if (dependencies === void 0)
+      continue;
+    if (!isRecord$2(dependencies))
+      fail$1("archive-preflight", "package_dependencies_invalid");
+    for (const [dependencyName, dependencyRange] of Object.entries(dependencies)) {
+      if (typeof dependencyRange !== "string" || !dependencyRange.trim()) {
+        fail$1("archive-preflight", "package_dependencies_invalid");
+      }
+      if (field !== "peerDependencies" || !optionalPeerNames.has(dependencyName)) {
+        runtimeDependencyNames.add(dependencyName);
+      }
+    }
+  }
+  return Object.freeze({
+    files: Object.freeze(rows),
+    contents,
+    filesDigest: sha256Commercial(canonicalCommercialJson(rows.map(({ path: filePath, size, sha256: sha2562 }) => ({
+      path: filePath,
+      size,
+      sha256: sha2562
+    })))),
+    packageName: packageJson.name,
+    version: packageJson.version,
+    runtimeDependencies: Object.freeze([...runtimeDependencyNames].sort(compareCanonicalText))
+  });
+}
+function readOnlyObjectPath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail$1("store-path", "object_digest_invalid");
+  return safeChild(root, "objects", "sha256", digest2.slice("sha256:".length));
+}
+function readOnlyTreePath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail$1("store-path", "tree_digest_invalid");
+  return safeChild(root, "trees", "sha256", digest2.slice("sha256:".length));
+}
+function verifyTree(root, archive) {
+  for (const row of archive.files) {
+    const segments = row.path.split("/");
+    let cursor = root;
+    for (const segment of segments) {
+      cursor = safeChild(cursor, segment);
+      const stat2 = lstatSync(cursor);
+      if (stat2.isSymbolicLink())
+        fail$1("cas-readback", "cas_tree_link_refused", "quarantine");
+    }
+    const stat = statSync(cursor);
+    if (!stat.isFile() || stat.size !== row.size || digestBytes(readFileSync(cursor)) !== row.sha256) {
+      fail$1("cas-readback", "cas_tree_digest_mismatch", "quarantine");
+    }
+  }
+}
+function resolveEntrypoint(entrypoint, artifacts, closureDigest) {
+  const separator = entrypoint.indexOf(":");
+  const packageName = entrypoint.slice(0, separator);
+  const relative = entrypoint.slice(separator + 1);
+  const artifact = artifacts.get(packageName);
+  if (!artifact)
+    fail$1("artifact-preflight", "entrypoint_package_missing");
+  if (!artifact.files.some((row) => row.path === relative))
+    fail$1("artifact-preflight", "entrypoint_file_missing");
+  return `runtimes/sha256/${closureDigest.slice("sha256:".length)}/node_modules/${packageName}/${relative}`;
+}
+function resolveLaunchClosure(manifest, artifacts) {
+  const roleRows = manifest.closure.filter((entry) => entry.launchRole !== null);
+  const runtime = roleRows.find((entry) => entry.launchRole === "runtime-node");
+  if (!runtime)
+    fail$1("artifact-preflight", "runtime_role_missing");
+  for (const entry of roleRows) {
+    const artifact = artifacts.get(entry.packageName);
+    if (!artifact)
+      fail$1("artifact-preflight", "launch_role_package_missing");
+    const file = artifact.files.find((candidate) => candidate.path === entry.launchEntrypoint);
+    if (!file)
+      fail$1("artifact-preflight", "launch_role_entrypoint_missing");
+    if (entry.launchRole !== "runtime-node") {
+      if (entry.runtimeRange === null)
+        fail$1("artifact-preflight", "launch_role_runtime_range_missing");
+      assertCommercialRuntimeCompatible(runtime.version, entry.runtimeRange);
+    }
+  }
+  const entries = roleRows.map((entry) => {
+    const artifact = artifacts.get(entry.packageName);
+    if (!artifact)
+      fail$1("artifact-preflight", "launch_role_package_missing");
+    const file = artifact.files.find((candidate) => candidate.path === entry.launchEntrypoint);
+    if (!file || entry.launchRole === null || entry.launchEntrypoint === null) {
+      fail$1("artifact-preflight", "launch_role_entrypoint_missing");
+    }
+    return Object.freeze({
+      role: entry.launchRole,
+      packageName: artifact.packageName,
+      packageVersion: artifact.version,
+      artifactDigest: artifact.digest,
+      entrypoint: entry.launchEntrypoint,
+      entrypointDigest: file.sha256,
+      runtimeRange: entry.runtimeRange,
+      resolvedPath: resolveEntrypoint(`${entry.packageName}:${entry.launchEntrypoint}`, artifacts, manifest.closureDigest)
+    });
+  }).sort((left, right) => compareCanonicalText(left.role, right.role));
+  return Object.freeze({
+    runtimeVersion: runtime.version,
+    entries: Object.freeze(entries)
+  });
+}
+function readOnlyRuntimeRootPath(root, closureDigest) {
+  if (!SHA256.test(closureDigest))
+    fail$1("store-path", "closure_digest_invalid");
+  return safeChild(root, "runtimes", "sha256", closureDigest.slice("sha256:".length));
+}
+function packageRuntimeRoot(nodeModulesRoot, packageName) {
+  const segments = packageName.split("/");
+  if (segments.length === 1)
+    return safeChild(nodeModulesRoot, segments[0]);
+  if (segments.length === 2 && segments[0].startsWith("@")) {
+    const scope = ensureManagedDirectory(nodeModulesRoot, segments[0]);
+    return safeChild(scope, segments[1]);
+  }
+  fail$1("artifact-preflight", "runtime_package_name_invalid");
+}
+function verifyRuntimeClosure(runtimeRoot, artifacts) {
+  const nodeModulesRoot = safeChild(runtimeRoot, "node_modules");
+  const nodeModulesStat = lstatSync(nodeModulesRoot);
+  if (nodeModulesStat.isSymbolicLink() || !nodeModulesStat.isDirectory()) {
+    fail$1("runtime-readback", "runtime_closure_unsafe", "quarantine");
+  }
+  for (const artifact of artifacts.values()) {
+    const packageRoot = packageRuntimeRoot(nodeModulesRoot, artifact.packageName);
+    for (const row of artifact.files) {
+      let cursor = packageRoot;
+      for (const segment of row.path.split("/")) {
+        cursor = safeChild(cursor, segment);
+        const stat2 = lstatSync(cursor);
+        if (stat2.isSymbolicLink())
+          fail$1("runtime-readback", "runtime_link_refused", "quarantine");
+      }
+      const stat = statSync(cursor);
+      if (!stat.isFile() || stat.size !== row.size || digestBytes(readFileSync(cursor)) !== row.sha256) {
+        fail$1("runtime-readback", "runtime_file_digest_mismatch", "quarantine");
+      }
+    }
+  }
+}
+function verifyRuntimeDependencyClosure(artifacts) {
+  for (const artifact of artifacts.values()) {
+    for (const dependencyName of artifact.runtimeDependencies) {
+      if (!artifacts.has(dependencyName)) {
+        fail$1("artifact-preflight", "runtime_dependency_outside_closure");
+      }
+    }
+  }
+}
+function statePath(root, name) {
+  return safeChild(ensureManagedDirectory(root, "state"), name);
+}
+function readOnlyStatePath(root, name) {
+  return safeChild(root, "state", name);
+}
+function assertStoreIdentity(root, expected, create = false) {
+  const filePath = create ? statePath(root, "store-identity.json") : readOnlyStatePath(root, "store-identity.json");
+  if (!existsSync(filePath)) {
+    if (!expected || !create)
+      fail$1("store-identity", "store_identity_missing", "quarantine");
+    const identity = Object.freeze({
+      schemaVersion: 1,
+      objectType: "aops-commercial-artifact-store-identity-v1",
+      storeFormatVersion: STORE_FORMAT_VERSION,
+      installationId: expected.installationId,
+      hostInstanceId: expected.hostInstanceId
+    });
+    atomicWrite(filePath, `${canonicalCommercialJson(identity)}
+`);
+  }
+  const value = parseJsonFile$1(filePath, "store-identity", "store_identity_json_invalid");
+  if (!isRecord$2(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-artifact-store-identity-v1" || value.storeFormatVersion !== STORE_FORMAT_VERSION || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string")
+    fail$1("store-identity", "store_identity_schema_invalid", "quarantine");
+  if (expected && (value.installationId !== expected.installationId || value.hostInstanceId !== expected.hostInstanceId))
+    fail$1("store-identity", "store_identity_mismatch", "quarantine");
+  return value;
+}
+function readOnlyReceiptPath(root, receiptId) {
+  assertIdentity(receiptId, "receipt_id_invalid");
+  return safeChild(root, "receipts", `${receiptId}.json`);
+}
+function readOnlyManifestPath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail$1("store-path", "manifest_digest_invalid");
+  return safeChild(root, "manifests", `${digest2.slice("sha256:".length)}.json`);
+}
+function keyBytes(root, create) {
+  const keyPath = readOnlyStatePath(root, "receipt-hmac.key");
+  if (!existsSync(keyPath)) {
+    fail$1("receipt-integrity", "receipt_key_missing", "quarantine");
+    atomicWrite(keyPath, randomBytes(32), 384);
+  }
+  const key = readFileSync(assertRegularFile(keyPath, "receipt-integrity", "receipt_key_unsafe"));
+  if (key.byteLength !== 32)
+    fail$1("receipt-integrity", "receipt_key_invalid", "quarantine");
+  return key;
+}
+function readReceipt(root, receiptId) {
+  const value = parseJsonFile$1(readOnlyReceiptPath(root, receiptId), "receipt-readback", "receipt_json_invalid");
+  if (!isRecord$2(value) || !isRecord$2(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.receiptDigestOrMac !== "string") {
+    fail$1("receipt-readback", "receipt_schema_invalid", "quarantine");
+  }
+  if (value.schemaVersion !== 2 || value.objectType !== "aops-installation-receipt-v2") {
+    fail$1("receipt-readback", "receipt_schema_unsupported", "quarantine");
+  }
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = createHmac("sha256", keyBytes(root)).update(canonicalCommercialJson(unsigned)).digest();
+  const actualText = value.localIntegrity.receiptDigestOrMac;
+  if (!/^hmac-sha256:[a-f0-9]{64}$/.test(actualText))
+    fail$1("receipt-readback", "receipt_mac_invalid", "quarantine");
+  const actual = Buffer.from(actualText.slice("hmac-sha256:".length), "hex");
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    fail$1("receipt-readback", "receipt_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readPointer(root, name) {
+  const filePath = readOnlyStatePath(root, name);
+  if (!existsSync(filePath))
+    return null;
+  const value = parseJsonFile$1(filePath, "activation-readback", "pointer_json_invalid");
+  if (!isRecord$2(value) || value.schemaVersion !== 1 || typeof value.receiptId !== "string" || typeof value.receiptMac !== "string" || !Number.isSafeInteger(value.generation))
+    fail$1("activation-readback", "pointer_schema_invalid", "quarantine");
+  const receipt = readReceipt(root, value.receiptId);
+  if (receipt.localIntegrity.receiptDigestOrMac !== value.receiptMac || receipt.activation.generation !== value.generation)
+    fail$1("activation-readback", "pointer_receipt_mismatch", "quarantine");
+  return value;
+}
+function highWaterPath(root, packageName) {
+  const identity = createHash("sha256").update(packageName, "utf8").digest("hex");
+  return safeChild(ensureManagedDirectory(root, "high-water"), `${identity}.json`);
+}
+function highWaterMacInput(value) {
+  return `aops-product-release-high-water-v1\0${canonicalCommercialJson(value)}`;
+}
+function verifyHighWaterState(root, packageName, value) {
+  if (!isRecord$2(value) || canonicalCommercialJson(Object.keys(value).sort()) !== canonicalCommercialJson([
+    "issuedAt",
+    "localIntegrity",
+    "manifestDigest",
+    "objectType",
+    "packageName",
+    "schemaVersion",
+    "versionOrdinal"
+  ]) || value.schemaVersion !== 1 || value.objectType !== "aops-product-release-high-water-v1" || typeof value.packageName !== "string" || value.packageName.length < 1 || value.packageName.length > 512 || value.packageName !== packageName || typeof value.issuedAt !== "string" || !Number.isFinite(Date.parse(value.issuedAt)) || !Number.isSafeInteger(value.versionOrdinal) || Number(value.versionOrdinal) < 0 || typeof value.manifestDigest !== "string" || !SHA256.test(value.manifestDigest) || !isRecord$2(value.localIntegrity) || canonicalCommercialJson(Object.keys(value.localIntegrity).sort()) !== canonicalCommercialJson(["mac", "scheme"]) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string" || !/^hmac-sha256:[a-f0-9]{64}$/.test(value.localIntegrity.mac))
+    fail$1("release-high-water", "high_water_schema_invalid", "quarantine");
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = createHmac("sha256", keyBytes(root)).update(highWaterMacInput(unsigned)).digest();
+  const actual = Buffer.from(value.localIntegrity.mac.slice("hmac-sha256:".length), "hex");
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    fail$1("release-high-water", "high_water_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readHighWater(root, packageName) {
+  const filePath = highWaterPath(root, packageName);
+  if (!existsSync(filePath))
+    return null;
+  const value = parseJsonFile$1(filePath, "release-high-water", "high_water_json_invalid");
+  const verified = verifyHighWaterState(root, packageName, value);
+  return Object.freeze({
+    issuedAt: verified.issuedAt,
+    versionOrdinal: verified.versionOrdinal,
+    manifestDigest: verified.manifestDigest
+  });
+}
+function assertRetainedHighWater(root, receipt) {
+  const retained = readHighWater(root, receipt.packageName);
+  if (!retained)
+    fail$1("release-high-water", "high_water_missing", "quarantine");
+  if (retained.versionOrdinal < receipt.releaseHighWater.versionOrdinal) {
+    fail$1("release-high-water", "high_water_receipt_mismatch", "quarantine");
+  }
+  return retained;
+}
+function verifyStoredClosure(root, receipt, onVerified) {
+  const startedAt = process.hrtime.bigint();
+  const artifacts = /* @__PURE__ */ new Map();
+  let casBytesRead = 0;
+  let npmArtifactCount = 0;
+  let archiveFileCount = 0;
+  let archiveFileBytes = 0;
+  for (const object of receipt.casObjects) {
+    const filePath = readOnlyObjectPath(root, object.digest);
+    const file = assertRegularFile(filePath, "cas-readback", "cas_object_missing");
+    const bytes = readFileSync(file);
+    casBytesRead += bytes.byteLength;
+    if (bytes.byteLength !== object.size || digestBytes(bytes) !== object.digest) {
+      fail$1("cas-readback", "cas_object_digest_mismatch", "quarantine");
+    }
+    if (object.role.startsWith("npm:")) {
+      npmArtifactCount += 1;
+      const packageName = object.role.slice("npm:".length);
+      const archive = inspectNpmTarball(bytes);
+      archiveFileCount += archive.files.length;
+      archiveFileBytes += archive.files.reduce((total, row) => total + row.size, 0);
+      if (archive.packageName !== packageName)
+        fail$1("cas-readback", "cas_package_identity_mismatch", "quarantine");
+      const tree = readOnlyTreePath(root, object.digest);
+      if (!existsSync(tree))
+        fail$1("cas-readback", "cas_tree_missing", "quarantine");
+      const treeStat = lstatSync(tree);
+      if (treeStat.isSymbolicLink() || !treeStat.isDirectory()) {
+        fail$1("cas-readback", "cas_tree_unsafe", "quarantine");
+      }
+      verifyTree(tree, archive);
+      artifacts.set(packageName, {
+        packageName,
+        version: archive.version,
+        digest: object.digest,
+        integrity: integrityBytes(bytes),
+        filesDigest: archive.filesDigest,
+        objectPath: file,
+        treePath: tree,
+        files: archive.files,
+        runtimeDependencies: archive.runtimeDependencies
+      });
+    }
+  }
+  const runtimeRoot = readOnlyRuntimeRootPath(root, receipt.closureDigest);
+  if (!existsSync(runtimeRoot))
+    fail$1("runtime-readback", "runtime_closure_missing", "quarantine");
+  verifyRuntimeClosure(runtimeRoot, artifacts);
+  verifyRuntimeDependencyClosure(artifacts);
+  onVerified?.(Object.freeze({
+    elapsedMs: Number(process.hrtime.bigint() - startedAt) / 1e6,
+    casObjectCount: receipt.casObjects.length,
+    npmArtifactCount,
+    tarballDecompressionCount: npmArtifactCount,
+    archiveFileCount,
+    casBytesRead,
+    treeBytesRead: archiveFileBytes,
+    runtimeBytesRead: archiveFileBytes,
+    materializedBytesDerivedFromArchiveMetadata: true,
+    materializedFilePasses: 2,
+    totalFileReads: receipt.casObjects.length + archiveFileCount * 2,
+    totalBytesRead: casBytesRead + archiveFileBytes * 2
+  }));
+  return artifacts;
+}
+const COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE = "aops-commercial-integrity-authority-v1";
+const COMMERCIAL_INTEGRITY_PENDING_PURPOSE = "aops-commercial-integrity-pending-v2";
+function commercialIntegrityRoot(stateRoot, create) {
+  if (!path.isAbsolute(stateRoot))
+    fail$1("commercial-integrity", "integrity_state_root_not_absolute");
+  const resolved = path.resolve(stateRoot);
+  if (!existsSync(resolved)) {
+    return null;
+  }
+  const safeStateRoot = assertAbsoluteSafeRoot(resolved);
+  {
+    const candidate = path.join(safeStateRoot, "commercial-integrity");
+    if (!existsSync(candidate))
+      return null;
+  }
+  return ensureManagedDirectory(safeStateRoot, "commercial-integrity");
+}
+function commercialIntegrityKey(root, create) {
+  const keyPath = safeChild(root, "authority-hmac.key");
+  if (!existsSync(keyPath)) {
+    return null;
+  }
+  const key = readFileSync(assertRegularFile(keyPath, "commercial-integrity", "integrity_key_unsafe"));
+  if (key.byteLength !== 32)
+    return null;
+  return key;
+}
+function integrityMac(key, purpose, value) {
+  return createHmac("sha256", key).update(`${purpose}\0${canonicalCommercialJson(value)}`).digest("hex");
+}
+function authorityUnsigned(value) {
+  const { localIntegrity: _, ...unsigned } = value;
+  return unsigned;
+}
+function pendingUnsigned(value) {
+  const { localIntegrity: _, ...unsigned } = value;
+  return unsigned;
+}
+function signCommercialIntegrityAuthority(key, value) {
+  return Object.freeze({
+    ...value,
+    localIntegrity: Object.freeze({
+      scheme: "hmac-sha256-v1",
+      mac: integrityMac(key, COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE, value)
+    })
+  });
+}
+function parseOptionalJson(filePath) {
+  if (!existsSync(filePath))
+    return null;
+  try {
+    const file = assertRegularFile(filePath, "commercial-integrity", "integrity_record_unsafe");
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    return null;
+  }
+}
+function validIntegrityFile(value) {
+  return isRecord$2(value) && typeof value.relativePath === "string" && value.relativePath.length > 0 && !value.relativePath.startsWith("/") && !value.relativePath.includes("\\") && !value.relativePath.split("/").some((segment) => !segment || segment === "." || segment === "..") && Number.isSafeInteger(value.size) && Number(value.size) >= 0 && typeof value.mtimeMs === "number" && Number.isFinite(value.mtimeMs) && typeof value.fileId === "string";
+}
+function validCriticalFile(value) {
+  return isRecord$2(value) && typeof value.relativePath === "string" && SHA256.test(String(value.digest));
+}
+function authorityShape(value) {
+  if (!isRecord$2(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-integrity-authority-v1" || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string" || typeof value.receiptId !== "string" || !SHA256.test(String(value.closureDigest)) || !Number.isSafeInteger(value.activationGeneration) || Number(value.activationGeneration) < 1 || typeof value.verifiedAt !== "string" || ![
+    "install",
+    "update",
+    "rollback",
+    "scheduled",
+    "routine-size-drift-full-verify",
+    "authority-reestablished"
+  ].includes(String(value.verificationSource)) || typeof value.authorityReestablished !== "boolean" || typeof value.previousAnchorUnknown !== "boolean" || !Array.isArray(value.files) || !value.files.every(validIntegrityFile) || !validCriticalFile(value.dcm) || !validCriticalFile(value.operationCatalog) || !isRecord$2(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string")
+    return false;
+  let previous = "";
+  for (const file of value.files) {
+    if (file.relativePath <= previous)
+      return false;
+    previous = file.relativePath;
+  }
+  return true;
+}
+function pendingShape(value) {
+  const hasNoLineage = isRecord$2(value) && value.planId === null && value.previousOperationReceiptId === null && value.previousPlanId === null;
+  const hasExactLineage = isRecord$2(value) && SHA256.test(String(value.planId)) && typeof value.previousOperationReceiptId === "string" && value.previousOperationReceiptId.length > 0 && SHA256.test(String(value.previousPlanId));
+  return isRecord$2(value) && value.schemaVersion === 2 && value.objectType === "aops-commercial-integrity-pending-v2" && ["install", "update", "rollback"].includes(String(value.operation)) && (hasNoLineage || hasExactLineage) && (value.operation === "install" ? hasNoLineage : true) && typeof value.installationId === "string" && typeof value.hostInstanceId === "string" && (value.priorReceiptId === null || typeof value.priorReceiptId === "string") && isRecord$2(value.target) && authorityShape({
+    ...value.target,
+    localIntegrity: { scheme: "hmac-sha256-v1", mac: "0".repeat(64) }
+  }) && isRecord$2(value.localIntegrity) && value.localIntegrity.scheme === "hmac-sha256-v1" && typeof value.localIntegrity.mac === "string";
+}
+function verifyMacText(actualText, expectedText) {
+  if (!/^[a-f0-9]{64}$/.test(actualText) || !/^[a-f0-9]{64}$/.test(expectedText))
+    return false;
+  const actual = Buffer.from(actualText, "hex");
+  const expected = Buffer.from(expectedText, "hex");
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function readCommercialIntegrityAuthority(root, key) {
+  const value = parseOptionalJson(safeChild(root, "authority.json"));
+  if (value === null || !authorityShape(value))
+    return null;
+  const expected = integrityMac(key, COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE, authorityUnsigned(value));
+  if (!verifyMacText(value.localIntegrity.mac, expected)) {
+    fail$1("commercial-integrity", "integrity_authority_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readCommercialIntegrityPending(root, key) {
+  const value = parseOptionalJson(safeChild(root, "pending.json"));
+  if (value === null)
+    return null;
+  if (!pendingShape(value))
+    return "invalid";
+  const expected = integrityMac(key, COMMERCIAL_INTEGRITY_PENDING_PURPOSE, pendingUnsigned(value));
+  return verifyMacText(value.localIntegrity.mac, expected) ? value : "invalid";
+}
+function readCommercialIntegrityQuarantine(root, key) {
+  const value = parseOptionalJson(safeChild(root, "quarantine.json"));
+  if (value === null)
+    return null;
+  if (!isRecord$2(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-integrity-quarantine-v1" || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string" || typeof value.receiptId !== "string" || !SHA256.test(String(value.closureDigest)) || !Number.isSafeInteger(value.activationGeneration) || typeof value.detectedAt !== "string" || value.source !== "scheduled-verification" || typeof value.stage !== "string" || typeof value.reason !== "string" || !isRecord$2(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string")
+    fail$1("commercial-integrity", "integrity_quarantine_record_invalid", "quarantine");
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = integrityMac(key, "aops-commercial-integrity-quarantine-v1", unsigned);
+  if (!verifyMacText(value.localIntegrity.mac, expected)) {
+    fail$1("commercial-integrity", "integrity_quarantine_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readCommercialIntegrityVerificationSchedule(integrityStateRoot, now = /* @__PURE__ */ new Date()) {
+  const integrityRoot = commercialIntegrityRoot(integrityStateRoot);
+  const key = integrityRoot ? commercialIntegrityKey(integrityRoot) : null;
+  if (!integrityRoot || !key) {
+    return Object.freeze({
+      state: "authority-unavailable",
+      verifiedAt: null,
+      dueAt: null,
+      minimumIntervalHours: 24
+    });
+  }
+  if (readCommercialIntegrityQuarantine(integrityRoot, key)) {
+    return Object.freeze({
+      state: "quarantined",
+      verifiedAt: null,
+      dueAt: null,
+      minimumIntervalHours: 24
+    });
+  }
+  const authority = readCommercialIntegrityAuthority(integrityRoot, key);
+  if (!authority) {
+    return Object.freeze({
+      state: "authority-unavailable",
+      verifiedAt: null,
+      dueAt: null,
+      minimumIntervalHours: 24
+    });
+  }
+  const verifiedAtMs = Date.parse(authority.verifiedAt);
+  if (!Number.isFinite(verifiedAtMs)) {
+    return Object.freeze({
+      state: "authority-unavailable",
+      verifiedAt: null,
+      dueAt: null,
+      minimumIntervalHours: 24
+    });
+  }
+  const dueAtMs = verifiedAtMs + 24 * 60 * 60 * 1e3;
+  if (verifiedAtMs > now.getTime()) {
+    return Object.freeze({
+      state: "due",
+      verifiedAt: new Date(verifiedAtMs).toISOString(),
+      dueAt: now.toISOString(),
+      minimumIntervalHours: 24
+    });
+  }
+  return Object.freeze({
+    state: now.getTime() >= dueAtMs ? "due" : "waiting",
+    verifiedAt: new Date(verifiedAtMs).toISOString(),
+    dueAt: new Date(dueAtMs).toISOString(),
+    minimumIntervalHours: 24
+  });
+}
+function persistScheduledIntegrityQuarantine(integrityRoot, key, receipt, error, now) {
+  const unsigned = Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-commercial-integrity-quarantine-v1",
+    installationId: receipt.installationId,
+    hostInstanceId: receipt.hostInstanceId,
+    receiptId: receipt.receiptId,
+    closureDigest: receipt.closureDigest,
+    activationGeneration: receipt.activation.generation,
+    detectedAt: now.toISOString(),
+    source: "scheduled-verification",
+    stage: error instanceof CommercialArtifactError ? error.stage : "scheduled-verification",
+    reason: error instanceof CommercialArtifactError ? error.reason : "scheduled_verification_failed"
+  });
+  const value = Object.freeze({
+    ...unsigned,
+    localIntegrity: Object.freeze({
+      scheme: "hmac-sha256-v1",
+      mac: integrityMac(key, "aops-commercial-integrity-quarantine-v1", unsigned)
+    })
+  });
+  atomicWrite(safeChild(integrityRoot, "quarantine.json"), `${canonicalCommercialJson(value)}
+`);
+}
+function integrityRelativePath(storeRoot, filePath) {
+  const relative = path.relative(storeRoot, filePath).split(path.sep).join("/");
+  if (!relative || relative.startsWith("../") || path.isAbsolute(relative)) {
+    fail$1("commercial-integrity", "integrity_snapshot_path_escape", "quarantine");
+  }
+  return relative;
+}
+function integrityStoredPath(storeRoot, relativePath) {
+  let cursor = storeRoot;
+  for (const segment of relativePath.split("/"))
+    cursor = safeChild(cursor, segment);
+  return cursor;
+}
+function integrityFileRecord(storeRoot, filePath) {
+  const stat = lstatSync(filePath);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    fail$1("commercial-integrity", "integrity_snapshot_file_unsafe", "quarantine");
+  }
+  return Object.freeze({
+    relativePath: integrityRelativePath(storeRoot, filePath),
+    size: stat.size,
+    mtimeMs: stat.mtimeMs,
+    fileId: `${stat.dev}:${stat.ino}`
+  });
+}
+function runtimePackageReadOnlyRoot(nodeModulesRoot, packageName) {
+  const segments = packageName.split("/");
+  if (segments.length === 1)
+    return safeChild(nodeModulesRoot, segments[0]);
+  if (segments.length === 2 && segments[0].startsWith("@")) {
+    return safeChild(nodeModulesRoot, segments[0], segments[1]);
+  }
+  fail$1("commercial-integrity", "integrity_package_name_invalid", "quarantine");
+}
+function buildCommercialIntegrityAuthority(storeRoot, receipt, artifacts, source, now, flags = {
+  authorityReestablished: false,
+  previousAnchorUnknown: false
+}) {
+  const records = /* @__PURE__ */ new Map();
+  const add = (filePath) => {
+    const record = integrityFileRecord(storeRoot, filePath);
+    const existing = records.get(record.relativePath);
+    if (existing && existing.size !== record.size) {
+      fail$1("commercial-integrity", "integrity_snapshot_duplicate_mismatch", "quarantine");
+    }
+    records.set(record.relativePath, record);
+  };
+  for (const object of receipt.casObjects)
+    add(readOnlyObjectPath(storeRoot, object.digest));
+  const runtimeRoot = readOnlyRuntimeRootPath(storeRoot, receipt.closureDigest);
+  const nodeModulesRoot = safeChild(runtimeRoot, "node_modules");
+  const critical = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts.values()) {
+    const packageRoot = runtimePackageReadOnlyRoot(nodeModulesRoot, artifact.packageName);
+    for (const row of artifact.files) {
+      const treeFile = path.join(artifact.treePath, ...row.path.split("/"));
+      const runtimeFile = path.join(packageRoot, ...row.path.split("/"));
+      add(treeFile);
+      add(runtimeFile);
+      const candidates = critical.get(row.sha256) ?? [];
+      candidates.push(integrityRelativePath(storeRoot, runtimeFile));
+      critical.set(row.sha256, candidates);
+    }
+  }
+  const criticalFile = (digest2, reason) => {
+    const candidates = critical.get(digest2)?.sort();
+    if (!candidates?.length)
+      fail$1("commercial-integrity", reason, "quarantine");
+    return Object.freeze({ relativePath: candidates[0], digest: digest2 });
+  };
+  return Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-commercial-integrity-authority-v1",
+    installationId: receipt.installationId,
+    hostInstanceId: receipt.hostInstanceId,
+    receiptId: receipt.receiptId,
+    closureDigest: receipt.closureDigest,
+    activationGeneration: receipt.activation.generation,
+    verifiedAt: now.toISOString(),
+    verificationSource: source,
+    authorityReestablished: flags.authorityReestablished,
+    previousAnchorUnknown: flags.previousAnchorUnknown,
+    files: Object.freeze([...records.values()].sort((left, right) => compareCanonicalText(left.relativePath, right.relativePath))),
+    dcm: criticalFile(receipt.dcmDigest, "integrity_dcm_path_missing"),
+    operationCatalog: criticalFile(receipt.operationCatalogDigest, "integrity_operation_catalog_path_missing")
+  });
+}
+function persistCommercialIntegrityAuthority(integrityRoot, key, value) {
+  const authority = signCommercialIntegrityAuthority(key, value);
+  atomicWrite(safeChild(integrityRoot, "authority.json"), `${canonicalCommercialJson(authority)}
+`);
+  return authority;
+}
+function verifyRoutineIntegrityFiles(storeRoot, authority) {
+  let bytes = 0;
+  let advisoryMtimeDriftCount = 0;
+  let advisoryFileIdDriftCount = 0;
+  for (const expected of authority.files) {
+    const filePath = integrityStoredPath(storeRoot, expected.relativePath);
+    if (!existsSync(filePath))
+      return Object.freeze({
+        matches: false,
+        fileCount: authority.files.length,
+        bytes,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount
+      });
+    const stat = lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size !== expected.size) {
+      return Object.freeze({
+        matches: false,
+        fileCount: authority.files.length,
+        bytes,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount
+      });
+    }
+    bytes += stat.size;
+    if (stat.mtimeMs !== expected.mtimeMs)
+      advisoryMtimeDriftCount += 1;
+    if (`${stat.dev}:${stat.ino}` !== expected.fileId)
+      advisoryFileIdDriftCount += 1;
+  }
+  return Object.freeze({
+    matches: true,
+    fileCount: authority.files.length,
+    bytes,
+    advisoryMtimeDriftCount,
+    advisoryFileIdDriftCount
+  });
+}
+function readCriticalIntegrityFile(storeRoot, critical) {
+  const filePath = assertRegularFile(integrityStoredPath(storeRoot, critical.relativePath), "commercial-integrity", "integrity_critical_file_missing");
+  const bytes = readFileSync(filePath);
+  if (digestBytes(bytes) !== critical.digest) {
+    fail$1("commercial-integrity", "integrity_critical_file_digest_mismatch", "quarantine");
+  }
+  return bytes;
+}
+function readClosureFileByDigest(root, receipt, digest2) {
+  if (!SHA256.test(digest2))
+    fail$1("closure-readback", "closure_file_digest_invalid");
+  let matched = null;
+  for (const object of receipt.casObjects) {
+    if (!object.role.startsWith("npm:"))
+      continue;
+    const file = assertRegularFile(readOnlyObjectPath(root, object.digest), "cas-readback", "cas_object_missing");
+    const bytes = readFileSync(file);
+    if (bytes.byteLength !== object.size || digestBytes(bytes) !== object.digest) {
+      fail$1("cas-readback", "cas_object_digest_mismatch", "quarantine");
+    }
+    const archive = inspectNpmTarball(bytes);
+    for (const row of archive.files) {
+      if (row.sha256 !== digest2)
+        continue;
+      const candidate = archive.contents.get(row.path);
+      if (!candidate || digestBytes(candidate) !== digest2) {
+        fail$1("closure-readback", "closure_file_digest_mismatch", "quarantine");
+      }
+      if (matched && !matched.equals(candidate)) {
+        fail$1("closure-readback", "closure_file_digest_collision", "quarantine");
+      }
+      matched = Buffer.from(candidate);
+    }
+  }
+  if (!matched)
+    fail$1("closure-readback", "closure_file_missing", "quarantine");
+  return matched;
+}
+function readStoredManifest(root, digest2) {
+  const value = parseJsonFile$1(readOnlyManifestPath(root, digest2), "manifest-readback", "stored_manifest_invalid");
+  return value;
+}
+function assertManifestReceiptBinding(receipt, manifest) {
+  const payload = manifest.envelope.payload;
+  if (manifest.manifestDigest !== receipt.manifestDigest || payload.release.releaseId !== receipt.releaseId || payload.release.packageName !== receipt.packageName || payload.release.version !== receipt.version || payload.closureDigest !== receipt.closureDigest || payload.packlistDigest !== receipt.packlistDigest || payload.dcm.digest !== receipt.dcmDigest || payload.dcm.operationCatalogDigest !== receipt.operationCatalogDigest)
+    fail$1("manifest-readback", "manifest_receipt_mismatch", "quarantine");
+}
+function assertRoutineLaunchClosureBinding(root, receipt, payload) {
+  const roleRows = payload.closure.filter((entry) => entry.launchRole !== null);
+  const runtime = roleRows.find((entry) => entry.launchRole === "runtime-node");
+  if (!runtime)
+    fail$1("manifest-readback", "runtime_role_missing", "quarantine");
+  if (receipt.launchClosure.runtimeVersion !== runtime.version || receipt.launchClosure.entries.length !== roleRows.length)
+    fail$1("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+  for (const row of roleRows) {
+    const entry = receipt.launchClosure.entries.find((candidate) => candidate.role === row.launchRole);
+    const expectedPath = row.launchEntrypoint === null ? null : `runtimes/sha256/${receipt.closureDigest.slice("sha256:".length)}/node_modules/${row.packageName}/${row.launchEntrypoint}`;
+    if (!entry || entry.packageName !== row.packageName || entry.packageVersion !== row.version || entry.artifactDigest !== row.artifactSha256 || entry.entrypoint !== row.launchEntrypoint || entry.runtimeRange !== row.runtimeRange || entry.resolvedPath !== expectedPath)
+      fail$1("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+    const launchFile = assertRegularFile(integrityStoredPath(root, entry.resolvedPath), "manifest-readback", "launch_closure_file_missing");
+    if (statSync(launchFile).size < 0) {
+      fail$1("manifest-readback", "launch_closure_file_missing", "quarantine");
+    }
+    if (row.launchRole !== "runtime-node") {
+      if (row.runtimeRange === null) {
+        fail$1("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+      }
+      assertCommercialRuntimeCompatible(runtime.version, row.runtimeRange);
+    }
+  }
+}
+function assertAuthorityStoreBinding(authority, identity) {
+  if (authority.installationId !== identity.installationId || authority.hostInstanceId !== identity.hostInstanceId)
+    fail$1("commercial-integrity", "integrity_authority_store_identity_mismatch", "quarantine");
+}
+function readVerifiedActiveCommercialArtifact(options) {
+  const root = assertAbsoluteSafeRoot(options.storeRoot);
+  const identity = assertStoreIdentity(root, options.expectedIdentity);
+  if (existsSync(readOnlyStatePath(root, "activation-journal.json"))) {
+    fail$1("activation-readback", "activation_recovery_required", "quarantine");
+  }
+  const pointer = readPointer(root, "active.json");
+  if (!pointer)
+    return null;
+  const receipt = readReceipt(root, pointer.receiptId);
+  if (receipt.installationId !== identity.installationId || receipt.hostInstanceId !== identity.hostInstanceId)
+    fail$1("store-identity", "receipt_store_identity_mismatch", "quarantine");
+  assertRetainedHighWater(root, receipt);
+  const mode = options.verificationMode ?? "full";
+  const scheduledIntegrityRoot = mode === "scheduled" && options.integrityStateRoot ? commercialIntegrityRoot(options.integrityStateRoot) : null;
+  const scheduledKey = scheduledIntegrityRoot ? commercialIntegrityKey(scheduledIntegrityRoot) : null;
+  if (scheduledIntegrityRoot && scheduledKey && readCommercialIntegrityQuarantine(scheduledIntegrityRoot, scheduledKey))
+    fail$1("commercial-integrity", "integrity_scheduled_quarantine_active", "quarantine");
+  try {
+    const manifest = verifyReleaseManifestEnvelope(readStoredManifest(root, receipt.manifestDigest), {
+      trustKeys: options.trustKeys,
+      now: options.now,
+      knownOperationIds: options.knownOperationIds
+    });
+    assertManifestReceiptBinding(receipt, manifest);
+    const payload = manifest.envelope.payload;
+    let artifacts = null;
+    let routineAuthority = null;
+    let routineDecision = null;
+    let routineFileCount = 0;
+    let routineBytes = 0;
+    let advisoryMtimeDriftCount = 0;
+    let advisoryFileIdDriftCount = 0;
+    const routineStartedAt = process.hrtime.bigint();
+    const fullVerify = () => verifyStoredClosure(root, receipt, options.onClosureVerified);
+    if (mode === "routine" && options.integrityStateRoot) {
+      const integrityRoot = commercialIntegrityRoot(options.integrityStateRoot, false);
+      const key = integrityRoot ? commercialIntegrityKey(integrityRoot, false) : null;
+      const authority = integrityRoot && key ? readCommercialIntegrityAuthority(integrityRoot, key) : null;
+      if (integrityRoot && key && readCommercialIntegrityQuarantine(integrityRoot, key)) {
+        fail$1("commercial-integrity", "integrity_scheduled_quarantine_active", "quarantine");
+      }
+      if (!integrityRoot || !key || !authority) {
+        artifacts = fullVerify();
+        routineDecision = "full-fallback-authority-unavailable";
+      } else {
+        assertAuthorityStoreBinding(authority, identity);
+        if (authority.activationGeneration > receipt.activation.generation) {
+          fail$1("commercial-integrity", "integrity_authority_ahead", "quarantine");
+        }
+        if (authority.activationGeneration < receipt.activation.generation) {
+          const pending = readCommercialIntegrityPending(integrityRoot, key);
+          if (pending !== null && pending !== "invalid" && pending.installationId === identity.installationId && pending.hostInstanceId === identity.hostInstanceId && pending.target.receiptId === receipt.receiptId && pending.target.closureDigest === receipt.closureDigest && pending.target.activationGeneration === receipt.activation.generation) {
+            artifacts = fullVerify();
+            const healed = buildCommercialIntegrityAuthority(root, receipt, artifacts, pending.target.verificationSource, options.now ?? /* @__PURE__ */ new Date());
+            routineAuthority = persistCommercialIntegrityAuthority(integrityRoot, key, healed);
+            rmSync(safeChild(integrityRoot, "pending.json"), { force: true });
+            routineDecision = "full-heal-forward";
+          } else {
+            artifacts = fullVerify();
+            routineDecision = "full-fallback-authority-behind";
+          }
+        } else {
+          if (authority.receiptId !== receipt.receiptId || authority.closureDigest !== receipt.closureDigest)
+            fail$1("commercial-integrity", "integrity_authority_receipt_mismatch", "quarantine");
+          const sweep = verifyRoutineIntegrityFiles(root, authority);
+          routineFileCount = sweep.fileCount;
+          routineBytes = sweep.bytes;
+          advisoryMtimeDriftCount = sweep.advisoryMtimeDriftCount;
+          advisoryFileIdDriftCount = sweep.advisoryFileIdDriftCount;
+          if (!sweep.matches) {
+            artifacts = fullVerify();
+            const refreshed = buildCommercialIntegrityAuthority(root, receipt, artifacts, "routine-size-drift-full-verify", options.now ?? /* @__PURE__ */ new Date());
+            routineAuthority = persistCommercialIntegrityAuthority(integrityRoot, key, refreshed);
+            routineDecision = "full-fallback-size-drift";
+          } else {
+            routineAuthority = authority;
+            routineDecision = "verified";
+          }
+        }
+      }
+    } else {
+      artifacts = fullVerify();
+      if (mode === "scheduled" && options.integrityStateRoot) {
+        const integrityRoot = scheduledIntegrityRoot;
+        const key = scheduledKey;
+        const authority = integrityRoot && key ? readCommercialIntegrityAuthority(integrityRoot, key) : null;
+        if (!integrityRoot || !key || !authority) {
+          fail$1("commercial-integrity", "integrity_authority_reestablish_required", "quarantine");
+        }
+        assertAuthorityStoreBinding(authority, identity);
+        if (authority.activationGeneration > receipt.activation.generation) {
+          fail$1("commercial-integrity", "integrity_authority_ahead", "quarantine");
+        }
+        if (authority.activationGeneration < receipt.activation.generation) {
+          fail$1("commercial-integrity", "integrity_authority_behind_reestablish_required", "quarantine");
+        }
+        if (authority.receiptId !== receipt.receiptId || authority.closureDigest !== receipt.closureDigest) {
+          fail$1("commercial-integrity", "integrity_authority_receipt_mismatch", "quarantine");
+        }
+        persistCommercialIntegrityAuthority(integrityRoot, key, buildCommercialIntegrityAuthority(root, receipt, artifacts, "scheduled", options.now ?? /* @__PURE__ */ new Date()));
+      }
+    }
+    if (artifacts) {
+      const launchClosure = resolveLaunchClosure(payload, artifacts);
+      if (canonicalCommercialJson(launchClosure) !== canonicalCommercialJson(receipt.launchClosure)) {
+        fail$1("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+      }
+    } else {
+      assertRoutineLaunchClosureBinding(root, receipt, payload);
+    }
+    const dcmBytes = routineAuthority ? readCriticalIntegrityFile(root, routineAuthority.dcm) : readClosureFileByDigest(root, receipt, receipt.dcmDigest);
+    const operationCatalogBytes = routineAuthority ? readCriticalIntegrityFile(root, routineAuthority.operationCatalog) : readClosureFileByDigest(root, receipt, receipt.operationCatalogDigest);
+    if (mode === "scheduled" && scheduledIntegrityRoot && scheduledKey) {
+      rmSync(safeChild(scheduledIntegrityRoot, "quarantine.json"), { force: true });
+    }
+    if (routineDecision) {
+      if (routineAuthority && routineFileCount === 0) {
+        const sweep = verifyRoutineIntegrityFiles(root, routineAuthority);
+        routineFileCount = sweep.fileCount;
+        routineBytes = sweep.bytes;
+        advisoryMtimeDriftCount = sweep.advisoryMtimeDriftCount;
+        advisoryFileIdDriftCount = sweep.advisoryFileIdDriftCount;
+      }
+      options.onRoutineVerified?.(Object.freeze({
+        elapsedMs: Number(process.hrtime.bigint() - routineStartedAt) / 1e6,
+        authorityDecision: routineDecision,
+        authoritativeFileCount: routineFileCount,
+        authoritativeBytes: routineBytes,
+        authoritativeBytesDerivedFromFileMetadata: true,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount,
+        fullVerificationPerformed: routineDecision !== "verified"
+      }));
+    }
+    return Object.freeze({
+      receipt,
+      manifest,
+      dcmBytes,
+      operationCatalogBytes
+    });
+  } catch (error) {
+    if (mode === "scheduled" && scheduledIntegrityRoot && scheduledKey) {
+      persistScheduledIntegrityQuarantine(scheduledIntegrityRoot, scheduledKey, receipt, error, options.now ?? /* @__PURE__ */ new Date());
+    }
+    throw error;
+  }
+}
+const INSTALLATION_POSSESSION_PROOF_ALGORITHM = "EdDSA";
+const INSTALLATION_POSSESSION_PROOF_TYPE = "aops-installation-possession-proof+jws";
+const INSTALLATION_POSSESSION_PROOF_PURPOSE = "urn:aops:installation-possession:v1";
+const INSTALLATION_POSSESSION_PROOF_SCHEMA_VERSION = 1;
+const MAX_INSTALLATION_POSSESSION_PROOF_LIFETIME_SECONDS = 5 * 60;
+const CLOCK_SKEW_SECONDS = 30;
+const MAX_PROOF_BYTES = 32 * 1024;
+const SHA256_HEX$1 = /^[a-f0-9]{64}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const PAYLOAD_KEYS = Object.freeze([
+  "activationChallengeDigest",
+  "exp",
+  "hostInstanceId",
+  "iat",
+  "installationId",
+  "installationPublicKeyJwk",
+  "leaseDigest",
+  "nonce",
+  "proofId",
+  "purpose",
+  "receiptBinding",
+  "schemaVersion"
+]);
+function fail(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function isRecord$1(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys$1(value, expected, stage) {
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (actual.length !== sortedExpected.length || actual.some((key, index) => key !== sortedExpected[index]))
+    fail(stage, "installation_possession_schema_invalid");
+}
+function text$1(value, maximum = 512) {
+  if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > maximum)
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  return value;
+}
+function integer(value) {
+  if (!Number.isSafeInteger(value)) {
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  }
+  return value;
+}
+function sha256$1(value) {
+  const normalized = text$1(value, 64);
+  if (!SHA256_HEX$1.test(normalized)) {
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  }
+  return normalized;
+}
+function hash(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function normalizeNonce(value) {
+  const normalized = text$1(value, 256);
+  if (!BASE64URL.test(normalized)) {
+    fail("installation-possession-schema", "installation_possession_nonce_invalid");
+  }
+  const bytes = Buffer.from(normalized, "base64url");
+  if (bytes.length < 32 || bytes.length > 128 || bytes.toString("base64url") !== normalized)
+    fail("installation-possession-schema", "installation_possession_nonce_invalid");
+  return normalized;
+}
+function publicJwk(value) {
+  if (!isRecord$1(value)) {
+    fail("installation-possession-schema", "installation_possession_key_invalid");
+  }
+  exactKeys$1(value, ["crv", "kty", "x"], "installation-possession-schema");
+  if (value.kty !== "OKP" || value.crv !== "Ed25519" || typeof value.x !== "string" || !BASE64URL.test(value.x))
+    fail("installation-possession-schema", "installation_possession_key_invalid");
+  const normalized = Object.freeze({
+    kty: "OKP",
+    crv: "Ed25519",
+    x: value.x
+  });
+  try {
+    const key = createPublicKey({ key: normalized, format: "jwk" });
+    if (key.asymmetricKeyType !== "ed25519") {
+      fail("installation-possession-schema", "installation_possession_key_invalid");
+    }
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail("installation-possession-schema", "installation_possession_key_invalid");
+  }
+  return normalized;
+}
+function receiptBinding(value) {
+  if (!isRecord$1(value)) {
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  }
+  exactKeys$1(value, ["closureDigest", "manifestDigest", "receiptId", "releaseId"], "installation-possession-schema");
+  return Object.freeze({
+    receiptId: text$1(value.receiptId, 200),
+    releaseId: text$1(value.releaseId),
+    manifestDigest: sha256$1(value.manifestDigest),
+    closureDigest: sha256$1(value.closureDigest)
+  });
+}
+function normalizeInstallationPossessionProofPayload(value) {
+  if (!isRecord$1(value)) {
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  }
+  exactKeys$1(value, PAYLOAD_KEYS, "installation-possession-schema");
+  if (integer(value.schemaVersion) !== INSTALLATION_POSSESSION_PROOF_SCHEMA_VERSION || value.purpose !== INSTALLATION_POSSESSION_PROOF_PURPOSE)
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  const proofId = text$1(value.proofId, 64).toLowerCase();
+  if (!UUID.test(proofId)) {
+    fail("installation-possession-schema", "installation_possession_schema_invalid");
+  }
+  const iat = integer(value.iat);
+  const exp = integer(value.exp);
+  if (iat < 0 || exp <= iat || exp - iat > MAX_INSTALLATION_POSSESSION_PROOF_LIFETIME_SECONDS)
+    fail("installation-possession-schema", "installation_possession_window_invalid");
+  return Object.freeze({
+    schemaVersion: 1,
+    purpose: INSTALLATION_POSSESSION_PROOF_PURPOSE,
+    proofId,
+    nonce: normalizeNonce(value.nonce),
+    installationId: text$1(value.installationId, 200),
+    hostInstanceId: text$1(value.hostInstanceId, 200),
+    installationPublicKeyJwk: publicJwk(value.installationPublicKeyJwk),
+    leaseDigest: sha256$1(value.leaseDigest),
+    activationChallengeDigest: sha256$1(value.activationChallengeDigest),
+    receiptBinding: receiptBinding(value.receiptBinding),
+    iat,
+    exp
+  });
+}
+function encode(value) {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function decodeSegment(segment, stage) {
+  if (!BASE64URL.test(segment))
+    fail(stage, "installation_possession_compact_invalid");
+  const decoded = Buffer.from(segment, "base64url");
+  if (decoded.toString("base64url") !== segment) {
+    fail(stage, "installation_possession_compact_invalid");
+  }
+  return decoded;
+}
+function decodeJson(segment, stage) {
+  try {
+    const value = JSON.parse(decodeSegment(segment, stage).toString("utf8"));
+    if (!isRecord$1(value))
+      fail(stage, "installation_possession_schema_invalid");
+    return value;
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail(stage, "installation_possession_json_invalid");
+  }
+}
+function createInstallationPossessionProof(input) {
+  const installationPublicKeyJwk = installationPublicJwkFromPrivateKey(input.privateKeyPem);
+  const payload = normalizeInstallationPossessionProofPayload({
+    schemaVersion: 1,
+    purpose: INSTALLATION_POSSESSION_PROOF_PURPOSE,
+    proofId: input.proofId,
+    nonce: input.nonce,
+    installationId: input.installationId,
+    hostInstanceId: input.hostInstanceId,
+    installationPublicKeyJwk,
+    leaseDigest: hash(input.leaseToken),
+    activationChallengeDigest: input.activationChallengeDigest,
+    receiptBinding: input.receiptBinding,
+    iat: input.iat,
+    exp: input.exp
+  });
+  const installationKeyThumbprint = offlineActivationKeyThumbprint(payload.installationPublicKeyJwk);
+  const header = Object.freeze({
+    alg: INSTALLATION_POSSESSION_PROOF_ALGORITHM,
+    typ: INSTALLATION_POSSESSION_PROOF_TYPE,
+    kid: `installation/${installationKeyThumbprint}`
+  });
+  const signingInput = `${encode(header)}.${encode(payload)}`;
+  let signature;
+  try {
+    const privateKey = createPrivateKey(input.privateKeyPem);
+    if (privateKey.asymmetricKeyType !== "ed25519") {
+      fail("installation-possession-signature", "installation_possession_key_invalid");
+    }
+    signature = sign(null, Buffer.from(signingInput, "ascii"), privateKey);
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail("installation-possession-signature", "installation_possession_signature_invalid");
+  }
+  const token = `${signingInput}.${signature.toString("base64url")}`;
+  return Object.freeze({
+    token,
+    payload,
+    proofDigest: hash(token),
+    installationKeyThumbprint
+  });
+}
+function verifyInstallationPossessionProof(input) {
+  if (typeof input.token !== "string" || input.token.length < 16 || Buffer.byteLength(input.token, "utf8") > MAX_PROOF_BYTES)
+    fail("installation-possession-schema", "installation_possession_compact_invalid");
+  const parts = input.token.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+    fail("installation-possession-schema", "installation_possession_compact_invalid");
+  }
+  const header = decodeJson(parts[0], "installation-possession-schema");
+  exactKeys$1(header, ["alg", "kid", "typ"], "installation-possession-schema");
+  if (header.alg !== INSTALLATION_POSSESSION_PROOF_ALGORITHM || header.typ !== INSTALLATION_POSSESSION_PROOF_TYPE) {
+    fail("installation-possession-signature", "installation_possession_signature_context_invalid");
+  }
+  const payload = normalizeInstallationPossessionProofPayload(decodeJson(parts[1], "installation-possession-schema"));
+  const installationKeyThumbprint = offlineActivationKeyThumbprint(payload.installationPublicKeyJwk);
+  if (header.kid !== `installation/${installationKeyThumbprint}` || installationKeyThumbprint !== input.expected.installationKeyThumbprint)
+    fail("installation-possession-coverage", "installation_key_not_bound");
+  let signature;
+  try {
+    signature = decodeSegment(parts[2], "installation-possession-signature");
+  } catch {
+    fail("installation-possession-signature", "installation_possession_signature_invalid");
+  }
+  const key = createPublicKey({
+    key: payload.installationPublicKeyJwk,
+    format: "jwk"
+  });
+  if (!verify(null, Buffer.from(`${parts[0]}.${parts[1]}`, "ascii"), key, signature)) {
+    fail("installation-possession-signature", "installation_possession_signature_invalid");
+  }
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const nowSeconds = Math.floor(now.getTime() / 1e3);
+  if (!Number.isSafeInteger(nowSeconds)) {
+    fail("installation-possession-validity", "clock_invalid");
+  }
+  if (nowSeconds + CLOCK_SKEW_SECONDS < payload.iat) {
+    fail("installation-possession-validity", "installation_possession_not_yet_valid");
+  }
+  if (nowSeconds >= payload.exp) {
+    fail("installation-possession-validity", "installation_possession_expired");
+  }
+  const expected = input.expected;
+  if (payload.nonce !== normalizeNonce(expected.nonce)) {
+    fail("installation-possession-coverage", "installation_possession_nonce_mismatch");
+  }
+  if (payload.installationId !== expected.installationId || payload.hostInstanceId !== expected.hostInstanceId)
+    fail("installation-possession-coverage", "installation_identity_not_bound");
+  if (payload.leaseDigest !== hash(expected.leaseToken)) {
+    fail("installation-possession-coverage", "lease_not_bound");
+  }
+  if (payload.activationChallengeDigest !== expected.activationChallengeDigest) {
+    fail("installation-possession-coverage", "activation_challenge_not_bound");
+  }
+  if (payload.receiptBinding.receiptId !== expected.receiptId || payload.receiptBinding.releaseId !== expected.releaseId || payload.receiptBinding.manifestDigest !== expected.manifestDigest || payload.receiptBinding.closureDigest !== expected.closureDigest)
+    fail("installation-possession-coverage", "receipt_not_bound");
+  return Object.freeze({
+    token: input.token,
+    payload,
+    proofDigest: hash(input.token),
+    installationKeyThumbprint,
+    verifiedAt: now.toISOString()
+  });
+}
+function commercialIntegrityReadOptions(storeRoot, requestedMode = "routine") {
+  const layout = resolveManagedInstallationLayout();
+  if (path.resolve(storeRoot) !== path.resolve(layout.storeRoot)) {
+    if (requestedMode === "scheduled") {
+      throw new Error("commercial_integrity_scheduler_requires_managed_store");
+    }
+    return Object.freeze({ verificationMode: "full" });
+  }
+  return Object.freeze({
+    integrityStateRoot: layout.stateRoot,
+    verificationMode: requestedMode
+  });
+}
+const CONFIG_KEYS_V1 = Object.freeze([
+  "domain",
+  "entitlementEpoch",
+  "extensionNamespace",
+  "hostInstanceId",
+  "installationId",
+  "issuer",
+  "leaseFile",
+  "leaseMode",
+  "leaseTrustBundle",
+  "minimumRevocationEpoch",
+  "objectType",
+  "productId",
+  "releaseTrustBundle",
+  "schemaVersion",
+  "storeRoot",
+  "tenantId",
+  "target"
+]);
+const CONFIG_KEYS_V2 = Object.freeze([
+  ...CONFIG_KEYS_V1,
+  "activationChallengeDigest",
+  "installationKeyThumbprint",
+  "installationPrivateKeyFile"
+]);
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, expected, reason) {
+  const actual = Object.keys(value).sort();
+  const sorted = [...expected].sort();
+  if (actual.length !== sorted.length || actual.some((key, index) => key !== sorted[index])) {
+    throw new Error(reason);
+  }
+}
+function text(value, reason) {
+  if (typeof value !== "string" || value !== value.trim() || value.length === 0) {
+    throw new Error(reason);
+  }
+  return value;
+}
+function nullableInteger(value, reason) {
+  if (value === null) return null;
+  if (!Number.isSafeInteger(value) || Number(value) < 0) throw new Error(reason);
+  return Number(value);
+}
+function sha256(value, reason) {
+  const normalized = text(value, reason);
+  if (!SHA256_HEX.test(normalized)) throw new Error(reason);
+  return normalized;
+}
+function digestHex(value, reason) {
+  const normalized = value.startsWith("sha256:") ? value.slice("sha256:".length) : value;
+  if (!SHA256_HEX.test(normalized)) throw new Error(reason);
+  return normalized;
+}
+function safeRegularFile(filePath, reason) {
+  if (!path.isAbsolute(filePath)) throw new Error(reason);
+  try {
+    const stat = lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(reason);
+    return realpathSync.native(filePath);
+  } catch {
+    throw new Error(reason);
+  }
+}
+function verifyOfflineInstallationPossessionAtLoad(input) {
+  const privateKeyPem = readFileSync(
+    safeRegularFile(
+      input.installationPrivateKeyFile,
+      "commercial_installation_private_key_invalid"
+    ),
+    "utf8"
+  );
+  const nonce = randomBytes(32).toString("base64url");
+  const iat = Math.floor(input.now.getTime() / 1e3);
+  const manifestDigest = digestHex(
+    input.receipt.manifestDigest,
+    "commercial_installation_possession_invalid"
+  );
+  const closureDigest = digestHex(
+    input.receipt.closureDigest,
+    "commercial_installation_possession_invalid"
+  );
+  try {
+    const proof = createInstallationPossessionProof({
+      privateKeyPem,
+      proofId: randomUUID(),
+      nonce,
+      installationId: input.installationId,
+      hostInstanceId: input.hostInstanceId,
+      leaseToken: input.leaseToken,
+      activationChallengeDigest: input.activationChallengeDigest,
+      receiptBinding: {
+        receiptId: input.receipt.receiptId,
+        releaseId: input.receipt.releaseId,
+        manifestDigest,
+        closureDigest
+      },
+      iat,
+      exp: iat + 2 * 60
+    });
+    verifyInstallationPossessionProof({
+      token: proof.token,
+      now: input.now,
+      expected: {
+        nonce,
+        installationId: input.installationId,
+        hostInstanceId: input.hostInstanceId,
+        installationKeyThumbprint: input.installationKeyThumbprint,
+        leaseToken: input.leaseToken,
+        activationChallengeDigest: input.activationChallengeDigest,
+        receiptId: input.receipt.receiptId,
+        releaseId: input.receipt.releaseId,
+        manifestDigest,
+        closureDigest
+      }
+    });
+  } catch {
+    throw new Error("commercial_installation_possession_invalid");
+  }
+}
+function safeRuntimeEntrypoint(storeRoot, relativePath) {
+  if (!path.isAbsolute(storeRoot) || path.isAbsolute(relativePath) || relativePath.split(/[\\/]/u).some((segment) => !segment || segment === "." || segment === "..")) throw new Error("commercial_runtime_entrypoint_invalid");
+  const root = realpathSync.native(storeRoot);
+  const candidate = path.resolve(root, relativePath);
+  const relative = path.relative(root, candidate);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error("commercial_runtime_entrypoint_invalid");
+  }
+  const real = safeRegularFile(candidate, "commercial_runtime_entrypoint_invalid");
+  const realRelative = path.relative(root, real);
+  if (!realRelative || realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
+    throw new Error("commercial_runtime_entrypoint_invalid");
+  }
+  return real;
+}
+function parseJsonFile(filePath, reason) {
+  try {
+    return JSON.parse(readFileSync(safeRegularFile(filePath, reason), "utf8"));
+  } catch (error) {
+    if (error instanceof Error && error.message === reason) throw error;
+    throw new Error(reason);
+  }
+}
+function parseConfig(filePath) {
+  const value = parseJsonFile(filePath, "commercial_admission_config_invalid");
+  if (!isRecord(value)) throw new Error("commercial_admission_config_invalid");
+  const schemaVersion = value.schemaVersion;
+  if (schemaVersion !== 1 && schemaVersion !== 2 || value.objectType !== `aops-commercial-admission-config-v${schemaVersion}`) throw new Error("commercial_admission_config_invalid");
+  exactKeys(
+    value,
+    schemaVersion === 1 ? CONFIG_KEYS_V1 : CONFIG_KEYS_V2,
+    "commercial_admission_config_invalid"
+  );
+  const leaseMode = value.leaseMode;
+  if (leaseMode !== null && leaseMode !== "online" && leaseMode !== "offline") {
+    throw new Error("commercial_admission_config_invalid");
+  }
+  if (schemaVersion === 2 && leaseMode !== "offline") {
+    throw new Error("commercial_admission_config_invalid");
+  }
+  return Object.freeze({
+    schemaVersion,
+    target: text(value.target, "commercial_admission_config_invalid"),
+    storeRoot: text(value.storeRoot, "commercial_admission_config_invalid"),
+    releaseTrustBundle: text(value.releaseTrustBundle, "commercial_admission_config_invalid"),
+    leaseFile: text(value.leaseFile, "commercial_admission_config_invalid"),
+    leaseTrustBundle: text(value.leaseTrustBundle, "commercial_admission_config_invalid"),
+    issuer: text(value.issuer, "commercial_admission_config_invalid"),
+    tenantId: text(value.tenantId, "commercial_admission_config_invalid"),
+    installationId: text(value.installationId, "commercial_admission_config_invalid"),
+    hostInstanceId: text(value.hostInstanceId, "commercial_admission_config_invalid"),
+    productId: text(value.productId, "commercial_admission_config_invalid"),
+    domain: text(value.domain, "commercial_admission_config_invalid").toLowerCase(),
+    extensionNamespace: text(value.extensionNamespace, "commercial_admission_config_invalid"),
+    entitlementEpoch: nullableInteger(value.entitlementEpoch, "commercial_admission_config_invalid"),
+    minimumRevocationEpoch: nullableInteger(
+      value.minimumRevocationEpoch,
+      "commercial_admission_config_invalid"
+    ),
+    leaseMode,
+    activationChallengeDigest: schemaVersion === 1 ? null : sha256(value.activationChallengeDigest, "commercial_admission_config_invalid"),
+    installationKeyThumbprint: schemaVersion === 1 ? null : sha256(value.installationKeyThumbprint, "commercial_admission_config_invalid"),
+    installationPrivateKeyFile: schemaVersion === 1 ? null : text(value.installationPrivateKeyFile, "commercial_admission_config_invalid")
+  });
+}
+function parseReleaseTrustBundleFile(filePath) {
+  const value = parseJsonFile(filePath, "release_trust_bundle_invalid");
+  if (!isRecord(value)) throw new Error("release_trust_bundle_invalid");
+  exactKeys(
+    value,
+    ["schemaVersion", "objectType", "purpose", "keys"],
+    "release_trust_bundle_invalid"
+  );
+  if (value.schemaVersion !== 1 || value.objectType !== "aops-release-trust-bundle-v1" || value.purpose !== RELEASE_MANIFEST_PURPOSE || !Array.isArray(value.keys) || value.keys.length === 0) throw new Error("release_trust_bundle_invalid");
+  const keys = value.keys.map((candidate) => {
+    if (!isRecord(candidate)) throw new Error("release_trust_bundle_invalid");
+    const actualKeys = Object.keys(candidate).sort();
+    const legacyKeys = ["alg", "kid", "publicKeyPem", "purpose"];
+    const rotatingKeys = [
+      "alg",
+      "kid",
+      "notAfter",
+      "notBefore",
+      "publicKeyPem",
+      "purpose",
+      "status"
+    ];
+    const rotating = actualKeys.length === rotatingKeys.length && actualKeys.every((key, index) => key === rotatingKeys[index]);
+    if (!rotating && (actualKeys.length !== legacyKeys.length || actualKeys.some((key, index) => key !== legacyKeys[index]))) throw new Error("release_trust_bundle_invalid");
+    if (candidate.alg !== "EdDSA" || candidate.purpose !== RELEASE_MANIFEST_PURPOSE || typeof candidate.kid !== "string" || typeof candidate.publicKeyPem !== "string" || rotating && !["active", "verify-only", "retired", "revoked"].includes(
+      String(candidate.status)
+    ) || rotating && candidate.notBefore !== null && typeof candidate.notBefore !== "string" || rotating && candidate.notAfter !== null && typeof candidate.notAfter !== "string") throw new Error("release_trust_bundle_invalid");
+    if (candidate.kid.toLowerCase().includes("test-ephemeral")) {
+      throw new Error("release_trust_test_key_refused");
+    }
+    return Object.freeze({
+      alg: "EdDSA",
+      purpose: RELEASE_MANIFEST_PURPOSE,
+      kid: candidate.kid,
+      publicKeyPem: candidate.publicKeyPem,
+      ...rotating ? {
+        status: candidate.status,
+        ...candidate.notBefore === null ? {} : { notBefore: candidate.notBefore },
+        ...candidate.notAfter === null ? {} : { notAfter: candidate.notAfter }
+      } : {}
+    });
+  });
+  if (new Set(keys.map((key) => key.kid)).size !== keys.length) {
+    throw new Error("release_trust_bundle_invalid");
+  }
+  return Object.freeze(keys);
+}
+function parseLeaseTrustBundle(filePath) {
+  const value = parseJsonFile(filePath, "lease_trust_bundle_invalid");
+  if (!isRecord(value)) throw new Error("lease_trust_bundle_invalid");
+  exactKeys(
+    value,
+    ["schemaVersion", "objectType", "purpose", "keys"],
+    "lease_trust_bundle_invalid"
+  );
+  if (value.schemaVersion !== 1 || value.objectType !== "aops-entitlement-lease-trust-bundle-v1" || value.purpose !== ENTITLEMENT_LEASE_PURPOSE || !Array.isArray(value.keys) || value.keys.length === 0) throw new Error("lease_trust_bundle_invalid");
+  const keys = value.keys.map((candidate) => {
+    if (!isRecord(candidate)) throw new Error("lease_trust_bundle_invalid");
+    exactKeys(
+      candidate,
+      ["alg", "kid", "notAfter", "notBefore", "publicKeyPem", "purpose", "status"],
+      "lease_trust_bundle_invalid"
+    );
+    if (candidate.alg !== ENTITLEMENT_LEASE_ALGORITHM || candidate.purpose !== ENTITLEMENT_LEASE_PURPOSE || typeof candidate.kid !== "string" || typeof candidate.publicKeyPem !== "string" || candidate.status !== "active" && candidate.status !== "verify-only" || candidate.notBefore !== null && typeof candidate.notBefore !== "string" || candidate.notAfter !== null && typeof candidate.notAfter !== "string") throw new Error("lease_trust_bundle_invalid");
+    return Object.freeze({
+      alg: ENTITLEMENT_LEASE_ALGORITHM,
+      purpose: ENTITLEMENT_LEASE_PURPOSE,
+      kid: candidate.kid,
+      publicKeyPem: candidate.publicKeyPem,
+      status: candidate.status,
+      ...candidate.notBefore === null ? {} : { notBefore: candidate.notBefore },
+      ...candidate.notAfter === null ? {} : { notAfter: candidate.notAfter }
+    });
+  });
+  if (new Set(keys.map((key) => key.kid)).size !== keys.length) {
+    throw new Error("lease_trust_bundle_invalid");
+  }
+  return Object.freeze(keys);
+}
+function parseOperations(dcmBytes, operationCatalogBytes, domain, extension) {
+  let dcmValue;
+  let catalogValue;
+  try {
+    dcmValue = JSON.parse(dcmBytes.toString("utf8"));
+    catalogValue = JSON.parse(operationCatalogBytes.toString("utf8"));
+  } catch {
+    throw new Error("commercial_operation_contract_invalid");
+  }
+  if (!isRecord(dcmValue) || !isRecord(dcmValue.domain) || dcmValue.domain.id !== domain || !isRecord(dcmValue.capabilities) || !Array.isArray(dcmValue.capabilities.operations) || !Array.isArray(catalogValue) || !isRecord(extension)) throw new Error("commercial_operation_contract_invalid");
+  const featureBindings = extension.operationFeatures;
+  if (!Array.isArray(featureBindings)) throw new Error("commercial_operation_contract_invalid");
+  const features = /* @__PURE__ */ new Map();
+  let previousOperationId = "";
+  for (const binding of featureBindings) {
+    if (!isRecord(binding)) throw new Error("commercial_operation_contract_invalid");
+    exactKeys(binding, ["operationId", "requiredFeatureIds"], "commercial_operation_contract_invalid");
+    if (typeof binding.operationId !== "string" || !Array.isArray(binding.requiredFeatureIds)) {
+      throw new Error("commercial_operation_contract_invalid");
+    }
+    const required = binding.requiredFeatureIds.map((entry) => text(entry, "commercial_operation_contract_invalid"));
+    if (binding.operationId <= previousOperationId || required.length === 0 || new Set(required).size !== required.length || required.some((entry, index) => entry !== [...required].sort()[index])) throw new Error("commercial_operation_contract_invalid");
+    previousOperationId = binding.operationId;
+    features.set(binding.operationId, Object.freeze(required));
+  }
+  const catalog = /* @__PURE__ */ new Map();
+  for (const operation of catalogValue) {
+    if (!isRecord(operation) || typeof operation.operationId !== "string" || typeof operation.sideEffect !== "string" || catalog.has(operation.operationId)) throw new Error("commercial_operation_contract_invalid");
+    catalog.set(operation.operationId, operation);
+  }
+  const policies = dcmValue.capabilities.operations.map((operation) => {
+    if (!isRecord(operation) || typeof operation.operationId !== "string" || !["none", "db", "fs", "network", "mixed"].includes(String(operation.sideEffect)) || !features.has(operation.operationId)) throw new Error("commercial_operation_contract_invalid");
+    const catalogOperation = catalog.get(operation.operationId);
+    if (!catalogOperation || catalogOperation.sideEffect !== operation.sideEffect) {
+      throw new Error("commercial_operation_contract_invalid");
+    }
+    return Object.freeze({
+      operationId: operation.operationId,
+      requiredFeatureIds: features.get(operation.operationId),
+      sideEffect: operation.sideEffect,
+      ...isRecord(operation.safety) ? {
+        safety: Object.freeze({
+          destructive: operation.safety.destructive === true,
+          confirmationRequired: operation.safety.confirmationRequired === true,
+          applyRequired: operation.safety.applyRequired === true
+        })
+      } : {}
+    });
+  });
+  if (catalog.size !== policies.length || features.size !== policies.length) {
+    throw new Error("commercial_operation_contract_invalid");
+  }
+  return Object.freeze(policies);
+}
+function loadCommercialAdmissionSnapshot(configFile, freeDomains, now = /* @__PURE__ */ new Date(), generation) {
+  const config = parseConfig(configFile);
+  const active = readVerifiedActiveCommercialArtifact({
+    storeRoot: config.storeRoot,
+    ...commercialIntegrityReadOptions(config.storeRoot),
+    trustKeys: parseReleaseTrustBundleFile(config.releaseTrustBundle),
+    now,
+    expectedIdentity: {
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId
+    }
+  });
+  if (!active) throw new Error("commercial_artifact_not_active");
+  const extension = active.manifest.envelope.payload.extensions[config.extensionNamespace];
+  if (!isRecord(extension) || extension.releaseTier !== "commercial" || !Array.isArray(extension.productIds) || !extension.productIds.includes(config.productId)) throw new Error("commercial_release_extension_invalid");
+  const hostProjection = extension.hostProjection;
+  if (!isRecord(hostProjection)) throw new Error("commercial_release_extension_invalid");
+  exactKeys(
+    hostProjection,
+    ["manifestExport", "pluginFactory"],
+    "commercial_release_extension_invalid"
+  );
+  const pluginFactory = text(
+    hostProjection.pluginFactory,
+    "commercial_release_extension_invalid"
+  );
+  const manifestExport = text(
+    hostProjection.manifestExport,
+    "commercial_release_extension_invalid"
+  );
+  const operations = parseOperations(
+    active.dcmBytes,
+    active.operationCatalogBytes,
+    config.domain,
+    extension
+  );
+  const token = readFileSync(safeRegularFile(config.leaseFile, "entitlement_lease_file_invalid"), "utf8").trim();
+  const lease = verifyEntitlementLease({
+    token,
+    trustKeys: parseLeaseTrustBundle(config.leaseTrustBundle),
+    issuer: config.issuer,
+    now,
+    expected: {
+      tenantId: config.tenantId,
+      installationId: config.installationId,
+      productId: config.productId,
+      domain: config.domain,
+      manifestDigest: active.manifest.manifestDigest,
+      closureDigest: active.receipt.closureDigest,
+      ...config.entitlementEpoch === null ? {} : {
+        entitlementEpoch: config.entitlementEpoch
+      },
+      ...config.minimumRevocationEpoch === null ? {} : {
+        minimumRevocationEpoch: config.minimumRevocationEpoch
+      },
+      ...config.leaseMode === null ? {} : { leaseMode: config.leaseMode },
+      ...config.installationKeyThumbprint === null ? {} : {
+        installationKeyThumbprint: config.installationKeyThumbprint
+      },
+      ...config.activationChallengeDigest === null ? {} : {
+        activationChallengeDigest: config.activationChallengeDigest
+      }
+    }
+  });
+  if (config.schemaVersion === 2) {
+    if (lease.claims.schemaVersion !== 2 || config.installationPrivateKeyFile === null || config.installationKeyThumbprint === null || config.activationChallengeDigest === null) throw new Error("commercial_installation_possession_invalid");
+    verifyOfflineInstallationPossessionAtLoad({
+      installationPrivateKeyFile: config.installationPrivateKeyFile,
+      installationKeyThumbprint: config.installationKeyThumbprint,
+      activationChallengeDigest: config.activationChallengeDigest,
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId,
+      leaseToken: token,
+      receipt: {
+        receiptId: active.receipt.receiptId,
+        releaseId: active.receipt.releaseId,
+        manifestDigest: active.receipt.manifestDigest,
+        closureDigest: active.receipt.closureDigest
+      },
+      now
+    });
+  }
+  const operationIds = new Set(operations.map((operation) => operation.operationId));
+  if (active.manifest.envelope.payload.degradedOperationIds.some(
+    (operationId) => !operationIds.has(operationId)
+  )) throw new Error("commercial_operation_contract_invalid");
+  const manifestEntrypoint = active.receipt.resolvedEntrypoints.manifestProviders[0] ?? active.receipt.resolvedEntrypoints.dcmProviders[0];
+  if (!manifestEntrypoint) throw new Error("commercial_runtime_entrypoint_invalid");
+  const snapshot = buildAdmittedDomainSnapshot({
+    generation: generation ?? Math.max(2, active.receipt.activation.generation + 1),
+    freeDomains,
+    commercialDomains: [{
+      domain: config.domain,
+      productId: config.productId,
+      receipt: active.receipt,
+      manifest: active.manifest,
+      lease,
+      operations
+    }],
+    now
+  });
+  return Object.freeze({
+    snapshot,
+    runtime: Object.freeze({
+      domain: config.domain,
+      pluginModule: safeRuntimeEntrypoint(
+        config.storeRoot,
+        active.receipt.resolvedEntrypoints.plugin
+      ),
+      pluginFactory,
+      manifestModule: safeRuntimeEntrypoint(config.storeRoot, manifestEntrypoint),
+      manifestExport
+    })
+  });
+}
+function readCommercialAdmissionIntegritySchedule(configFile, now = /* @__PURE__ */ new Date()) {
+  const config = parseConfig(configFile);
+  const options = commercialIntegrityReadOptions(config.storeRoot, "scheduled");
+  if (!options.integrityStateRoot) {
+    throw new Error("commercial_integrity_scheduler_requires_managed_store");
+  }
+  return readCommercialIntegrityVerificationSchedule(options.integrityStateRoot, now);
+}
+function resolveCommercialIntegrityWorkerInput(configFile) {
+  const config = parseConfig(configFile);
+  const options = commercialIntegrityReadOptions(config.storeRoot, "scheduled");
+  if (!options.integrityStateRoot) {
+    throw new Error("commercial_integrity_scheduler_requires_managed_store");
+  }
+  return Object.freeze({
+    storeRoot: config.storeRoot,
+    integrityStateRoot: options.integrityStateRoot,
+    trustKeys: parseReleaseTrustBundleFile(config.releaseTrustBundle),
+    expectedIdentity: Object.freeze({
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId
+    })
+  });
+}
+
+export { loadCommercialAdmissionSnapshot, parseReleaseTrustBundleFile, readCommercialAdmissionIntegritySchedule, resolveCommercialIntegrityWorkerInput, verifyOfflineInstallationPossessionAtLoad };