@aopslabs/aops-server 0.2.0

package/runtime/commercial-integrity-worker.mjs

@@ -0,0 +1,1643 @@
+import { workerData, parentPort } from "node:worker_threads";
+import { createPublicKey, verify, createHash, createHmac, timingSafeEqual, randomUUID, randomBytes } from "node:crypto";
+import { existsSync, rmSync, mkdirSync, lstatSync, realpathSync, readFileSync, statSync, writeFileSync, renameSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { gunzipSync } from "node:zlib";
+function compareCanonicalText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+const RELEASE_MANIFEST_OBJECT_TYPE = "aops-release-closure-manifest";
+const RELEASE_MANIFEST_CANONICALIZATION = "RFC8785-JCS-v1";
+const RELEASE_MANIFEST_PURPOSE = "urn:aops:artifact-installer:v1";
+const RELEASE_MANIFEST_CRITICAL_FIELDS = Object.freeze([
+  "objectType",
+  "payloadCanonicalization",
+  "schemaVersion"
+]);
+const SHA256$1 = /^sha256:[a-f0-9]{64}$/;
+const SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+const RELEASE_KID = /^release\/[A-Za-z0-9._~-]{1,160}$/;
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SOURCE_COMMIT = /^[a-f0-9]{40,64}$/;
+const NAMESPACE = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/;
+const COMMERCIAL_LAUNCH_ROLES = Object.freeze([
+  "runtime-node",
+  "cli",
+  "server",
+  "cockpit"
+]);
+const verifiedReleaseManifests = /* @__PURE__ */ new WeakSet();
+class CommercialArtifactError extends Error {
+  stage;
+  decision;
+  reason;
+  constructor(stage, reason, decision = "deny") {
+    super(`${stage}:${reason}`);
+    this.name = "CommercialArtifactError";
+    this.stage = stage;
+    this.reason = reason;
+    this.decision = decision;
+  }
+}
+function fail$1(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function isRecord$1(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function canonicalCommercialJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      fail$1("manifest-schema", "non_finite_number");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map((entry) => canonicalCommercialJson(entry)).join(",")}]`;
+  if (!isRecord$1(value))
+    fail$1("manifest-schema", "non_json_value");
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalCommercialJson(value[key])}`).join(",")}}`;
+}
+function sha256Commercial(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function runtimeVersionTuple(value) {
+  const match = /^([0-9]+)\.([0-9]+)\.([0-9]+)$/.exec(value);
+  if (!match)
+    fail$1("artifact-preflight", "bundled_runtime_version_invalid");
+  const tuple = match.slice(1).map(Number);
+  if (tuple.some((part) => !Number.isSafeInteger(part) || part < 0)) {
+    fail$1("artifact-preflight", "bundled_runtime_version_invalid");
+  }
+  return tuple;
+}
+function compareRuntimeVersions(left, right) {
+  for (let index = 0; index < left.length; index += 1) {
+    if (left[index] !== right[index])
+      return left[index] < right[index] ? -1 : 1;
+  }
+  return 0;
+}
+function assertCommercialRuntimeCompatible(version, supportedRange) {
+  const current = runtimeVersionTuple(version);
+  const clauses = supportedRange.trim().split(/\s+/);
+  const compatible = clauses.length > 0 && clauses.every((clause) => {
+    const match = /^(>=|>|<=|<|=)?([0-9]+\.[0-9]+\.[0-9]+)$/.exec(clause);
+    if (!match)
+      return false;
+    const comparison = compareRuntimeVersions(current, runtimeVersionTuple(match[2]));
+    if (match[1] === ">=")
+      return comparison >= 0;
+    if (match[1] === ">")
+      return comparison > 0;
+    if (match[1] === "<=")
+      return comparison <= 0;
+    if (match[1] === "<")
+      return comparison < 0;
+    return comparison === 0;
+  });
+  if (!compatible)
+    fail$1("artifact-preflight", "bundled_runtime_incompatible");
+}
+function exactObject(value, keys, reason) {
+  if (!isRecord$1(value))
+    fail$1("manifest-schema", reason);
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  if (canonicalCommercialJson(actual) !== canonicalCommercialJson(expected))
+    fail$1("manifest-schema", reason);
+}
+function requiredString(record, key, reason) {
+  const value = record[key];
+  if (typeof value !== "string" || !value || value !== value.trim() || value.length > 1024) {
+    fail$1("manifest-schema", reason);
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value))
+    fail$1("manifest-schema", reason);
+  return value;
+}
+function digest(record, key, reason) {
+  const value = requiredString(record, key, reason);
+  if (!SHA256$1.test(value))
+    fail$1("manifest-schema", reason);
+  return value;
+}
+function timestamp(record, key, reason) {
+  const value = requiredString(record, key, reason);
+  const millis = Date.parse(value);
+  if (!Number.isFinite(millis) || new Date(millis).toISOString() !== value)
+    fail$1("manifest-schema", reason);
+  return value;
+}
+function sortedUniqueStrings(record, key, reason, options = {}) {
+  const value = record[key];
+  if (!Array.isArray(value) || !options.allowEmpty && value.length === 0)
+    fail$1("manifest-schema", reason);
+  const strings = value.map((entry) => {
+    if (typeof entry !== "string" || !entry || entry !== entry.trim() || entry.length > 1024) {
+      fail$1("manifest-schema", reason);
+    }
+    if (options.validate && !options.validate(entry))
+      fail$1("manifest-schema", reason);
+    return entry;
+  });
+  const expected = [...new Set(strings)].sort();
+  if (canonicalCommercialJson(strings) !== canonicalCommercialJson(expected))
+    fail$1("manifest-schema", reason);
+  return Object.freeze(strings);
+}
+function safeEntrypoint(value) {
+  if (pathLikeAbsolute(value) || value.includes("\\") || value.includes("\0"))
+    return false;
+  const separator = value.indexOf(":");
+  if (separator < 1)
+    return false;
+  const packageName = value.slice(0, separator);
+  const relative = value.slice(separator + 1);
+  return PACKAGE_NAME.test(packageName) && relative.length > 0 && relative.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+function safePackageRelativeEntrypoint(value) {
+  return value.length > 0 && value.length <= 4096 && !pathLikeAbsolute(value) && !value.includes("\\") && !value.includes("\0") && value.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+function validRuntimeRange(value) {
+  const clauses = value.trim().split(/\s+/);
+  return clauses.length > 0 && clauses.every((clause) => /^(?:>=|>|<=|<|=)?[0-9]+\.[0-9]+\.[0-9]+$/.test(clause));
+}
+function pathLikeAbsolute(value) {
+  return value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+}
+function assertNoLocalMaterial(value, reason) {
+  if (pathLikeAbsolute(value) || /(?:localhost|127\.0\.0\.1|password|token|secret)=/i.test(value)) {
+    fail$1("manifest-schema", reason);
+  }
+}
+function parseClosure(value) {
+  if (!Array.isArray(value) || value.length === 0)
+    fail$1("manifest-schema", "closure_invalid");
+  const rows = value.map((candidate) => {
+    exactObject(candidate, [
+      "packageName",
+      "version",
+      "artifactSha256",
+      "packageIntegrity",
+      "filesDigest",
+      "launchRole",
+      "launchEntrypoint",
+      "runtimeRange"
+    ], "closure_entry_invalid");
+    const packageName = requiredString(candidate, "packageName", "closure_package_invalid");
+    const version = requiredString(candidate, "version", "closure_version_invalid");
+    const packageIntegrity = requiredString(candidate, "packageIntegrity", "closure_integrity_invalid");
+    if (!PACKAGE_NAME.test(packageName))
+      fail$1("manifest-schema", "closure_package_invalid");
+    if (!VERSION.test(version))
+      fail$1("manifest-schema", "closure_version_invalid");
+    if (!SHA512_INTEGRITY.test(packageIntegrity))
+      fail$1("manifest-schema", "closure_integrity_invalid");
+    const launchRole = candidate.launchRole;
+    if (launchRole !== null && !COMMERCIAL_LAUNCH_ROLES.includes(launchRole)) {
+      fail$1("manifest-schema", "closure_launch_role_invalid");
+    }
+    const launchEntrypoint = candidate.launchEntrypoint;
+    const runtimeRange = candidate.runtimeRange;
+    if (launchRole === null) {
+      if (launchEntrypoint !== null || runtimeRange !== null) {
+        fail$1("manifest-schema", "closure_launch_binding_invalid");
+      }
+    } else {
+      if (typeof launchEntrypoint !== "string" || !safePackageRelativeEntrypoint(launchEntrypoint)) {
+        fail$1("manifest-schema", "closure_launch_entrypoint_invalid");
+      }
+      if (launchRole === "runtime-node") {
+        if (runtimeRange !== null)
+          fail$1("manifest-schema", "closure_runtime_range_invalid");
+      } else if (typeof runtimeRange !== "string" || !validRuntimeRange(runtimeRange)) {
+        fail$1("manifest-schema", "closure_runtime_range_invalid");
+      }
+    }
+    return Object.freeze({
+      packageName,
+      version,
+      artifactSha256: digest(candidate, "artifactSha256", "closure_artifact_digest_invalid"),
+      packageIntegrity,
+      filesDigest: digest(candidate, "filesDigest", "closure_files_digest_invalid"),
+      launchRole,
+      launchEntrypoint,
+      runtimeRange
+    });
+  });
+  const identities = rows.map((row) => `${row.packageName}@${row.version}`);
+  if (canonicalCommercialJson(identities) !== canonicalCommercialJson([...new Set(identities)].sort())) {
+    fail$1("manifest-schema", "closure_order_invalid");
+  }
+  const roles = rows.filter((row) => row.launchRole !== null).map((row) => row.launchRole);
+  if (roles.filter((role) => role === "runtime-node").length !== 1) {
+    fail$1("manifest-schema", "closure_runtime_role_invalid");
+  }
+  if (new Set(roles).size !== roles.length)
+    fail$1("manifest-schema", "closure_launch_role_duplicate");
+  return Object.freeze(rows);
+}
+function parseRelease(value) {
+  exactObject(value, ["packageName", "version", "releaseId", "sourceRepositoryId", "sourceCommit", "sourceTag"], "release_invalid");
+  const packageName = requiredString(value, "packageName", "release_package_invalid");
+  const version = requiredString(value, "version", "release_version_invalid");
+  const sourceRepositoryId = requiredString(value, "sourceRepositoryId", "release_repository_invalid");
+  const sourceCommit = requiredString(value, "sourceCommit", "release_commit_invalid");
+  const sourceTag = requiredString(value, "sourceTag", "release_tag_invalid");
+  if (!PACKAGE_NAME.test(packageName))
+    fail$1("manifest-schema", "release_package_invalid");
+  if (!VERSION.test(version))
+    fail$1("manifest-schema", "release_version_invalid");
+  if (!SOURCE_COMMIT.test(sourceCommit))
+    fail$1("manifest-schema", "release_commit_invalid");
+  assertNoLocalMaterial(sourceRepositoryId, "release_repository_invalid");
+  assertNoLocalMaterial(sourceTag, "release_tag_invalid");
+  return Object.freeze({
+    packageName,
+    version,
+    releaseId: requiredString(value, "releaseId", "release_id_invalid"),
+    sourceRepositoryId,
+    sourceCommit,
+    sourceTag
+  });
+}
+function parseMigrationCapsules(value) {
+  if (!Array.isArray(value))
+    fail$1("manifest-schema", "migration_capsules_invalid");
+  const rows = value.map((candidate) => {
+    exactObject(candidate, ["capsuleId", "version", "digest", "semanticContractDigest", "readbackPolicy", "rollbackPolicy"], "migration_capsule_invalid");
+    const version = requiredString(candidate, "version", "migration_capsule_version_invalid");
+    if (!VERSION.test(version))
+      fail$1("manifest-schema", "migration_capsule_version_invalid");
+    return Object.freeze({
+      capsuleId: requiredString(candidate, "capsuleId", "migration_capsule_id_invalid"),
+      version,
+      digest: digest(candidate, "digest", "migration_capsule_digest_invalid"),
+      semanticContractDigest: digest(candidate, "semanticContractDigest", "migration_semantic_digest_invalid"),
+      readbackPolicy: requiredString(candidate, "readbackPolicy", "migration_readback_policy_invalid"),
+      rollbackPolicy: requiredString(candidate, "rollbackPolicy", "migration_rollback_policy_invalid")
+    });
+  });
+  const identities = rows.map((row) => `${row.capsuleId}@${row.version}`);
+  if (canonicalCommercialJson(identities) !== canonicalCommercialJson([...new Set(identities)].sort())) {
+    fail$1("manifest-schema", "migration_capsule_order_invalid");
+  }
+  return Object.freeze(rows);
+}
+function parseReleaseClosureManifest(value, options = {}) {
+  exactObject(value, [
+    "manifestId",
+    "publisherId",
+    "issuedAt",
+    "notBefore",
+    "notAfter",
+    "release",
+    "closure",
+    "closureDigest",
+    "packlistDigest",
+    "sbom",
+    "entrypoints",
+    "dcm",
+    "hostAbi",
+    "migrationCapsules",
+    "degradedOperationIds",
+    "extensions"
+  ], "release_manifest_invalid");
+  const issuedAt = timestamp(value, "issuedAt", "issued_at_invalid");
+  const notBefore = timestamp(value, "notBefore", "not_before_invalid");
+  const notAfter = timestamp(value, "notAfter", "not_after_invalid");
+  if (!(Date.parse(notBefore) <= Date.parse(issuedAt) && Date.parse(issuedAt) < Date.parse(notAfter))) {
+    fail$1("manifest-schema", "manifest_time_order_invalid");
+  }
+  const release = parseRelease(value.release);
+  const closure = parseClosure(value.closure);
+  if (!closure.some((row) => row.packageName === release.packageName && row.version === release.version)) {
+    fail$1("manifest-schema", "release_missing_from_closure");
+  }
+  const closureDigest = digest(value, "closureDigest", "closure_digest_invalid");
+  if (sha256Commercial(canonicalCommercialJson(closure)) !== closureDigest) {
+    fail$1("manifest-closure", "closure_digest_mismatch");
+  }
+  exactObject(value.sbom, ["format", "digest"], "sbom_invalid");
+  const sbom = Object.freeze({
+    format: requiredString(value.sbom, "format", "sbom_format_invalid"),
+    digest: digest(value.sbom, "digest", "sbom_digest_invalid")
+  });
+  exactObject(value.entrypoints, ["plugin", "dcmProviders", "manifestProviders", "resources"], "entrypoints_invalid");
+  const plugin = requiredString(value.entrypoints, "plugin", "plugin_entrypoint_invalid");
+  if (!safeEntrypoint(plugin))
+    fail$1("manifest-schema", "plugin_entrypoint_invalid");
+  const entrypoints = Object.freeze({
+    plugin,
+    dcmProviders: sortedUniqueStrings(value.entrypoints, "dcmProviders", "dcm_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint }),
+    manifestProviders: sortedUniqueStrings(value.entrypoints, "manifestProviders", "manifest_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint }),
+    resources: sortedUniqueStrings(value.entrypoints, "resources", "resource_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint })
+  });
+  exactObject(value.dcm, ["digest", "operationCatalogDigest"], "dcm_invalid");
+  const dcm = Object.freeze({
+    digest: digest(value.dcm, "digest", "dcm_digest_invalid"),
+    operationCatalogDigest: digest(value.dcm, "operationCatalogDigest", "operation_catalog_digest_invalid")
+  });
+  exactObject(value.hostAbi, ["protocolVersion", "supportedRange"], "host_abi_invalid");
+  const hostAbi = Object.freeze({
+    protocolVersion: requiredString(value.hostAbi, "protocolVersion", "host_abi_protocol_invalid"),
+    supportedRange: requiredString(value.hostAbi, "supportedRange", "host_abi_range_invalid")
+  });
+  const degradedOperationIds = sortedUniqueStrings(value, "degradedOperationIds", "degraded_operations_invalid", { allowEmpty: true });
+  if (options.knownOperationIds) {
+    for (const operationId of degradedOperationIds) {
+      if (!options.knownOperationIds.has(operationId))
+        fail$1("manifest-schema", "unknown_degraded_operation");
+    }
+  }
+  if (!isRecord$1(value.extensions))
+    fail$1("manifest-schema", "extensions_invalid");
+  for (const [namespace, extension] of Object.entries(value.extensions)) {
+    if (!NAMESPACE.test(namespace) || !isRecord$1(extension))
+      fail$1("manifest-schema", "extension_invalid");
+    canonicalCommercialJson(extension);
+  }
+  return Object.freeze({
+    manifestId: requiredString(value, "manifestId", "manifest_id_invalid"),
+    publisherId: requiredString(value, "publisherId", "publisher_id_invalid"),
+    issuedAt,
+    notBefore,
+    notAfter,
+    release,
+    closure,
+    closureDigest,
+    packlistDigest: digest(value, "packlistDigest", "packlist_digest_invalid"),
+    sbom,
+    entrypoints,
+    dcm,
+    hostAbi,
+    migrationCapsules: parseMigrationCapsules(value.migrationCapsules),
+    degradedOperationIds,
+    extensions: Object.freeze({ ...value.extensions })
+  });
+}
+function signatureInput(envelope) {
+  return canonicalCommercialJson(envelope);
+}
+function createReleaseManifestSigningInput(envelope) {
+  return Buffer.from(signatureInput(envelope), "utf8");
+}
+function parseReleaseManifestEnvelope(value, options = {}) {
+  exactObject(value, ["schemaVersion", "objectType", "payloadCanonicalization", "payloadDigest", "signingHeader", "signature", "payload"], "manifest_envelope_invalid");
+  if (value.schemaVersion !== 2)
+    fail$1("manifest-schema", "unsupported_schema_version");
+  if (value.objectType !== RELEASE_MANIFEST_OBJECT_TYPE)
+    fail$1("manifest-schema", "object_type_mismatch");
+  if (value.payloadCanonicalization !== RELEASE_MANIFEST_CANONICALIZATION) {
+    fail$1("manifest-schema", "canonicalization_unsupported");
+  }
+  exactObject(value.signingHeader, ["purpose", "alg", "kid", "crit"], "signing_header_invalid");
+  if (value.signingHeader.purpose !== RELEASE_MANIFEST_PURPOSE)
+    fail$1("manifest-signature", "key_purpose_mismatch");
+  if (value.signingHeader.alg !== "EdDSA")
+    fail$1("manifest-signature", "algorithm_not_allowed");
+  const kid = requiredString(value.signingHeader, "kid", "signing_kid_invalid");
+  if (!RELEASE_KID.test(kid))
+    fail$1("manifest-signature", "key_purpose_mismatch");
+  const crit = sortedUniqueStrings(value.signingHeader, "crit", "critical_fields_invalid", { allowEmpty: true });
+  if (canonicalCommercialJson(crit) !== canonicalCommercialJson(RELEASE_MANIFEST_CRITICAL_FIELDS)) {
+    fail$1("manifest-signature", "unknown_critical_field");
+  }
+  const signature = requiredString(value, "signature", "signature_invalid");
+  if (!/^[A-Za-z0-9_-]{86}$/.test(signature))
+    fail$1("manifest-signature", "signature_invalid");
+  const payload = parseReleaseClosureManifest(value.payload, options);
+  const payloadDigest = digest(value, "payloadDigest", "payload_digest_invalid");
+  if (sha256Commercial(canonicalCommercialJson(payload)) !== payloadDigest) {
+    fail$1("manifest-digest", "payload_digest_mismatch");
+  }
+  return Object.freeze({
+    schemaVersion: 2,
+    objectType: RELEASE_MANIFEST_OBJECT_TYPE,
+    payloadCanonicalization: RELEASE_MANIFEST_CANONICALIZATION,
+    payloadDigest,
+    signingHeader: Object.freeze({
+      purpose: RELEASE_MANIFEST_PURPOSE,
+      alg: "EdDSA",
+      kid,
+      crit
+    }),
+    signature,
+    payload
+  });
+}
+function decodeBase64Url(value) {
+  try {
+    return Buffer.from(value, "base64url");
+  } catch {
+    fail$1("manifest-signature", "signature_invalid");
+  }
+}
+function verifyReleaseManifestEnvelope(value, options) {
+  const envelope = parseReleaseManifestEnvelope(value, { knownOperationIds: options.knownOperationIds });
+  const duplicateKids = options.trustKeys.filter((key) => key.kid === envelope.signingHeader.kid);
+  if (duplicateKids.length !== 1)
+    fail$1("manifest-signature", duplicateKids.length ? "duplicate_trust_key" : "unknown_signing_key");
+  const trustKey = duplicateKids[0];
+  if (trustKey.purpose !== RELEASE_MANIFEST_PURPOSE || trustKey.alg !== "EdDSA" || !RELEASE_KID.test(trustKey.kid)) {
+    fail$1("manifest-signature", "key_purpose_mismatch");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const nowMillis = now.getTime();
+  if (!Number.isFinite(nowMillis))
+    fail$1("manifest-validity", "clock_invalid");
+  if (trustKey.status !== void 0 && !["active", "verify-only", "retired", "revoked"].includes(trustKey.status))
+    fail$1("manifest-signature", "release_key_status_invalid");
+  if (trustKey.status === "retired" || trustKey.status === "revoked") {
+    fail$1("manifest-signature", "release_key_not_accepted");
+  }
+  const keyNotBefore = trustKey.notBefore === void 0 ? null : Date.parse(trustKey.notBefore);
+  const keyNotAfter = trustKey.notAfter === void 0 ? null : Date.parse(trustKey.notAfter);
+  if (keyNotBefore !== null && !Number.isFinite(keyNotBefore) || keyNotAfter !== null && !Number.isFinite(keyNotAfter) || keyNotBefore !== null && keyNotAfter !== null && keyNotBefore >= keyNotAfter)
+    fail$1("manifest-signature", "release_key_time_invalid");
+  if (keyNotBefore !== null && nowMillis < keyNotBefore) {
+    fail$1("manifest-signature", "release_key_not_yet_valid");
+  }
+  if (keyNotAfter !== null && nowMillis >= keyNotAfter) {
+    fail$1("manifest-signature", "release_key_expired");
+  }
+  let publicKey;
+  try {
+    publicKey = createPublicKey(trustKey.publicKeyPem);
+  } catch {
+    fail$1("manifest-signature", "trust_key_invalid");
+  }
+  if (publicKey.asymmetricKeyType !== "ed25519")
+    fail$1("manifest-signature", "algorithm_not_allowed");
+  const unsigned = {
+    schemaVersion: envelope.schemaVersion,
+    objectType: envelope.objectType,
+    payloadCanonicalization: envelope.payloadCanonicalization,
+    payloadDigest: envelope.payloadDigest,
+    signingHeader: envelope.signingHeader,
+    payload: envelope.payload
+  };
+  if (!verify(null, createReleaseManifestSigningInput(unsigned), publicKey, decodeBase64Url(envelope.signature))) {
+    fail$1("manifest-signature", "bad_signature");
+  }
+  if (nowMillis < Date.parse(envelope.payload.notBefore))
+    fail$1("manifest-validity", "manifest_not_yet_valid");
+  if (nowMillis >= Date.parse(envelope.payload.notAfter))
+    fail$1("manifest-validity", "manifest_expired");
+  const verified = Object.freeze({
+    envelope,
+    manifestDigest: sha256Commercial(canonicalCommercialJson(envelope)),
+    payloadDigest: envelope.payloadDigest,
+    verifiedAt: now.toISOString(),
+    signerKid: envelope.signingHeader.kid
+  });
+  verifiedReleaseManifests.add(verified);
+  return verified;
+}
+const COMMON_CLAIM_KEYS = Object.freeze([
+  "aud",
+  "domainConstraints",
+  "entitlementEpoch",
+  "exp",
+  "featureIds",
+  "fullUntil",
+  "iat",
+  "installationId",
+  "iss",
+  "jti",
+  "leaseMode",
+  "nbf",
+  "productIds",
+  "refreshAfter",
+  "releaseConstraint",
+  "revocationEpoch",
+  "schemaVersion",
+  "skuId",
+  "subscriptionId",
+  "tenantId"
+]);
+Object.freeze([
+  ...COMMON_CLAIM_KEYS,
+  "activationBinding",
+  "installationKeyThumbprint"
+]);
+const STORE_FORMAT_VERSION = 1;
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+const IDENTITY = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/;
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+const MAX_ARCHIVE_FILES = 1e5;
+const MAX_FILE_BYTES = 128 * 1024 * 1024;
+function fail(stage, reason, decision = "deny") {
+  throw new CommercialArtifactError(stage, reason, decision);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseJsonFile(filePath, stage, reason) {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    fail(stage, reason);
+  }
+}
+function assertIdentity(value, reason) {
+  if (!IDENTITY.test(value))
+    fail("store-identity", reason);
+}
+function assertAbsoluteSafeRoot(rootPath, create) {
+  if (!path.isAbsolute(rootPath))
+    fail("store-path", "store_root_not_absolute");
+  const resolved = path.resolve(rootPath);
+  if (path.parse(resolved).root === resolved)
+    fail("store-path", "store_root_too_broad");
+  if (!existsSync(resolved)) {
+    fail("store-path", "store_root_missing");
+    mkdirSync(resolved, { recursive: true, mode: 448 });
+  }
+  const stat = lstatSync(resolved);
+  if (stat.isSymbolicLink() || !stat.isDirectory())
+    fail("store-path", "store_root_unsafe");
+  const real = realpathSync.native(resolved);
+  if (path.relative(resolved, real) !== "")
+    fail("store-path", "store_root_reparse_refused");
+  return real;
+}
+function safeChild(root, ...segments) {
+  for (const segment of segments) {
+    if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\")) {
+      fail("store-path", "unsafe_managed_segment");
+    }
+  }
+  const candidate = path.join(root, ...segments);
+  const relative = path.relative(root, candidate);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
+    fail("store-path", "managed_path_escape");
+  return candidate;
+}
+function ensureManagedDirectory(root, ...segments) {
+  let cursor = root;
+  for (const segment of segments) {
+    cursor = safeChild(cursor, segment);
+    if (!existsSync(cursor))
+      mkdirSync(cursor, { mode: 448 });
+    const stat = lstatSync(cursor);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+      fail("store-path", "managed_directory_unsafe");
+    if (path.relative(cursor, realpathSync.native(cursor)) !== "")
+      fail("store-path", "managed_directory_reparse_refused");
+  }
+  return cursor;
+}
+function assertRegularFile(filePath, stage, reason) {
+  const stat = lstatSync(filePath);
+  if (stat.isSymbolicLink() || !stat.isFile())
+    fail(stage, reason);
+  return realpathSync.native(filePath);
+}
+function digestBytes(bytes) {
+  return sha256Commercial(bytes);
+}
+function integrityBytes(bytes) {
+  return `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
+}
+function atomicWrite(filePath, bytes, mode = 384) {
+  const parent = path.dirname(filePath);
+  const tempPath = path.join(parent, `.${path.basename(filePath)}.${randomUUID()}.tmp`);
+  writeFileSync(tempPath, bytes, { mode, flag: "wx" });
+  renameSync(tempPath, filePath);
+  try {
+    chmodSync(filePath, mode);
+  } catch {
+  }
+}
+function trimTarText(bytes) {
+  const nul = bytes.indexOf(0);
+  return bytes.subarray(0, nul === -1 ? bytes.length : nul).toString("utf8").trim();
+}
+function tarNumber(bytes, reason) {
+  if ((bytes[0] & 128) !== 0)
+    fail("archive-safety", reason);
+  const text = trimTarText(bytes).replace(/\0/g, "").trim();
+  if (!text)
+    return 0;
+  if (!/^[0-7]+$/.test(text))
+    fail("archive-safety", reason);
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value) || value < 0)
+    fail("archive-safety", reason);
+  return value;
+}
+function parsePax(bytes) {
+  const fields = {};
+  let offset = 0;
+  while (offset < bytes.length) {
+    const space = bytes.indexOf(32, offset);
+    if (space < 0)
+      fail("archive-safety", "pax_record_invalid");
+    const length = Number.parseInt(bytes.subarray(offset, space).toString("ascii"), 10);
+    if (!Number.isSafeInteger(length) || length <= 0 || offset + length > bytes.length) {
+      fail("archive-safety", "pax_record_invalid");
+    }
+    const record = bytes.subarray(space + 1, offset + length - 1).toString("utf8");
+    const equals = record.indexOf("=");
+    if (equals <= 0)
+      fail("archive-safety", "pax_record_invalid");
+    const key = record.slice(0, equals);
+    if (Object.hasOwn(fields, key))
+      fail("archive-safety", "pax_duplicate_field");
+    fields[key] = record.slice(equals + 1);
+    offset += length;
+  }
+  return fields;
+}
+function safeArchivePath(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (!normalized.startsWith("package/") || normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized) || normalized.length > 4096)
+    fail("archive-safety", "archive_path_invalid");
+  const relative = normalized.slice("package/".length);
+  if (!relative || relative.endsWith("/") || relative.split("/").some((segment) => !segment || segment === "." || segment === "..")) {
+    fail("archive-safety", "archive_path_invalid");
+  }
+  return relative.normalize("NFC");
+}
+function inspectNpmTarball(bytes) {
+  if (bytes.byteLength <= 0 || bytes.byteLength > MAX_ARCHIVE_BYTES)
+    fail("archive-safety", "archive_size_invalid");
+  let tar;
+  try {
+    tar = gunzipSync(bytes, { maxOutputLength: MAX_ARCHIVE_BYTES });
+  } catch {
+    fail("archive-safety", "archive_gzip_invalid");
+  }
+  const rows = [];
+  const contents = /* @__PURE__ */ new Map();
+  let offset = 0;
+  let pax = {};
+  let longName = null;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0))
+      break;
+    const storedChecksum = tarNumber(header.subarray(148, 156), "archive_checksum_invalid");
+    let checksum = 0;
+    for (let index = 0; index < 512; index += 1) {
+      checksum += index >= 148 && index < 156 ? 32 : header[index];
+    }
+    if (storedChecksum !== checksum)
+      fail("archive-safety", "archive_checksum_mismatch");
+    const baseName = trimTarText(header.subarray(0, 100));
+    const prefix = trimTarText(header.subarray(345, 500));
+    const headerName = prefix ? `${prefix}/${baseName}` : baseName;
+    const mode = tarNumber(header.subarray(100, 108), "archive_mode_invalid") & 511;
+    const headerSize = tarNumber(header.subarray(124, 136), "archive_entry_size_invalid");
+    if (headerSize > MAX_FILE_BYTES)
+      fail("archive-safety", "archive_entry_too_large");
+    const type = String.fromCharCode(header[156] || 0);
+    const contentOffset = offset + 512;
+    const contentEnd = contentOffset + headerSize;
+    if (contentEnd > tar.length)
+      fail("archive-safety", "archive_truncated");
+    const content = tar.subarray(contentOffset, contentEnd);
+    offset = contentOffset + Math.ceil(headerSize / 512) * 512;
+    if (type === "x" || type === "g") {
+      const next = parsePax(content);
+      const unsupported = Object.keys(next).filter((key) => !["path", "size", "mtime"].includes(key));
+      if (unsupported.some((key) => key === "linkpath"))
+        fail("archive-safety", "archive_link_refused");
+      pax = type === "g" ? { ...pax, ...next } : next;
+      continue;
+    }
+    if (type === "L") {
+      longName = trimTarText(content);
+      continue;
+    }
+    if (type === "5") {
+      pax = {};
+      longName = null;
+      continue;
+    }
+    if (type !== "\0" && type !== "0")
+      fail("archive-safety", "archive_special_entry_refused");
+    const entryName = pax.path ?? longName ?? headerName;
+    const declaredSize = pax.size === void 0 ? headerSize : Number.parseInt(pax.size, 10);
+    if (!Number.isSafeInteger(declaredSize) || declaredSize !== headerSize)
+      fail("archive-safety", "archive_entry_size_mismatch");
+    const relative = safeArchivePath(entryName);
+    if (contents.has(relative))
+      fail("archive-safety", "archive_duplicate_path");
+    const copy = Buffer.from(content);
+    contents.set(relative, copy);
+    rows.push(Object.freeze({
+      path: relative,
+      size: copy.byteLength,
+      mode,
+      sha256: digestBytes(copy)
+    }));
+    if (rows.length > MAX_ARCHIVE_FILES)
+      fail("archive-safety", "archive_file_limit_exceeded");
+    pax = {};
+    longName = null;
+  }
+  rows.sort((left, right) => compareCanonicalText(left.path, right.path));
+  const packageBytes = contents.get("package.json");
+  if (!packageBytes)
+    fail("archive-preflight", "package_json_missing");
+  let packageJson;
+  try {
+    packageJson = JSON.parse(packageBytes.toString("utf8"));
+  } catch {
+    fail("archive-preflight", "package_json_invalid");
+  }
+  if (!isRecord(packageJson) || typeof packageJson.name !== "string" || typeof packageJson.version !== "string") {
+    fail("archive-preflight", "package_identity_invalid");
+  }
+  const optionalPeerNames = /* @__PURE__ */ new Set();
+  if (packageJson.peerDependenciesMeta !== void 0) {
+    if (!isRecord(packageJson.peerDependenciesMeta)) {
+      fail("archive-preflight", "package_dependencies_invalid");
+    }
+    for (const [dependencyName, metadata] of Object.entries(packageJson.peerDependenciesMeta)) {
+      if (!isRecord(metadata) || typeof metadata.optional !== "boolean") {
+        fail("archive-preflight", "package_dependencies_invalid");
+      }
+      if (metadata.optional)
+        optionalPeerNames.add(dependencyName);
+    }
+  }
+  const runtimeDependencyNames = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies"]) {
+    const dependencies = packageJson[field];
+    if (dependencies === void 0)
+      continue;
+    if (!isRecord(dependencies))
+      fail("archive-preflight", "package_dependencies_invalid");
+    for (const [dependencyName, dependencyRange] of Object.entries(dependencies)) {
+      if (typeof dependencyRange !== "string" || !dependencyRange.trim()) {
+        fail("archive-preflight", "package_dependencies_invalid");
+      }
+      if (field !== "peerDependencies" || !optionalPeerNames.has(dependencyName)) {
+        runtimeDependencyNames.add(dependencyName);
+      }
+    }
+  }
+  return Object.freeze({
+    files: Object.freeze(rows),
+    contents,
+    filesDigest: sha256Commercial(canonicalCommercialJson(rows.map(({ path: filePath, size, sha256 }) => ({
+      path: filePath,
+      size,
+      sha256
+    })))),
+    packageName: packageJson.name,
+    version: packageJson.version,
+    runtimeDependencies: Object.freeze([...runtimeDependencyNames].sort(compareCanonicalText))
+  });
+}
+function readOnlyObjectPath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail("store-path", "object_digest_invalid");
+  return safeChild(root, "objects", "sha256", digest2.slice("sha256:".length));
+}
+function readOnlyTreePath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail("store-path", "tree_digest_invalid");
+  return safeChild(root, "trees", "sha256", digest2.slice("sha256:".length));
+}
+function verifyTree(root, archive) {
+  for (const row of archive.files) {
+    const segments = row.path.split("/");
+    let cursor = root;
+    for (const segment of segments) {
+      cursor = safeChild(cursor, segment);
+      const stat2 = lstatSync(cursor);
+      if (stat2.isSymbolicLink())
+        fail("cas-readback", "cas_tree_link_refused", "quarantine");
+    }
+    const stat = statSync(cursor);
+    if (!stat.isFile() || stat.size !== row.size || digestBytes(readFileSync(cursor)) !== row.sha256) {
+      fail("cas-readback", "cas_tree_digest_mismatch", "quarantine");
+    }
+  }
+}
+function resolveEntrypoint(entrypoint, artifacts, closureDigest) {
+  const separator = entrypoint.indexOf(":");
+  const packageName = entrypoint.slice(0, separator);
+  const relative = entrypoint.slice(separator + 1);
+  const artifact = artifacts.get(packageName);
+  if (!artifact)
+    fail("artifact-preflight", "entrypoint_package_missing");
+  if (!artifact.files.some((row) => row.path === relative))
+    fail("artifact-preflight", "entrypoint_file_missing");
+  return `runtimes/sha256/${closureDigest.slice("sha256:".length)}/node_modules/${packageName}/${relative}`;
+}
+function resolveLaunchClosure(manifest, artifacts) {
+  const roleRows = manifest.closure.filter((entry) => entry.launchRole !== null);
+  const runtime = roleRows.find((entry) => entry.launchRole === "runtime-node");
+  if (!runtime)
+    fail("artifact-preflight", "runtime_role_missing");
+  for (const entry of roleRows) {
+    const artifact = artifacts.get(entry.packageName);
+    if (!artifact)
+      fail("artifact-preflight", "launch_role_package_missing");
+    const file = artifact.files.find((candidate) => candidate.path === entry.launchEntrypoint);
+    if (!file)
+      fail("artifact-preflight", "launch_role_entrypoint_missing");
+    if (entry.launchRole !== "runtime-node") {
+      if (entry.runtimeRange === null)
+        fail("artifact-preflight", "launch_role_runtime_range_missing");
+      assertCommercialRuntimeCompatible(runtime.version, entry.runtimeRange);
+    }
+  }
+  const entries = roleRows.map((entry) => {
+    const artifact = artifacts.get(entry.packageName);
+    if (!artifact)
+      fail("artifact-preflight", "launch_role_package_missing");
+    const file = artifact.files.find((candidate) => candidate.path === entry.launchEntrypoint);
+    if (!file || entry.launchRole === null || entry.launchEntrypoint === null) {
+      fail("artifact-preflight", "launch_role_entrypoint_missing");
+    }
+    return Object.freeze({
+      role: entry.launchRole,
+      packageName: artifact.packageName,
+      packageVersion: artifact.version,
+      artifactDigest: artifact.digest,
+      entrypoint: entry.launchEntrypoint,
+      entrypointDigest: file.sha256,
+      runtimeRange: entry.runtimeRange,
+      resolvedPath: resolveEntrypoint(`${entry.packageName}:${entry.launchEntrypoint}`, artifacts, manifest.closureDigest)
+    });
+  }).sort((left, right) => compareCanonicalText(left.role, right.role));
+  return Object.freeze({
+    runtimeVersion: runtime.version,
+    entries: Object.freeze(entries)
+  });
+}
+function readOnlyRuntimeRootPath(root, closureDigest) {
+  if (!SHA256.test(closureDigest))
+    fail("store-path", "closure_digest_invalid");
+  return safeChild(root, "runtimes", "sha256", closureDigest.slice("sha256:".length));
+}
+function packageRuntimeRoot(nodeModulesRoot, packageName) {
+  const segments = packageName.split("/");
+  if (segments.length === 1)
+    return safeChild(nodeModulesRoot, segments[0]);
+  if (segments.length === 2 && segments[0].startsWith("@")) {
+    const scope = ensureManagedDirectory(nodeModulesRoot, segments[0]);
+    return safeChild(scope, segments[1]);
+  }
+  fail("artifact-preflight", "runtime_package_name_invalid");
+}
+function verifyRuntimeClosure(runtimeRoot, artifacts) {
+  const nodeModulesRoot = safeChild(runtimeRoot, "node_modules");
+  const nodeModulesStat = lstatSync(nodeModulesRoot);
+  if (nodeModulesStat.isSymbolicLink() || !nodeModulesStat.isDirectory()) {
+    fail("runtime-readback", "runtime_closure_unsafe", "quarantine");
+  }
+  for (const artifact of artifacts.values()) {
+    const packageRoot = packageRuntimeRoot(nodeModulesRoot, artifact.packageName);
+    for (const row of artifact.files) {
+      let cursor = packageRoot;
+      for (const segment of row.path.split("/")) {
+        cursor = safeChild(cursor, segment);
+        const stat2 = lstatSync(cursor);
+        if (stat2.isSymbolicLink())
+          fail("runtime-readback", "runtime_link_refused", "quarantine");
+      }
+      const stat = statSync(cursor);
+      if (!stat.isFile() || stat.size !== row.size || digestBytes(readFileSync(cursor)) !== row.sha256) {
+        fail("runtime-readback", "runtime_file_digest_mismatch", "quarantine");
+      }
+    }
+  }
+}
+function verifyRuntimeDependencyClosure(artifacts) {
+  for (const artifact of artifacts.values()) {
+    for (const dependencyName of artifact.runtimeDependencies) {
+      if (!artifacts.has(dependencyName)) {
+        fail("artifact-preflight", "runtime_dependency_outside_closure");
+      }
+    }
+  }
+}
+function statePath(root, name) {
+  return safeChild(ensureManagedDirectory(root, "state"), name);
+}
+function readOnlyStatePath(root, name) {
+  return safeChild(root, "state", name);
+}
+function assertStoreIdentity(root, expected, create = false) {
+  const filePath = create ? statePath(root, "store-identity.json") : readOnlyStatePath(root, "store-identity.json");
+  if (!existsSync(filePath)) {
+    if (!expected || !create)
+      fail("store-identity", "store_identity_missing", "quarantine");
+    const identity = Object.freeze({
+      schemaVersion: 1,
+      objectType: "aops-commercial-artifact-store-identity-v1",
+      storeFormatVersion: STORE_FORMAT_VERSION,
+      installationId: expected.installationId,
+      hostInstanceId: expected.hostInstanceId
+    });
+    atomicWrite(filePath, `${canonicalCommercialJson(identity)}
+`);
+  }
+  const value = parseJsonFile(filePath, "store-identity", "store_identity_json_invalid");
+  if (!isRecord(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-artifact-store-identity-v1" || value.storeFormatVersion !== STORE_FORMAT_VERSION || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string")
+    fail("store-identity", "store_identity_schema_invalid", "quarantine");
+  if (expected && (value.installationId !== expected.installationId || value.hostInstanceId !== expected.hostInstanceId))
+    fail("store-identity", "store_identity_mismatch", "quarantine");
+  return value;
+}
+function readOnlyReceiptPath(root, receiptId) {
+  assertIdentity(receiptId, "receipt_id_invalid");
+  return safeChild(root, "receipts", `${receiptId}.json`);
+}
+function readOnlyManifestPath(root, digest2) {
+  if (!SHA256.test(digest2))
+    fail("store-path", "manifest_digest_invalid");
+  return safeChild(root, "manifests", `${digest2.slice("sha256:".length)}.json`);
+}
+function keyBytes(root, create) {
+  const keyPath = readOnlyStatePath(root, "receipt-hmac.key");
+  if (!existsSync(keyPath)) {
+    fail("receipt-integrity", "receipt_key_missing", "quarantine");
+    atomicWrite(keyPath, randomBytes(32), 384);
+  }
+  const key = readFileSync(assertRegularFile(keyPath, "receipt-integrity", "receipt_key_unsafe"));
+  if (key.byteLength !== 32)
+    fail("receipt-integrity", "receipt_key_invalid", "quarantine");
+  return key;
+}
+function readReceipt(root, receiptId) {
+  const value = parseJsonFile(readOnlyReceiptPath(root, receiptId), "receipt-readback", "receipt_json_invalid");
+  if (!isRecord(value) || !isRecord(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.receiptDigestOrMac !== "string") {
+    fail("receipt-readback", "receipt_schema_invalid", "quarantine");
+  }
+  if (value.schemaVersion !== 2 || value.objectType !== "aops-installation-receipt-v2") {
+    fail("receipt-readback", "receipt_schema_unsupported", "quarantine");
+  }
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = createHmac("sha256", keyBytes(root)).update(canonicalCommercialJson(unsigned)).digest();
+  const actualText = value.localIntegrity.receiptDigestOrMac;
+  if (!/^hmac-sha256:[a-f0-9]{64}$/.test(actualText))
+    fail("receipt-readback", "receipt_mac_invalid", "quarantine");
+  const actual = Buffer.from(actualText.slice("hmac-sha256:".length), "hex");
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    fail("receipt-readback", "receipt_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readPointer(root, name) {
+  const filePath = readOnlyStatePath(root, name);
+  if (!existsSync(filePath))
+    return null;
+  const value = parseJsonFile(filePath, "activation-readback", "pointer_json_invalid");
+  if (!isRecord(value) || value.schemaVersion !== 1 || typeof value.receiptId !== "string" || typeof value.receiptMac !== "string" || !Number.isSafeInteger(value.generation))
+    fail("activation-readback", "pointer_schema_invalid", "quarantine");
+  const receipt = readReceipt(root, value.receiptId);
+  if (receipt.localIntegrity.receiptDigestOrMac !== value.receiptMac || receipt.activation.generation !== value.generation)
+    fail("activation-readback", "pointer_receipt_mismatch", "quarantine");
+  return value;
+}
+function highWaterPath(root, packageName) {
+  const identity = createHash("sha256").update(packageName, "utf8").digest("hex");
+  return safeChild(ensureManagedDirectory(root, "high-water"), `${identity}.json`);
+}
+function highWaterMacInput(value) {
+  return `aops-product-release-high-water-v1\0${canonicalCommercialJson(value)}`;
+}
+function verifyHighWaterState(root, packageName, value) {
+  if (!isRecord(value) || canonicalCommercialJson(Object.keys(value).sort()) !== canonicalCommercialJson([
+    "issuedAt",
+    "localIntegrity",
+    "manifestDigest",
+    "objectType",
+    "packageName",
+    "schemaVersion",
+    "versionOrdinal"
+  ]) || value.schemaVersion !== 1 || value.objectType !== "aops-product-release-high-water-v1" || typeof value.packageName !== "string" || value.packageName.length < 1 || value.packageName.length > 512 || value.packageName !== packageName || typeof value.issuedAt !== "string" || !Number.isFinite(Date.parse(value.issuedAt)) || !Number.isSafeInteger(value.versionOrdinal) || Number(value.versionOrdinal) < 0 || typeof value.manifestDigest !== "string" || !SHA256.test(value.manifestDigest) || !isRecord(value.localIntegrity) || canonicalCommercialJson(Object.keys(value.localIntegrity).sort()) !== canonicalCommercialJson(["mac", "scheme"]) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string" || !/^hmac-sha256:[a-f0-9]{64}$/.test(value.localIntegrity.mac))
+    fail("release-high-water", "high_water_schema_invalid", "quarantine");
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = createHmac("sha256", keyBytes(root)).update(highWaterMacInput(unsigned)).digest();
+  const actual = Buffer.from(value.localIntegrity.mac.slice("hmac-sha256:".length), "hex");
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    fail("release-high-water", "high_water_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readHighWater(root, packageName) {
+  const filePath = highWaterPath(root, packageName);
+  if (!existsSync(filePath))
+    return null;
+  const value = parseJsonFile(filePath, "release-high-water", "high_water_json_invalid");
+  const verified = verifyHighWaterState(root, packageName, value);
+  return Object.freeze({
+    issuedAt: verified.issuedAt,
+    versionOrdinal: verified.versionOrdinal,
+    manifestDigest: verified.manifestDigest
+  });
+}
+function assertRetainedHighWater(root, receipt) {
+  const retained = readHighWater(root, receipt.packageName);
+  if (!retained)
+    fail("release-high-water", "high_water_missing", "quarantine");
+  if (retained.versionOrdinal < receipt.releaseHighWater.versionOrdinal) {
+    fail("release-high-water", "high_water_receipt_mismatch", "quarantine");
+  }
+  return retained;
+}
+function verifyStoredClosure(root, receipt, onVerified) {
+  const startedAt = process.hrtime.bigint();
+  const artifacts = /* @__PURE__ */ new Map();
+  let casBytesRead = 0;
+  let npmArtifactCount = 0;
+  let archiveFileCount = 0;
+  let archiveFileBytes = 0;
+  for (const object of receipt.casObjects) {
+    const filePath = readOnlyObjectPath(root, object.digest);
+    const file = assertRegularFile(filePath, "cas-readback", "cas_object_missing");
+    const bytes = readFileSync(file);
+    casBytesRead += bytes.byteLength;
+    if (bytes.byteLength !== object.size || digestBytes(bytes) !== object.digest) {
+      fail("cas-readback", "cas_object_digest_mismatch", "quarantine");
+    }
+    if (object.role.startsWith("npm:")) {
+      npmArtifactCount += 1;
+      const packageName = object.role.slice("npm:".length);
+      const archive = inspectNpmTarball(bytes);
+      archiveFileCount += archive.files.length;
+      archiveFileBytes += archive.files.reduce((total, row) => total + row.size, 0);
+      if (archive.packageName !== packageName)
+        fail("cas-readback", "cas_package_identity_mismatch", "quarantine");
+      const tree = readOnlyTreePath(root, object.digest);
+      if (!existsSync(tree))
+        fail("cas-readback", "cas_tree_missing", "quarantine");
+      const treeStat = lstatSync(tree);
+      if (treeStat.isSymbolicLink() || !treeStat.isDirectory()) {
+        fail("cas-readback", "cas_tree_unsafe", "quarantine");
+      }
+      verifyTree(tree, archive);
+      artifacts.set(packageName, {
+        packageName,
+        version: archive.version,
+        digest: object.digest,
+        integrity: integrityBytes(bytes),
+        filesDigest: archive.filesDigest,
+        objectPath: file,
+        treePath: tree,
+        files: archive.files,
+        runtimeDependencies: archive.runtimeDependencies
+      });
+    }
+  }
+  const runtimeRoot = readOnlyRuntimeRootPath(root, receipt.closureDigest);
+  if (!existsSync(runtimeRoot))
+    fail("runtime-readback", "runtime_closure_missing", "quarantine");
+  verifyRuntimeClosure(runtimeRoot, artifacts);
+  verifyRuntimeDependencyClosure(artifacts);
+  onVerified?.(Object.freeze({
+    elapsedMs: Number(process.hrtime.bigint() - startedAt) / 1e6,
+    casObjectCount: receipt.casObjects.length,
+    npmArtifactCount,
+    tarballDecompressionCount: npmArtifactCount,
+    archiveFileCount,
+    casBytesRead,
+    treeBytesRead: archiveFileBytes,
+    runtimeBytesRead: archiveFileBytes,
+    materializedBytesDerivedFromArchiveMetadata: true,
+    materializedFilePasses: 2,
+    totalFileReads: receipt.casObjects.length + archiveFileCount * 2,
+    totalBytesRead: casBytesRead + archiveFileBytes * 2
+  }));
+  return artifacts;
+}
+const COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE = "aops-commercial-integrity-authority-v1";
+const COMMERCIAL_INTEGRITY_PENDING_PURPOSE = "aops-commercial-integrity-pending-v2";
+function commercialIntegrityRoot(stateRoot, create) {
+  if (!path.isAbsolute(stateRoot))
+    fail("commercial-integrity", "integrity_state_root_not_absolute");
+  const resolved = path.resolve(stateRoot);
+  if (!existsSync(resolved)) {
+    return null;
+  }
+  const safeStateRoot = assertAbsoluteSafeRoot(resolved);
+  {
+    const candidate = path.join(safeStateRoot, "commercial-integrity");
+    if (!existsSync(candidate))
+      return null;
+  }
+  return ensureManagedDirectory(safeStateRoot, "commercial-integrity");
+}
+function commercialIntegrityKey(root, create) {
+  const keyPath = safeChild(root, "authority-hmac.key");
+  if (!existsSync(keyPath)) {
+    return null;
+  }
+  const key = readFileSync(assertRegularFile(keyPath, "commercial-integrity", "integrity_key_unsafe"));
+  if (key.byteLength !== 32)
+    return null;
+  return key;
+}
+function integrityMac(key, purpose, value) {
+  return createHmac("sha256", key).update(`${purpose}\0${canonicalCommercialJson(value)}`).digest("hex");
+}
+function authorityUnsigned(value) {
+  const { localIntegrity: _, ...unsigned } = value;
+  return unsigned;
+}
+function pendingUnsigned(value) {
+  const { localIntegrity: _, ...unsigned } = value;
+  return unsigned;
+}
+function signCommercialIntegrityAuthority(key, value) {
+  return Object.freeze({
+    ...value,
+    localIntegrity: Object.freeze({
+      scheme: "hmac-sha256-v1",
+      mac: integrityMac(key, COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE, value)
+    })
+  });
+}
+function parseOptionalJson(filePath) {
+  if (!existsSync(filePath))
+    return null;
+  try {
+    const file = assertRegularFile(filePath, "commercial-integrity", "integrity_record_unsafe");
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    return null;
+  }
+}
+function validIntegrityFile(value) {
+  return isRecord(value) && typeof value.relativePath === "string" && value.relativePath.length > 0 && !value.relativePath.startsWith("/") && !value.relativePath.includes("\\") && !value.relativePath.split("/").some((segment) => !segment || segment === "." || segment === "..") && Number.isSafeInteger(value.size) && Number(value.size) >= 0 && typeof value.mtimeMs === "number" && Number.isFinite(value.mtimeMs) && typeof value.fileId === "string";
+}
+function validCriticalFile(value) {
+  return isRecord(value) && typeof value.relativePath === "string" && SHA256.test(String(value.digest));
+}
+function authorityShape(value) {
+  if (!isRecord(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-integrity-authority-v1" || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string" || typeof value.receiptId !== "string" || !SHA256.test(String(value.closureDigest)) || !Number.isSafeInteger(value.activationGeneration) || Number(value.activationGeneration) < 1 || typeof value.verifiedAt !== "string" || ![
+    "install",
+    "update",
+    "rollback",
+    "scheduled",
+    "routine-size-drift-full-verify",
+    "authority-reestablished"
+  ].includes(String(value.verificationSource)) || typeof value.authorityReestablished !== "boolean" || typeof value.previousAnchorUnknown !== "boolean" || !Array.isArray(value.files) || !value.files.every(validIntegrityFile) || !validCriticalFile(value.dcm) || !validCriticalFile(value.operationCatalog) || !isRecord(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string")
+    return false;
+  let previous = "";
+  for (const file of value.files) {
+    if (file.relativePath <= previous)
+      return false;
+    previous = file.relativePath;
+  }
+  return true;
+}
+function pendingShape(value) {
+  const hasNoLineage = isRecord(value) && value.planId === null && value.previousOperationReceiptId === null && value.previousPlanId === null;
+  const hasExactLineage = isRecord(value) && SHA256.test(String(value.planId)) && typeof value.previousOperationReceiptId === "string" && value.previousOperationReceiptId.length > 0 && SHA256.test(String(value.previousPlanId));
+  return isRecord(value) && value.schemaVersion === 2 && value.objectType === "aops-commercial-integrity-pending-v2" && ["install", "update", "rollback"].includes(String(value.operation)) && (hasNoLineage || hasExactLineage) && (value.operation === "install" ? hasNoLineage : true) && typeof value.installationId === "string" && typeof value.hostInstanceId === "string" && (value.priorReceiptId === null || typeof value.priorReceiptId === "string") && isRecord(value.target) && authorityShape({
+    ...value.target,
+    localIntegrity: { scheme: "hmac-sha256-v1", mac: "0".repeat(64) }
+  }) && isRecord(value.localIntegrity) && value.localIntegrity.scheme === "hmac-sha256-v1" && typeof value.localIntegrity.mac === "string";
+}
+function verifyMacText(actualText, expectedText) {
+  if (!/^[a-f0-9]{64}$/.test(actualText) || !/^[a-f0-9]{64}$/.test(expectedText))
+    return false;
+  const actual = Buffer.from(actualText, "hex");
+  const expected = Buffer.from(expectedText, "hex");
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function readCommercialIntegrityAuthority(root, key) {
+  const value = parseOptionalJson(safeChild(root, "authority.json"));
+  if (value === null || !authorityShape(value))
+    return null;
+  const expected = integrityMac(key, COMMERCIAL_INTEGRITY_AUTHORITY_PURPOSE, authorityUnsigned(value));
+  if (!verifyMacText(value.localIntegrity.mac, expected)) {
+    fail("commercial-integrity", "integrity_authority_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function readCommercialIntegrityPending(root, key) {
+  const value = parseOptionalJson(safeChild(root, "pending.json"));
+  if (value === null)
+    return null;
+  if (!pendingShape(value))
+    return "invalid";
+  const expected = integrityMac(key, COMMERCIAL_INTEGRITY_PENDING_PURPOSE, pendingUnsigned(value));
+  return verifyMacText(value.localIntegrity.mac, expected) ? value : "invalid";
+}
+function readCommercialIntegrityQuarantine(root, key) {
+  const value = parseOptionalJson(safeChild(root, "quarantine.json"));
+  if (value === null)
+    return null;
+  if (!isRecord(value) || value.schemaVersion !== 1 || value.objectType !== "aops-commercial-integrity-quarantine-v1" || typeof value.installationId !== "string" || typeof value.hostInstanceId !== "string" || typeof value.receiptId !== "string" || !SHA256.test(String(value.closureDigest)) || !Number.isSafeInteger(value.activationGeneration) || typeof value.detectedAt !== "string" || value.source !== "scheduled-verification" || typeof value.stage !== "string" || typeof value.reason !== "string" || !isRecord(value.localIntegrity) || value.localIntegrity.scheme !== "hmac-sha256-v1" || typeof value.localIntegrity.mac !== "string")
+    fail("commercial-integrity", "integrity_quarantine_record_invalid", "quarantine");
+  const { localIntegrity: _, ...unsigned } = value;
+  const expected = integrityMac(key, "aops-commercial-integrity-quarantine-v1", unsigned);
+  if (!verifyMacText(value.localIntegrity.mac, expected)) {
+    fail("commercial-integrity", "integrity_quarantine_mac_mismatch", "quarantine");
+  }
+  return value;
+}
+function persistScheduledIntegrityQuarantine(integrityRoot, key, receipt, error, now) {
+  const unsigned = Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-commercial-integrity-quarantine-v1",
+    installationId: receipt.installationId,
+    hostInstanceId: receipt.hostInstanceId,
+    receiptId: receipt.receiptId,
+    closureDigest: receipt.closureDigest,
+    activationGeneration: receipt.activation.generation,
+    detectedAt: now.toISOString(),
+    source: "scheduled-verification",
+    stage: error instanceof CommercialArtifactError ? error.stage : "scheduled-verification",
+    reason: error instanceof CommercialArtifactError ? error.reason : "scheduled_verification_failed"
+  });
+  const value = Object.freeze({
+    ...unsigned,
+    localIntegrity: Object.freeze({
+      scheme: "hmac-sha256-v1",
+      mac: integrityMac(key, "aops-commercial-integrity-quarantine-v1", unsigned)
+    })
+  });
+  atomicWrite(safeChild(integrityRoot, "quarantine.json"), `${canonicalCommercialJson(value)}
+`);
+}
+function integrityRelativePath(storeRoot, filePath) {
+  const relative = path.relative(storeRoot, filePath).split(path.sep).join("/");
+  if (!relative || relative.startsWith("../") || path.isAbsolute(relative)) {
+    fail("commercial-integrity", "integrity_snapshot_path_escape", "quarantine");
+  }
+  return relative;
+}
+function integrityStoredPath(storeRoot, relativePath) {
+  let cursor = storeRoot;
+  for (const segment of relativePath.split("/"))
+    cursor = safeChild(cursor, segment);
+  return cursor;
+}
+function integrityFileRecord(storeRoot, filePath) {
+  const stat = lstatSync(filePath);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    fail("commercial-integrity", "integrity_snapshot_file_unsafe", "quarantine");
+  }
+  return Object.freeze({
+    relativePath: integrityRelativePath(storeRoot, filePath),
+    size: stat.size,
+    mtimeMs: stat.mtimeMs,
+    fileId: `${stat.dev}:${stat.ino}`
+  });
+}
+function runtimePackageReadOnlyRoot(nodeModulesRoot, packageName) {
+  const segments = packageName.split("/");
+  if (segments.length === 1)
+    return safeChild(nodeModulesRoot, segments[0]);
+  if (segments.length === 2 && segments[0].startsWith("@")) {
+    return safeChild(nodeModulesRoot, segments[0], segments[1]);
+  }
+  fail("commercial-integrity", "integrity_package_name_invalid", "quarantine");
+}
+function buildCommercialIntegrityAuthority(storeRoot, receipt, artifacts, source, now, flags = {
+  authorityReestablished: false,
+  previousAnchorUnknown: false
+}) {
+  const records = /* @__PURE__ */ new Map();
+  const add = (filePath) => {
+    const record = integrityFileRecord(storeRoot, filePath);
+    const existing = records.get(record.relativePath);
+    if (existing && existing.size !== record.size) {
+      fail("commercial-integrity", "integrity_snapshot_duplicate_mismatch", "quarantine");
+    }
+    records.set(record.relativePath, record);
+  };
+  for (const object of receipt.casObjects)
+    add(readOnlyObjectPath(storeRoot, object.digest));
+  const runtimeRoot = readOnlyRuntimeRootPath(storeRoot, receipt.closureDigest);
+  const nodeModulesRoot = safeChild(runtimeRoot, "node_modules");
+  const critical = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts.values()) {
+    const packageRoot = runtimePackageReadOnlyRoot(nodeModulesRoot, artifact.packageName);
+    for (const row of artifact.files) {
+      const treeFile = path.join(artifact.treePath, ...row.path.split("/"));
+      const runtimeFile = path.join(packageRoot, ...row.path.split("/"));
+      add(treeFile);
+      add(runtimeFile);
+      const candidates = critical.get(row.sha256) ?? [];
+      candidates.push(integrityRelativePath(storeRoot, runtimeFile));
+      critical.set(row.sha256, candidates);
+    }
+  }
+  const criticalFile = (digest2, reason) => {
+    const candidates = critical.get(digest2)?.sort();
+    if (!candidates?.length)
+      fail("commercial-integrity", reason, "quarantine");
+    return Object.freeze({ relativePath: candidates[0], digest: digest2 });
+  };
+  return Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-commercial-integrity-authority-v1",
+    installationId: receipt.installationId,
+    hostInstanceId: receipt.hostInstanceId,
+    receiptId: receipt.receiptId,
+    closureDigest: receipt.closureDigest,
+    activationGeneration: receipt.activation.generation,
+    verifiedAt: now.toISOString(),
+    verificationSource: source,
+    authorityReestablished: flags.authorityReestablished,
+    previousAnchorUnknown: flags.previousAnchorUnknown,
+    files: Object.freeze([...records.values()].sort((left, right) => compareCanonicalText(left.relativePath, right.relativePath))),
+    dcm: criticalFile(receipt.dcmDigest, "integrity_dcm_path_missing"),
+    operationCatalog: criticalFile(receipt.operationCatalogDigest, "integrity_operation_catalog_path_missing")
+  });
+}
+function persistCommercialIntegrityAuthority(integrityRoot, key, value) {
+  const authority = signCommercialIntegrityAuthority(key, value);
+  atomicWrite(safeChild(integrityRoot, "authority.json"), `${canonicalCommercialJson(authority)}
+`);
+  return authority;
+}
+function verifyRoutineIntegrityFiles(storeRoot, authority) {
+  let bytes = 0;
+  let advisoryMtimeDriftCount = 0;
+  let advisoryFileIdDriftCount = 0;
+  for (const expected of authority.files) {
+    const filePath = integrityStoredPath(storeRoot, expected.relativePath);
+    if (!existsSync(filePath))
+      return Object.freeze({
+        matches: false,
+        fileCount: authority.files.length,
+        bytes,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount
+      });
+    const stat = lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size !== expected.size) {
+      return Object.freeze({
+        matches: false,
+        fileCount: authority.files.length,
+        bytes,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount
+      });
+    }
+    bytes += stat.size;
+    if (stat.mtimeMs !== expected.mtimeMs)
+      advisoryMtimeDriftCount += 1;
+    if (`${stat.dev}:${stat.ino}` !== expected.fileId)
+      advisoryFileIdDriftCount += 1;
+  }
+  return Object.freeze({
+    matches: true,
+    fileCount: authority.files.length,
+    bytes,
+    advisoryMtimeDriftCount,
+    advisoryFileIdDriftCount
+  });
+}
+function readCriticalIntegrityFile(storeRoot, critical) {
+  const filePath = assertRegularFile(integrityStoredPath(storeRoot, critical.relativePath), "commercial-integrity", "integrity_critical_file_missing");
+  const bytes = readFileSync(filePath);
+  if (digestBytes(bytes) !== critical.digest) {
+    fail("commercial-integrity", "integrity_critical_file_digest_mismatch", "quarantine");
+  }
+  return bytes;
+}
+function readClosureFileByDigest(root, receipt, digest2) {
+  if (!SHA256.test(digest2))
+    fail("closure-readback", "closure_file_digest_invalid");
+  let matched = null;
+  for (const object of receipt.casObjects) {
+    if (!object.role.startsWith("npm:"))
+      continue;
+    const file = assertRegularFile(readOnlyObjectPath(root, object.digest), "cas-readback", "cas_object_missing");
+    const bytes = readFileSync(file);
+    if (bytes.byteLength !== object.size || digestBytes(bytes) !== object.digest) {
+      fail("cas-readback", "cas_object_digest_mismatch", "quarantine");
+    }
+    const archive = inspectNpmTarball(bytes);
+    for (const row of archive.files) {
+      if (row.sha256 !== digest2)
+        continue;
+      const candidate = archive.contents.get(row.path);
+      if (!candidate || digestBytes(candidate) !== digest2) {
+        fail("closure-readback", "closure_file_digest_mismatch", "quarantine");
+      }
+      if (matched && !matched.equals(candidate)) {
+        fail("closure-readback", "closure_file_digest_collision", "quarantine");
+      }
+      matched = Buffer.from(candidate);
+    }
+  }
+  if (!matched)
+    fail("closure-readback", "closure_file_missing", "quarantine");
+  return matched;
+}
+function readStoredManifest(root, digest2) {
+  const value = parseJsonFile(readOnlyManifestPath(root, digest2), "manifest-readback", "stored_manifest_invalid");
+  return value;
+}
+function assertManifestReceiptBinding(receipt, manifest) {
+  const payload = manifest.envelope.payload;
+  if (manifest.manifestDigest !== receipt.manifestDigest || payload.release.releaseId !== receipt.releaseId || payload.release.packageName !== receipt.packageName || payload.release.version !== receipt.version || payload.closureDigest !== receipt.closureDigest || payload.packlistDigest !== receipt.packlistDigest || payload.dcm.digest !== receipt.dcmDigest || payload.dcm.operationCatalogDigest !== receipt.operationCatalogDigest)
+    fail("manifest-readback", "manifest_receipt_mismatch", "quarantine");
+}
+function assertRoutineLaunchClosureBinding(root, receipt, payload) {
+  const roleRows = payload.closure.filter((entry) => entry.launchRole !== null);
+  const runtime = roleRows.find((entry) => entry.launchRole === "runtime-node");
+  if (!runtime)
+    fail("manifest-readback", "runtime_role_missing", "quarantine");
+  if (receipt.launchClosure.runtimeVersion !== runtime.version || receipt.launchClosure.entries.length !== roleRows.length)
+    fail("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+  for (const row of roleRows) {
+    const entry = receipt.launchClosure.entries.find((candidate) => candidate.role === row.launchRole);
+    const expectedPath = row.launchEntrypoint === null ? null : `runtimes/sha256/${receipt.closureDigest.slice("sha256:".length)}/node_modules/${row.packageName}/${row.launchEntrypoint}`;
+    if (!entry || entry.packageName !== row.packageName || entry.packageVersion !== row.version || entry.artifactDigest !== row.artifactSha256 || entry.entrypoint !== row.launchEntrypoint || entry.runtimeRange !== row.runtimeRange || entry.resolvedPath !== expectedPath)
+      fail("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+    const launchFile = assertRegularFile(integrityStoredPath(root, entry.resolvedPath), "manifest-readback", "launch_closure_file_missing");
+    if (statSync(launchFile).size < 0) {
+      fail("manifest-readback", "launch_closure_file_missing", "quarantine");
+    }
+    if (row.launchRole !== "runtime-node") {
+      if (row.runtimeRange === null) {
+        fail("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+      }
+      assertCommercialRuntimeCompatible(runtime.version, row.runtimeRange);
+    }
+  }
+}
+function assertAuthorityStoreBinding(authority, identity) {
+  if (authority.installationId !== identity.installationId || authority.hostInstanceId !== identity.hostInstanceId)
+    fail("commercial-integrity", "integrity_authority_store_identity_mismatch", "quarantine");
+}
+function readVerifiedActiveCommercialArtifact(options) {
+  const root = assertAbsoluteSafeRoot(options.storeRoot);
+  const identity = assertStoreIdentity(root, options.expectedIdentity);
+  if (existsSync(readOnlyStatePath(root, "activation-journal.json"))) {
+    fail("activation-readback", "activation_recovery_required", "quarantine");
+  }
+  const pointer = readPointer(root, "active.json");
+  if (!pointer)
+    return null;
+  const receipt = readReceipt(root, pointer.receiptId);
+  if (receipt.installationId !== identity.installationId || receipt.hostInstanceId !== identity.hostInstanceId)
+    fail("store-identity", "receipt_store_identity_mismatch", "quarantine");
+  assertRetainedHighWater(root, receipt);
+  const mode = options.verificationMode ?? "full";
+  const scheduledIntegrityRoot = mode === "scheduled" && options.integrityStateRoot ? commercialIntegrityRoot(options.integrityStateRoot) : null;
+  const scheduledKey = scheduledIntegrityRoot ? commercialIntegrityKey(scheduledIntegrityRoot) : null;
+  if (scheduledIntegrityRoot && scheduledKey && readCommercialIntegrityQuarantine(scheduledIntegrityRoot, scheduledKey))
+    fail("commercial-integrity", "integrity_scheduled_quarantine_active", "quarantine");
+  try {
+    const manifest = verifyReleaseManifestEnvelope(readStoredManifest(root, receipt.manifestDigest), {
+      trustKeys: options.trustKeys,
+      now: options.now,
+      knownOperationIds: options.knownOperationIds
+    });
+    assertManifestReceiptBinding(receipt, manifest);
+    const payload = manifest.envelope.payload;
+    let artifacts = null;
+    let routineAuthority = null;
+    let routineDecision = null;
+    let routineFileCount = 0;
+    let routineBytes = 0;
+    let advisoryMtimeDriftCount = 0;
+    let advisoryFileIdDriftCount = 0;
+    const routineStartedAt = process.hrtime.bigint();
+    const fullVerify = () => verifyStoredClosure(root, receipt, options.onClosureVerified);
+    if (mode === "routine" && options.integrityStateRoot) {
+      const integrityRoot = commercialIntegrityRoot(options.integrityStateRoot, false);
+      const key = integrityRoot ? commercialIntegrityKey(integrityRoot, false) : null;
+      const authority = integrityRoot && key ? readCommercialIntegrityAuthority(integrityRoot, key) : null;
+      if (integrityRoot && key && readCommercialIntegrityQuarantine(integrityRoot, key)) {
+        fail("commercial-integrity", "integrity_scheduled_quarantine_active", "quarantine");
+      }
+      if (!integrityRoot || !key || !authority) {
+        artifacts = fullVerify();
+        routineDecision = "full-fallback-authority-unavailable";
+      } else {
+        assertAuthorityStoreBinding(authority, identity);
+        if (authority.activationGeneration > receipt.activation.generation) {
+          fail("commercial-integrity", "integrity_authority_ahead", "quarantine");
+        }
+        if (authority.activationGeneration < receipt.activation.generation) {
+          const pending = readCommercialIntegrityPending(integrityRoot, key);
+          if (pending !== null && pending !== "invalid" && pending.installationId === identity.installationId && pending.hostInstanceId === identity.hostInstanceId && pending.target.receiptId === receipt.receiptId && pending.target.closureDigest === receipt.closureDigest && pending.target.activationGeneration === receipt.activation.generation) {
+            artifacts = fullVerify();
+            const healed = buildCommercialIntegrityAuthority(root, receipt, artifacts, pending.target.verificationSource, options.now ?? /* @__PURE__ */ new Date());
+            routineAuthority = persistCommercialIntegrityAuthority(integrityRoot, key, healed);
+            rmSync(safeChild(integrityRoot, "pending.json"), { force: true });
+            routineDecision = "full-heal-forward";
+          } else {
+            artifacts = fullVerify();
+            routineDecision = "full-fallback-authority-behind";
+          }
+        } else {
+          if (authority.receiptId !== receipt.receiptId || authority.closureDigest !== receipt.closureDigest)
+            fail("commercial-integrity", "integrity_authority_receipt_mismatch", "quarantine");
+          const sweep = verifyRoutineIntegrityFiles(root, authority);
+          routineFileCount = sweep.fileCount;
+          routineBytes = sweep.bytes;
+          advisoryMtimeDriftCount = sweep.advisoryMtimeDriftCount;
+          advisoryFileIdDriftCount = sweep.advisoryFileIdDriftCount;
+          if (!sweep.matches) {
+            artifacts = fullVerify();
+            const refreshed = buildCommercialIntegrityAuthority(root, receipt, artifacts, "routine-size-drift-full-verify", options.now ?? /* @__PURE__ */ new Date());
+            routineAuthority = persistCommercialIntegrityAuthority(integrityRoot, key, refreshed);
+            routineDecision = "full-fallback-size-drift";
+          } else {
+            routineAuthority = authority;
+            routineDecision = "verified";
+          }
+        }
+      }
+    } else {
+      artifacts = fullVerify();
+      if (mode === "scheduled" && options.integrityStateRoot) {
+        const integrityRoot = scheduledIntegrityRoot;
+        const key = scheduledKey;
+        const authority = integrityRoot && key ? readCommercialIntegrityAuthority(integrityRoot, key) : null;
+        if (!integrityRoot || !key || !authority) {
+          fail("commercial-integrity", "integrity_authority_reestablish_required", "quarantine");
+        }
+        assertAuthorityStoreBinding(authority, identity);
+        if (authority.activationGeneration > receipt.activation.generation) {
+          fail("commercial-integrity", "integrity_authority_ahead", "quarantine");
+        }
+        if (authority.activationGeneration < receipt.activation.generation) {
+          fail("commercial-integrity", "integrity_authority_behind_reestablish_required", "quarantine");
+        }
+        if (authority.receiptId !== receipt.receiptId || authority.closureDigest !== receipt.closureDigest) {
+          fail("commercial-integrity", "integrity_authority_receipt_mismatch", "quarantine");
+        }
+        persistCommercialIntegrityAuthority(integrityRoot, key, buildCommercialIntegrityAuthority(root, receipt, artifacts, "scheduled", options.now ?? /* @__PURE__ */ new Date()));
+      }
+    }
+    if (artifacts) {
+      const launchClosure = resolveLaunchClosure(payload, artifacts);
+      if (canonicalCommercialJson(launchClosure) !== canonicalCommercialJson(receipt.launchClosure)) {
+        fail("manifest-readback", "launch_closure_receipt_mismatch", "quarantine");
+      }
+    } else {
+      assertRoutineLaunchClosureBinding(root, receipt, payload);
+    }
+    const dcmBytes = routineAuthority ? readCriticalIntegrityFile(root, routineAuthority.dcm) : readClosureFileByDigest(root, receipt, receipt.dcmDigest);
+    const operationCatalogBytes = routineAuthority ? readCriticalIntegrityFile(root, routineAuthority.operationCatalog) : readClosureFileByDigest(root, receipt, receipt.operationCatalogDigest);
+    if (mode === "scheduled" && scheduledIntegrityRoot && scheduledKey) {
+      rmSync(safeChild(scheduledIntegrityRoot, "quarantine.json"), { force: true });
+    }
+    if (routineDecision) {
+      if (routineAuthority && routineFileCount === 0) {
+        const sweep = verifyRoutineIntegrityFiles(root, routineAuthority);
+        routineFileCount = sweep.fileCount;
+        routineBytes = sweep.bytes;
+        advisoryMtimeDriftCount = sweep.advisoryMtimeDriftCount;
+        advisoryFileIdDriftCount = sweep.advisoryFileIdDriftCount;
+      }
+      options.onRoutineVerified?.(Object.freeze({
+        elapsedMs: Number(process.hrtime.bigint() - routineStartedAt) / 1e6,
+        authorityDecision: routineDecision,
+        authoritativeFileCount: routineFileCount,
+        authoritativeBytes: routineBytes,
+        authoritativeBytesDerivedFromFileMetadata: true,
+        advisoryMtimeDriftCount,
+        advisoryFileIdDriftCount,
+        fullVerificationPerformed: routineDecision !== "verified"
+      }));
+    }
+    return Object.freeze({
+      receipt,
+      manifest,
+      dcmBytes,
+      operationCatalogBytes
+    });
+  } catch (error) {
+    if (mode === "scheduled" && scheduledIntegrityRoot && scheduledKey) {
+      persistScheduledIntegrityQuarantine(scheduledIntegrityRoot, scheduledKey, receipt, error, options.now ?? /* @__PURE__ */ new Date());
+    }
+    throw error;
+  }
+}
+const port = parentPort;
+if (!port) throw new Error("commercial_integrity_worker_parent_port_missing");
+try {
+  const data = workerData;
+  const active = readVerifiedActiveCommercialArtifact({
+    ...data.input,
+    verificationMode: "scheduled",
+    now: new Date(data.now)
+  });
+  if (!active) throw new Error("commercial_artifact_not_active");
+  port.postMessage({ ok: true, receiptId: active.receipt.receiptId });
+} catch (error) {
+  const candidate = error;
+  port.postMessage({
+    ok: false,
+    stage: typeof candidate?.stage === "string" ? candidate.stage : "commercial-integrity-scheduler",
+    decision: typeof candidate?.decision === "string" ? candidate.decision : "deny",
+    reason: typeof candidate?.reason === "string" ? candidate.reason : typeof candidate?.message === "string" ? candidate.message : "scheduled_verification_failed"
+  });
+}