@aopslabs/aops-server 0.2.0

package/build/server/chunks/admission-snapshot-C2wGfTWE.js

@@ -0,0 +1,1034 @@
+import { createPublicKey, verify, createHash } from 'node:crypto';
+
+const RELEASE_MANIFEST_OBJECT_TYPE = "aops-release-closure-manifest";
+const RELEASE_MANIFEST_CANONICALIZATION = "RFC8785-JCS-v1";
+const RELEASE_MANIFEST_PURPOSE = "urn:aops:artifact-installer:v1";
+const RELEASE_MANIFEST_CRITICAL_FIELDS = Object.freeze([
+  "objectType",
+  "payloadCanonicalization",
+  "schemaVersion"
+]);
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+const SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+const RELEASE_KID = /^release\/[A-Za-z0-9._~-]{1,160}$/;
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SOURCE_COMMIT = /^[a-f0-9]{40,64}$/;
+const NAMESPACE = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/;
+const COMMERCIAL_LAUNCH_ROLES = Object.freeze([
+  "runtime-node",
+  "cli",
+  "server",
+  "cockpit"
+]);
+const verifiedReleaseManifests = /* @__PURE__ */ new WeakSet();
+class CommercialArtifactError extends Error {
+  stage;
+  decision;
+  reason;
+  constructor(stage, reason, decision = "deny") {
+    super(`${stage}:${reason}`);
+    this.name = "CommercialArtifactError";
+    this.stage = stage;
+    this.reason = reason;
+    this.decision = decision;
+  }
+}
+function fail$3(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function isRecord$1(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function canonicalCommercialJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      fail$3("manifest-schema", "non_finite_number");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map((entry) => canonicalCommercialJson(entry)).join(",")}]`;
+  if (!isRecord$1(value))
+    fail$3("manifest-schema", "non_json_value");
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalCommercialJson(value[key])}`).join(",")}}`;
+}
+function sha256Commercial(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function runtimeVersionTuple(value) {
+  const match = /^([0-9]+)\.([0-9]+)\.([0-9]+)$/.exec(value);
+  if (!match)
+    fail$3("artifact-preflight", "bundled_runtime_version_invalid");
+  const tuple = match.slice(1).map(Number);
+  if (tuple.some((part) => !Number.isSafeInteger(part) || part < 0)) {
+    fail$3("artifact-preflight", "bundled_runtime_version_invalid");
+  }
+  return tuple;
+}
+function compareRuntimeVersions(left, right) {
+  for (let index = 0; index < left.length; index += 1) {
+    if (left[index] !== right[index])
+      return left[index] < right[index] ? -1 : 1;
+  }
+  return 0;
+}
+function assertCommercialRuntimeCompatible(version, supportedRange) {
+  const current = runtimeVersionTuple(version);
+  const clauses = supportedRange.trim().split(/\s+/);
+  const compatible = clauses.length > 0 && clauses.every((clause) => {
+    const match = /^(>=|>|<=|<|=)?([0-9]+\.[0-9]+\.[0-9]+)$/.exec(clause);
+    if (!match)
+      return false;
+    const comparison = compareRuntimeVersions(current, runtimeVersionTuple(match[2]));
+    if (match[1] === ">=")
+      return comparison >= 0;
+    if (match[1] === ">")
+      return comparison > 0;
+    if (match[1] === "<=")
+      return comparison <= 0;
+    if (match[1] === "<")
+      return comparison < 0;
+    return comparison === 0;
+  });
+  if (!compatible)
+    fail$3("artifact-preflight", "bundled_runtime_incompatible");
+}
+function exactObject(value, keys, reason) {
+  if (!isRecord$1(value))
+    fail$3("manifest-schema", reason);
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  if (canonicalCommercialJson(actual) !== canonicalCommercialJson(expected))
+    fail$3("manifest-schema", reason);
+}
+function requiredString(record, key, reason) {
+  const value = record[key];
+  if (typeof value !== "string" || !value || value !== value.trim() || value.length > 1024) {
+    fail$3("manifest-schema", reason);
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value))
+    fail$3("manifest-schema", reason);
+  return value;
+}
+function digest(record, key, reason) {
+  const value = requiredString(record, key, reason);
+  if (!SHA256.test(value))
+    fail$3("manifest-schema", reason);
+  return value;
+}
+function timestamp(record, key, reason) {
+  const value = requiredString(record, key, reason);
+  const millis = Date.parse(value);
+  if (!Number.isFinite(millis) || new Date(millis).toISOString() !== value)
+    fail$3("manifest-schema", reason);
+  return value;
+}
+function sortedUniqueStrings(record, key, reason, options = {}) {
+  const value = record[key];
+  if (!Array.isArray(value) || !options.allowEmpty && value.length === 0)
+    fail$3("manifest-schema", reason);
+  const strings = value.map((entry) => {
+    if (typeof entry !== "string" || !entry || entry !== entry.trim() || entry.length > 1024) {
+      fail$3("manifest-schema", reason);
+    }
+    if (options.validate && !options.validate(entry))
+      fail$3("manifest-schema", reason);
+    return entry;
+  });
+  const expected = [...new Set(strings)].sort();
+  if (canonicalCommercialJson(strings) !== canonicalCommercialJson(expected))
+    fail$3("manifest-schema", reason);
+  return Object.freeze(strings);
+}
+function safeEntrypoint(value) {
+  if (pathLikeAbsolute(value) || value.includes("\\") || value.includes("\0"))
+    return false;
+  const separator = value.indexOf(":");
+  if (separator < 1)
+    return false;
+  const packageName = value.slice(0, separator);
+  const relative = value.slice(separator + 1);
+  return PACKAGE_NAME.test(packageName) && relative.length > 0 && relative.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+function safePackageRelativeEntrypoint(value) {
+  return value.length > 0 && value.length <= 4096 && !pathLikeAbsolute(value) && !value.includes("\\") && !value.includes("\0") && value.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+function validRuntimeRange(value) {
+  const clauses = value.trim().split(/\s+/);
+  return clauses.length > 0 && clauses.every((clause) => /^(?:>=|>|<=|<|=)?[0-9]+\.[0-9]+\.[0-9]+$/.test(clause));
+}
+function pathLikeAbsolute(value) {
+  return value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+}
+function assertNoLocalMaterial(value, reason) {
+  if (pathLikeAbsolute(value) || /(?:localhost|127\.0\.0\.1|password|token|secret)=/i.test(value)) {
+    fail$3("manifest-schema", reason);
+  }
+}
+function parseClosure(value) {
+  if (!Array.isArray(value) || value.length === 0)
+    fail$3("manifest-schema", "closure_invalid");
+  const rows = value.map((candidate) => {
+    exactObject(candidate, [
+      "packageName",
+      "version",
+      "artifactSha256",
+      "packageIntegrity",
+      "filesDigest",
+      "launchRole",
+      "launchEntrypoint",
+      "runtimeRange"
+    ], "closure_entry_invalid");
+    const packageName = requiredString(candidate, "packageName", "closure_package_invalid");
+    const version = requiredString(candidate, "version", "closure_version_invalid");
+    const packageIntegrity = requiredString(candidate, "packageIntegrity", "closure_integrity_invalid");
+    if (!PACKAGE_NAME.test(packageName))
+      fail$3("manifest-schema", "closure_package_invalid");
+    if (!VERSION.test(version))
+      fail$3("manifest-schema", "closure_version_invalid");
+    if (!SHA512_INTEGRITY.test(packageIntegrity))
+      fail$3("manifest-schema", "closure_integrity_invalid");
+    const launchRole = candidate.launchRole;
+    if (launchRole !== null && !COMMERCIAL_LAUNCH_ROLES.includes(launchRole)) {
+      fail$3("manifest-schema", "closure_launch_role_invalid");
+    }
+    const launchEntrypoint = candidate.launchEntrypoint;
+    const runtimeRange = candidate.runtimeRange;
+    if (launchRole === null) {
+      if (launchEntrypoint !== null || runtimeRange !== null) {
+        fail$3("manifest-schema", "closure_launch_binding_invalid");
+      }
+    } else {
+      if (typeof launchEntrypoint !== "string" || !safePackageRelativeEntrypoint(launchEntrypoint)) {
+        fail$3("manifest-schema", "closure_launch_entrypoint_invalid");
+      }
+      if (launchRole === "runtime-node") {
+        if (runtimeRange !== null)
+          fail$3("manifest-schema", "closure_runtime_range_invalid");
+      } else if (typeof runtimeRange !== "string" || !validRuntimeRange(runtimeRange)) {
+        fail$3("manifest-schema", "closure_runtime_range_invalid");
+      }
+    }
+    return Object.freeze({
+      packageName,
+      version,
+      artifactSha256: digest(candidate, "artifactSha256", "closure_artifact_digest_invalid"),
+      packageIntegrity,
+      filesDigest: digest(candidate, "filesDigest", "closure_files_digest_invalid"),
+      launchRole,
+      launchEntrypoint,
+      runtimeRange
+    });
+  });
+  const identities = rows.map((row) => `${row.packageName}@${row.version}`);
+  if (canonicalCommercialJson(identities) !== canonicalCommercialJson([...new Set(identities)].sort())) {
+    fail$3("manifest-schema", "closure_order_invalid");
+  }
+  const roles = rows.filter((row) => row.launchRole !== null).map((row) => row.launchRole);
+  if (roles.filter((role) => role === "runtime-node").length !== 1) {
+    fail$3("manifest-schema", "closure_runtime_role_invalid");
+  }
+  if (new Set(roles).size !== roles.length)
+    fail$3("manifest-schema", "closure_launch_role_duplicate");
+  return Object.freeze(rows);
+}
+function parseRelease(value) {
+  exactObject(value, ["packageName", "version", "releaseId", "sourceRepositoryId", "sourceCommit", "sourceTag"], "release_invalid");
+  const packageName = requiredString(value, "packageName", "release_package_invalid");
+  const version = requiredString(value, "version", "release_version_invalid");
+  const sourceRepositoryId = requiredString(value, "sourceRepositoryId", "release_repository_invalid");
+  const sourceCommit = requiredString(value, "sourceCommit", "release_commit_invalid");
+  const sourceTag = requiredString(value, "sourceTag", "release_tag_invalid");
+  if (!PACKAGE_NAME.test(packageName))
+    fail$3("manifest-schema", "release_package_invalid");
+  if (!VERSION.test(version))
+    fail$3("manifest-schema", "release_version_invalid");
+  if (!SOURCE_COMMIT.test(sourceCommit))
+    fail$3("manifest-schema", "release_commit_invalid");
+  assertNoLocalMaterial(sourceRepositoryId, "release_repository_invalid");
+  assertNoLocalMaterial(sourceTag, "release_tag_invalid");
+  return Object.freeze({
+    packageName,
+    version,
+    releaseId: requiredString(value, "releaseId", "release_id_invalid"),
+    sourceRepositoryId,
+    sourceCommit,
+    sourceTag
+  });
+}
+function parseMigrationCapsules(value) {
+  if (!Array.isArray(value))
+    fail$3("manifest-schema", "migration_capsules_invalid");
+  const rows = value.map((candidate) => {
+    exactObject(candidate, ["capsuleId", "version", "digest", "semanticContractDigest", "readbackPolicy", "rollbackPolicy"], "migration_capsule_invalid");
+    const version = requiredString(candidate, "version", "migration_capsule_version_invalid");
+    if (!VERSION.test(version))
+      fail$3("manifest-schema", "migration_capsule_version_invalid");
+    return Object.freeze({
+      capsuleId: requiredString(candidate, "capsuleId", "migration_capsule_id_invalid"),
+      version,
+      digest: digest(candidate, "digest", "migration_capsule_digest_invalid"),
+      semanticContractDigest: digest(candidate, "semanticContractDigest", "migration_semantic_digest_invalid"),
+      readbackPolicy: requiredString(candidate, "readbackPolicy", "migration_readback_policy_invalid"),
+      rollbackPolicy: requiredString(candidate, "rollbackPolicy", "migration_rollback_policy_invalid")
+    });
+  });
+  const identities = rows.map((row) => `${row.capsuleId}@${row.version}`);
+  if (canonicalCommercialJson(identities) !== canonicalCommercialJson([...new Set(identities)].sort())) {
+    fail$3("manifest-schema", "migration_capsule_order_invalid");
+  }
+  return Object.freeze(rows);
+}
+function parseReleaseClosureManifest(value, options = {}) {
+  exactObject(value, [
+    "manifestId",
+    "publisherId",
+    "issuedAt",
+    "notBefore",
+    "notAfter",
+    "release",
+    "closure",
+    "closureDigest",
+    "packlistDigest",
+    "sbom",
+    "entrypoints",
+    "dcm",
+    "hostAbi",
+    "migrationCapsules",
+    "degradedOperationIds",
+    "extensions"
+  ], "release_manifest_invalid");
+  const issuedAt = timestamp(value, "issuedAt", "issued_at_invalid");
+  const notBefore = timestamp(value, "notBefore", "not_before_invalid");
+  const notAfter = timestamp(value, "notAfter", "not_after_invalid");
+  if (!(Date.parse(notBefore) <= Date.parse(issuedAt) && Date.parse(issuedAt) < Date.parse(notAfter))) {
+    fail$3("manifest-schema", "manifest_time_order_invalid");
+  }
+  const release = parseRelease(value.release);
+  const closure = parseClosure(value.closure);
+  if (!closure.some((row) => row.packageName === release.packageName && row.version === release.version)) {
+    fail$3("manifest-schema", "release_missing_from_closure");
+  }
+  const closureDigest = digest(value, "closureDigest", "closure_digest_invalid");
+  if (sha256Commercial(canonicalCommercialJson(closure)) !== closureDigest) {
+    fail$3("manifest-closure", "closure_digest_mismatch");
+  }
+  exactObject(value.sbom, ["format", "digest"], "sbom_invalid");
+  const sbom = Object.freeze({
+    format: requiredString(value.sbom, "format", "sbom_format_invalid"),
+    digest: digest(value.sbom, "digest", "sbom_digest_invalid")
+  });
+  exactObject(value.entrypoints, ["plugin", "dcmProviders", "manifestProviders", "resources"], "entrypoints_invalid");
+  const plugin = requiredString(value.entrypoints, "plugin", "plugin_entrypoint_invalid");
+  if (!safeEntrypoint(plugin))
+    fail$3("manifest-schema", "plugin_entrypoint_invalid");
+  const entrypoints = Object.freeze({
+    plugin,
+    dcmProviders: sortedUniqueStrings(value.entrypoints, "dcmProviders", "dcm_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint }),
+    manifestProviders: sortedUniqueStrings(value.entrypoints, "manifestProviders", "manifest_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint }),
+    resources: sortedUniqueStrings(value.entrypoints, "resources", "resource_entrypoints_invalid", { allowEmpty: true, validate: safeEntrypoint })
+  });
+  exactObject(value.dcm, ["digest", "operationCatalogDigest"], "dcm_invalid");
+  const dcm = Object.freeze({
+    digest: digest(value.dcm, "digest", "dcm_digest_invalid"),
+    operationCatalogDigest: digest(value.dcm, "operationCatalogDigest", "operation_catalog_digest_invalid")
+  });
+  exactObject(value.hostAbi, ["protocolVersion", "supportedRange"], "host_abi_invalid");
+  const hostAbi = Object.freeze({
+    protocolVersion: requiredString(value.hostAbi, "protocolVersion", "host_abi_protocol_invalid"),
+    supportedRange: requiredString(value.hostAbi, "supportedRange", "host_abi_range_invalid")
+  });
+  const degradedOperationIds = sortedUniqueStrings(value, "degradedOperationIds", "degraded_operations_invalid", { allowEmpty: true });
+  if (options.knownOperationIds) {
+    for (const operationId of degradedOperationIds) {
+      if (!options.knownOperationIds.has(operationId))
+        fail$3("manifest-schema", "unknown_degraded_operation");
+    }
+  }
+  if (!isRecord$1(value.extensions))
+    fail$3("manifest-schema", "extensions_invalid");
+  for (const [namespace, extension] of Object.entries(value.extensions)) {
+    if (!NAMESPACE.test(namespace) || !isRecord$1(extension))
+      fail$3("manifest-schema", "extension_invalid");
+    canonicalCommercialJson(extension);
+  }
+  return Object.freeze({
+    manifestId: requiredString(value, "manifestId", "manifest_id_invalid"),
+    publisherId: requiredString(value, "publisherId", "publisher_id_invalid"),
+    issuedAt,
+    notBefore,
+    notAfter,
+    release,
+    closure,
+    closureDigest,
+    packlistDigest: digest(value, "packlistDigest", "packlist_digest_invalid"),
+    sbom,
+    entrypoints,
+    dcm,
+    hostAbi,
+    migrationCapsules: parseMigrationCapsules(value.migrationCapsules),
+    degradedOperationIds,
+    extensions: Object.freeze({ ...value.extensions })
+  });
+}
+function signatureInput(envelope) {
+  return canonicalCommercialJson(envelope);
+}
+function createReleaseManifestSigningInput(envelope) {
+  return Buffer.from(signatureInput(envelope), "utf8");
+}
+function parseReleaseManifestEnvelope(value, options = {}) {
+  exactObject(value, ["schemaVersion", "objectType", "payloadCanonicalization", "payloadDigest", "signingHeader", "signature", "payload"], "manifest_envelope_invalid");
+  if (value.schemaVersion !== 2)
+    fail$3("manifest-schema", "unsupported_schema_version");
+  if (value.objectType !== RELEASE_MANIFEST_OBJECT_TYPE)
+    fail$3("manifest-schema", "object_type_mismatch");
+  if (value.payloadCanonicalization !== RELEASE_MANIFEST_CANONICALIZATION) {
+    fail$3("manifest-schema", "canonicalization_unsupported");
+  }
+  exactObject(value.signingHeader, ["purpose", "alg", "kid", "crit"], "signing_header_invalid");
+  if (value.signingHeader.purpose !== RELEASE_MANIFEST_PURPOSE)
+    fail$3("manifest-signature", "key_purpose_mismatch");
+  if (value.signingHeader.alg !== "EdDSA")
+    fail$3("manifest-signature", "algorithm_not_allowed");
+  const kid = requiredString(value.signingHeader, "kid", "signing_kid_invalid");
+  if (!RELEASE_KID.test(kid))
+    fail$3("manifest-signature", "key_purpose_mismatch");
+  const crit = sortedUniqueStrings(value.signingHeader, "crit", "critical_fields_invalid", { allowEmpty: true });
+  if (canonicalCommercialJson(crit) !== canonicalCommercialJson(RELEASE_MANIFEST_CRITICAL_FIELDS)) {
+    fail$3("manifest-signature", "unknown_critical_field");
+  }
+  const signature = requiredString(value, "signature", "signature_invalid");
+  if (!/^[A-Za-z0-9_-]{86}$/.test(signature))
+    fail$3("manifest-signature", "signature_invalid");
+  const payload = parseReleaseClosureManifest(value.payload, options);
+  const payloadDigest = digest(value, "payloadDigest", "payload_digest_invalid");
+  if (sha256Commercial(canonicalCommercialJson(payload)) !== payloadDigest) {
+    fail$3("manifest-digest", "payload_digest_mismatch");
+  }
+  return Object.freeze({
+    schemaVersion: 2,
+    objectType: RELEASE_MANIFEST_OBJECT_TYPE,
+    payloadCanonicalization: RELEASE_MANIFEST_CANONICALIZATION,
+    payloadDigest,
+    signingHeader: Object.freeze({
+      purpose: RELEASE_MANIFEST_PURPOSE,
+      alg: "EdDSA",
+      kid,
+      crit
+    }),
+    signature,
+    payload
+  });
+}
+function decodeBase64Url(value) {
+  try {
+    return Buffer.from(value, "base64url");
+  } catch {
+    fail$3("manifest-signature", "signature_invalid");
+  }
+}
+function verifyReleaseManifestEnvelope(value, options) {
+  const envelope = parseReleaseManifestEnvelope(value, { knownOperationIds: options.knownOperationIds });
+  const duplicateKids = options.trustKeys.filter((key) => key.kid === envelope.signingHeader.kid);
+  if (duplicateKids.length !== 1)
+    fail$3("manifest-signature", duplicateKids.length ? "duplicate_trust_key" : "unknown_signing_key");
+  const trustKey = duplicateKids[0];
+  if (trustKey.purpose !== RELEASE_MANIFEST_PURPOSE || trustKey.alg !== "EdDSA" || !RELEASE_KID.test(trustKey.kid)) {
+    fail$3("manifest-signature", "key_purpose_mismatch");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const nowMillis = now.getTime();
+  if (!Number.isFinite(nowMillis))
+    fail$3("manifest-validity", "clock_invalid");
+  if (trustKey.status !== void 0 && !["active", "verify-only", "retired", "revoked"].includes(trustKey.status))
+    fail$3("manifest-signature", "release_key_status_invalid");
+  if (trustKey.status === "retired" || trustKey.status === "revoked") {
+    fail$3("manifest-signature", "release_key_not_accepted");
+  }
+  const keyNotBefore = trustKey.notBefore === void 0 ? null : Date.parse(trustKey.notBefore);
+  const keyNotAfter = trustKey.notAfter === void 0 ? null : Date.parse(trustKey.notAfter);
+  if (keyNotBefore !== null && !Number.isFinite(keyNotBefore) || keyNotAfter !== null && !Number.isFinite(keyNotAfter) || keyNotBefore !== null && keyNotAfter !== null && keyNotBefore >= keyNotAfter)
+    fail$3("manifest-signature", "release_key_time_invalid");
+  if (keyNotBefore !== null && nowMillis < keyNotBefore) {
+    fail$3("manifest-signature", "release_key_not_yet_valid");
+  }
+  if (keyNotAfter !== null && nowMillis >= keyNotAfter) {
+    fail$3("manifest-signature", "release_key_expired");
+  }
+  let publicKey;
+  try {
+    publicKey = createPublicKey(trustKey.publicKeyPem);
+  } catch {
+    fail$3("manifest-signature", "trust_key_invalid");
+  }
+  if (publicKey.asymmetricKeyType !== "ed25519")
+    fail$3("manifest-signature", "algorithm_not_allowed");
+  const unsigned = {
+    schemaVersion: envelope.schemaVersion,
+    objectType: envelope.objectType,
+    payloadCanonicalization: envelope.payloadCanonicalization,
+    payloadDigest: envelope.payloadDigest,
+    signingHeader: envelope.signingHeader,
+    payload: envelope.payload
+  };
+  if (!verify(null, createReleaseManifestSigningInput(unsigned), publicKey, decodeBase64Url(envelope.signature))) {
+    fail$3("manifest-signature", "bad_signature");
+  }
+  if (nowMillis < Date.parse(envelope.payload.notBefore))
+    fail$3("manifest-validity", "manifest_not_yet_valid");
+  if (nowMillis >= Date.parse(envelope.payload.notAfter))
+    fail$3("manifest-validity", "manifest_expired");
+  const verified = Object.freeze({
+    envelope,
+    manifestDigest: sha256Commercial(canonicalCommercialJson(envelope)),
+    payloadDigest: envelope.payloadDigest,
+    verifiedAt: now.toISOString(),
+    signerKid: envelope.signingHeader.kid
+  });
+  verifiedReleaseManifests.add(verified);
+  return verified;
+}
+const verifiedRevocationSnapshots = /* @__PURE__ */ new WeakSet();
+function fail$2(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function text$1(value, maximum = 512) {
+  if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > maximum || /[\u0000-\u001f\u007f]/u.test(value))
+    fail$2("revocation-snapshot-schema", "revocation_snapshot_schema_invalid");
+  return value;
+}
+function assertVerifiedRevocationSnapshot(value) {
+  if (!verifiedRevocationSnapshots.has(value)) {
+    fail$2("revocation-snapshot-authority", "unverified_revocation_snapshot_identity");
+  }
+}
+function assertRevocationSnapshotCovers(input) {
+  assertVerifiedRevocationSnapshot(input.snapshot);
+  const claims = input.snapshot.claims;
+  if (claims.iss !== input.issuer) {
+    fail$2("revocation-snapshot-coverage", "revocation_snapshot_issuer_invalid");
+  }
+  if (claims.tenantId !== input.tenantId) {
+    fail$2("revocation-snapshot-coverage", "revocation_snapshot_tenant_not_covered");
+  }
+  if (claims.coverage.kind === "installation" && claims.coverage.installationId !== input.installationId || claims.coverage.kind === "product" && !claims.coverage.productIds.includes(input.productId))
+    fail$2("revocation-snapshot-coverage", "revocation_snapshot_scope_not_covered");
+}
+function evaluateRevocationSnapshotLease(input) {
+  assertVerifiedRevocationSnapshot(input.snapshot);
+  const leaseId = text$1(input.leaseId, 200);
+  const common = {
+    snapshotOrdinal: input.snapshot.claims.snapshotOrdinal,
+    revocationEpoch: input.snapshot.claims.revocationEpoch
+  };
+  if (input.snapshot.claims.revokedLeaseIds.includes(leaseId)) {
+    return Object.freeze({ status: "revoked", ...common });
+  }
+  if (input.snapshot.mode === "retained-deny-only") {
+    return Object.freeze({
+      status: "unknown",
+      reason: "snapshot_expired",
+      ...common
+    });
+  }
+  return Object.freeze({ status: "not-revoked", ...common });
+}
+const ENTITLEMENT_LEASE_ALGORITHM = "EdDSA";
+const ENTITLEMENT_LEASE_TYPE = "aops-entitlement-lease+jwt";
+const ENTITLEMENT_LEASE_PURPOSE = "urn:aops:commercial-admission:v1";
+const ENTITLEMENT_LEASE_SCHEMA_VERSION = 1;
+const ENTITLEMENT_LEASE_BOUND_SCHEMA_VERSION = 2;
+const OFFLINE_LEASE_MAX_FULL_WINDOW_SECONDS = 90 * 24 * 60 * 60;
+const OFFLINE_LEASE_MAX_DEGRADED_WINDOW_SECONDS = 14 * 24 * 60 * 60;
+const UNSIGNED_REVOCATION_LIST_REFUSAL = Object.freeze({
+  stage: "lease-revocation-migration",
+  reason: "unsigned_revocation_list_refused",
+  decision: "quarantine",
+  nextAction: "Import and verify a South-signed revocation snapshot; do not retain derived revoked ID lists."
+});
+const MAX_LEASE_BYTES = 32 * 1024;
+const CLOCK_SKEW_SECONDS = 30;
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+const LEASE_KID = /^lease\/[A-Za-z0-9._:/-]+$/;
+const verifiedEntitlementLeases = /* @__PURE__ */ new WeakSet();
+const COMMON_CLAIM_KEYS = Object.freeze([
+  "aud",
+  "domainConstraints",
+  "entitlementEpoch",
+  "exp",
+  "featureIds",
+  "fullUntil",
+  "iat",
+  "installationId",
+  "iss",
+  "jti",
+  "leaseMode",
+  "nbf",
+  "productIds",
+  "refreshAfter",
+  "releaseConstraint",
+  "revocationEpoch",
+  "schemaVersion",
+  "skuId",
+  "subscriptionId",
+  "tenantId"
+]);
+const CLAIM_KEYS_V1 = COMMON_CLAIM_KEYS;
+const CLAIM_KEYS_V2 = Object.freeze([
+  ...COMMON_CLAIM_KEYS,
+  "activationBinding",
+  "installationKeyThumbprint"
+]);
+function fail$1(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, expected, stage) {
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (actual.length !== sortedExpected.length || actual.some((key, index) => key !== sortedExpected[index]))
+    fail$1(stage, "lease_schema_invalid");
+}
+function text(value, maximum = 512) {
+  if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > maximum)
+    fail$1("lease-schema", "lease_schema_invalid");
+  return value;
+}
+function integer(value) {
+  if (!Number.isSafeInteger(value))
+    fail$1("lease-schema", "lease_schema_invalid");
+  return value;
+}
+function sortedTexts(value, maximum = 200) {
+  if (!Array.isArray(value) || value.length > 512)
+    fail$1("lease-schema", "lease_schema_invalid");
+  const result = value.map((entry) => text(entry, maximum));
+  const sorted = [...result].sort();
+  if (new Set(result).size !== result.length || result.some((entry, index) => entry !== sorted[index]))
+    fail$1("lease-schema", "lease_schema_invalid");
+  return Object.freeze(result);
+}
+function sortedDigests(value) {
+  const digests = sortedTexts(value, 64);
+  if (digests.some((digest2) => !SHA256_HEX.test(digest2))) {
+    fail$1("lease-schema", "lease_schema_invalid");
+  }
+  return digests;
+}
+function normalizeDigest(value) {
+  const digest2 = value.startsWith("sha256:") ? value.slice("sha256:".length) : value;
+  if (!SHA256_HEX.test(digest2))
+    fail$1("lease-coverage", "release_digest_invalid");
+  return digest2;
+}
+function releaseConstraint(value) {
+  if (!isRecord(value))
+    fail$1("lease-schema", "lease_schema_invalid");
+  exactKeys(value, ["manifestDigests", "closureDigests", "versionRange"], "lease-schema");
+  const manifestDigests = sortedDigests(value.manifestDigests);
+  const closureDigests = sortedDigests(value.closureDigests);
+  const versionRange = value.versionRange === null ? null : text(value.versionRange);
+  if (manifestDigests.length === 0 && closureDigests.length === 0 && versionRange === null) {
+    fail$1("lease-schema", "lease_release_constraint_empty");
+  }
+  return Object.freeze({ manifestDigests, closureDigests, versionRange });
+}
+function sha256(value) {
+  const digest2 = text(value, 64);
+  if (!SHA256_HEX.test(digest2))
+    fail$1("lease-schema", "lease_schema_invalid");
+  return digest2;
+}
+function activationBinding(value, leaseMode) {
+  if (!isRecord(value))
+    fail$1("lease-schema", "lease_schema_invalid");
+  exactKeys(value, ["challengeDigest", "kind"], "lease-schema");
+  if (value.kind !== "online" && value.kind !== "offline-challenge") {
+    fail$1("lease-schema", "lease_schema_invalid");
+  }
+  const challengeDigest = value.challengeDigest === null ? null : sha256(value.challengeDigest);
+  if (leaseMode === "online" && (value.kind !== "online" || challengeDigest !== null) || leaseMode === "offline" && (value.kind !== "offline-challenge" || challengeDigest === null))
+    fail$1("lease-schema", "lease_activation_binding_invalid");
+  return Object.freeze({ kind: value.kind, challengeDigest });
+}
+function decodeSegment(segment) {
+  if (!/^[A-Za-z0-9_-]+$/.test(segment))
+    fail$1("lease-schema", "lease_compact_invalid");
+  const decoded = Buffer.from(segment, "base64url");
+  if (decoded.toString("base64url") !== segment)
+    fail$1("lease-schema", "lease_compact_invalid");
+  return decoded;
+}
+function decodeJson(segment) {
+  try {
+    const value = JSON.parse(decodeSegment(segment).toString("utf8"));
+    if (!isRecord(value))
+      fail$1("lease-schema", "lease_schema_invalid");
+    return value;
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail$1("lease-schema", "lease_json_invalid");
+  }
+}
+function normalizeEntitlementLeaseClaims(value) {
+  if (!isRecord(value))
+    fail$1("lease-schema", "lease_schema_invalid");
+  const schemaVersion = integer(value.schemaVersion);
+  if (schemaVersion !== ENTITLEMENT_LEASE_SCHEMA_VERSION && schemaVersion !== ENTITLEMENT_LEASE_BOUND_SCHEMA_VERSION) {
+    fail$1("lease-schema", "lease_schema_version_unsupported");
+  }
+  exactKeys(value, schemaVersion === ENTITLEMENT_LEASE_SCHEMA_VERSION ? CLAIM_KEYS_V1 : CLAIM_KEYS_V2, "lease-schema");
+  const aud = text(value.aud);
+  if (aud !== ENTITLEMENT_LEASE_PURPOSE)
+    fail$1("lease-schema", "lease_audience_invalid");
+  const leaseMode = value.leaseMode;
+  if (leaseMode !== "online" && leaseMode !== "offline") {
+    fail$1("lease-schema", "lease_mode_invalid");
+  }
+  const common = {
+    iss: text(value.iss),
+    aud: ENTITLEMENT_LEASE_PURPOSE,
+    jti: text(value.jti, 200),
+    tenantId: text(value.tenantId, 200),
+    subscriptionId: text(value.subscriptionId, 200),
+    installationId: text(value.installationId, 200),
+    productIds: sortedTexts(value.productIds),
+    skuId: text(value.skuId, 200),
+    featureIds: sortedTexts(value.featureIds),
+    domainConstraints: sortedTexts(value.domainConstraints),
+    releaseConstraint: releaseConstraint(value.releaseConstraint),
+    leaseMode,
+    entitlementEpoch: integer(value.entitlementEpoch),
+    revocationEpoch: integer(value.revocationEpoch),
+    iat: integer(value.iat),
+    nbf: integer(value.nbf),
+    refreshAfter: integer(value.refreshAfter),
+    fullUntil: integer(value.fullUntil),
+    exp: integer(value.exp)
+  };
+  const claims = schemaVersion === ENTITLEMENT_LEASE_SCHEMA_VERSION ? Object.freeze({ schemaVersion: 1, ...common }) : Object.freeze({
+    schemaVersion: 2,
+    ...common,
+    installationKeyThumbprint: sha256(value.installationKeyThumbprint),
+    activationBinding: activationBinding(value.activationBinding, leaseMode)
+  });
+  if (claims.productIds.length === 0 || claims.entitlementEpoch < 1 || claims.revocationEpoch < 0 || claims.nbf < claims.iat - CLOCK_SKEW_SECONDS || claims.refreshAfter < claims.nbf || claims.fullUntil < claims.refreshAfter || claims.exp < claims.fullUntil)
+    fail$1("lease-schema", "lease_time_or_epoch_invalid");
+  if (claims.leaseMode === "offline" && (claims.fullUntil - claims.nbf > OFFLINE_LEASE_MAX_FULL_WINDOW_SECONDS || claims.exp - claims.fullUntil > OFFLINE_LEASE_MAX_DEGRADED_WINDOW_SECONDS))
+    fail$1("lease-schema", "offline_lease_window_exceeded");
+  return claims;
+}
+function assertTrustKey(key, nowMs) {
+  if (key.alg !== ENTITLEMENT_LEASE_ALGORITHM || key.purpose !== ENTITLEMENT_LEASE_PURPOSE || !LEASE_KID.test(key.kid))
+    fail$1("lease-signature", "lease_key_purpose_mismatch");
+  if (key.status !== void 0 && !["active", "verify-only", "retired", "revoked"].includes(key.status))
+    fail$1("lease-signature", "lease_key_status_invalid");
+  if (key.status === "revoked" || key.status === "retired") {
+    fail$1("lease-signature", "lease_key_not_accepted");
+  }
+  const notBefore = key.notBefore === void 0 ? null : Date.parse(key.notBefore);
+  const notAfter = key.notAfter === void 0 ? null : Date.parse(key.notAfter);
+  if (notBefore !== null && !Number.isFinite(notBefore) || notAfter !== null && !Number.isFinite(notAfter) || notBefore !== null && notAfter !== null && notBefore >= notAfter)
+    fail$1("lease-signature", "lease_key_time_invalid");
+  if (notBefore !== null && nowMs < notBefore) {
+    fail$1("lease-signature", "lease_key_not_yet_valid");
+  }
+  if (notAfter !== null && nowMs >= notAfter) {
+    fail$1("lease-signature", "lease_key_expired");
+  }
+}
+function verifyEntitlementLease(input) {
+  if (Object.prototype.hasOwnProperty.call(input, "revokedLeaseIds") && input.revokedLeaseIds !== void 0) {
+    throw new CommercialArtifactError(UNSIGNED_REVOCATION_LIST_REFUSAL.stage, UNSIGNED_REVOCATION_LIST_REFUSAL.reason, UNSIGNED_REVOCATION_LIST_REFUSAL.decision);
+  }
+  if (typeof input.token !== "string" || input.token.length < 16 || Buffer.byteLength(input.token, "utf8") > MAX_LEASE_BYTES)
+    fail$1("lease-schema", "lease_compact_invalid");
+  const parts = input.token.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+    fail$1("lease-schema", "lease_compact_invalid");
+  }
+  const header = decodeJson(parts[0]);
+  exactKeys(header, ["alg", "kid", "typ"], "lease-schema");
+  if (header.alg !== ENTITLEMENT_LEASE_ALGORITHM)
+    fail$1("lease-signature", "lease_algorithm_invalid");
+  if (header.typ !== ENTITLEMENT_LEASE_TYPE)
+    fail$1("lease-signature", "lease_type_invalid");
+  const kid = text(header.kid, 200);
+  if (!LEASE_KID.test(kid))
+    fail$1("lease-signature", "lease_key_purpose_mismatch");
+  const key = input.trustKeys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    fail$1("lease-signature", "lease_key_unknown");
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const nowMs = now.getTime();
+  const nowSeconds = Math.floor(nowMs / 1e3);
+  if (!Number.isSafeInteger(nowSeconds))
+    fail$1("lease-validity", "clock_invalid");
+  assertTrustKey(key, nowMs);
+  let publicKey;
+  try {
+    publicKey = createPublicKey(key.publicKeyPem);
+    if (publicKey.asymmetricKeyType !== "ed25519")
+      fail$1("lease-signature", "lease_key_type_invalid");
+  } catch (error) {
+    if (error instanceof CommercialArtifactError)
+      throw error;
+    fail$1("lease-signature", "lease_key_invalid");
+  }
+  let signature;
+  try {
+    signature = decodeSegment(parts[2]);
+  } catch {
+    fail$1("lease-signature", "bad_signature");
+  }
+  if (!verify(null, Buffer.from(`${parts[0]}.${parts[1]}`, "ascii"), publicKey, signature)) {
+    fail$1("lease-signature", "bad_signature");
+  }
+  const claims = normalizeEntitlementLeaseClaims(decodeJson(parts[1]));
+  if (claims.iss !== input.issuer)
+    fail$1("lease-validity", "lease_issuer_invalid");
+  if (nowSeconds + CLOCK_SKEW_SECONDS < claims.nbf)
+    fail$1("lease-validity", "lease_not_yet_valid");
+  if (nowSeconds >= claims.exp)
+    fail$1("lease-validity", "lease_expired");
+  const expected = input.expected;
+  if (input.revocationSnapshot) {
+    assertVerifiedRevocationSnapshot(input.revocationSnapshot);
+    assertRevocationSnapshotCovers({
+      snapshot: input.revocationSnapshot,
+      issuer: input.issuer,
+      tenantId: claims.tenantId,
+      installationId: claims.installationId,
+      productId: expected.productId
+    });
+    const disposition = evaluateRevocationSnapshotLease({
+      snapshot: input.revocationSnapshot,
+      leaseId: claims.jti
+    });
+    if (disposition.status === "revoked") {
+      fail$1("lease-validity", "lease_revoked");
+    }
+    if (disposition.status === "unknown") {
+      fail$1("lease-validity", "revocation_status_unknown");
+    }
+  }
+  if (claims.tenantId !== expected.tenantId)
+    fail$1("lease-coverage", "tenant_not_covered");
+  if (claims.installationId !== expected.installationId) {
+    fail$1("lease-coverage", "installation_not_covered");
+  }
+  if (!claims.productIds.includes(expected.productId))
+    fail$1("lease-coverage", "product_not_covered");
+  if (expected.featureIds?.some((feature) => !claims.featureIds.includes(feature))) {
+    fail$1("lease-coverage", "feature_not_covered");
+  }
+  if (expected.domain && !claims.domainConstraints.includes(expected.domain)) {
+    fail$1("lease-coverage", "domain_not_covered");
+  }
+  if (!claims.releaseConstraint.manifestDigests.includes(normalizeDigest(expected.manifestDigest)) || !claims.releaseConstraint.closureDigests.includes(normalizeDigest(expected.closureDigest)))
+    fail$1("lease-coverage", "release_not_covered");
+  if (expected.entitlementEpoch !== void 0 && claims.entitlementEpoch !== expected.entitlementEpoch) {
+    fail$1("lease-epoch", "entitlement_epoch_stale");
+  }
+  if (expected.minimumRevocationEpoch !== void 0 && claims.revocationEpoch < expected.minimumRevocationEpoch)
+    fail$1("lease-epoch", "revocation_epoch_stale");
+  if (expected.leaseMode !== void 0 && claims.leaseMode !== expected.leaseMode) {
+    fail$1("lease-coverage", "lease_mode_mismatch");
+  }
+  if (claims.leaseMode === "offline" && claims.schemaVersion !== 2) {
+    fail$1("lease-coverage", "offline_lease_binding_required");
+  }
+  if (claims.leaseMode === "offline" && (expected.installationKeyThumbprint === void 0 || expected.activationChallengeDigest === void 0))
+    fail$1("lease-coverage", "offline_lease_binding_context_required");
+  if (expected.installationKeyThumbprint !== void 0) {
+    if (claims.schemaVersion !== 2 || claims.installationKeyThumbprint !== normalizeDigest(expected.installationKeyThumbprint))
+      fail$1("lease-coverage", "installation_key_not_bound");
+  }
+  if (expected.activationChallengeDigest !== void 0) {
+    if (claims.schemaVersion !== 2 || claims.activationBinding.kind !== "offline-challenge" || claims.activationBinding.challengeDigest !== normalizeDigest(expected.activationChallengeDigest))
+      fail$1("lease-coverage", "activation_challenge_not_bound");
+  }
+  const verified = Object.freeze({
+    claims,
+    keyId: kid,
+    mode: nowSeconds < claims.fullUntil ? "full" : "degraded",
+    refreshDue: nowSeconds >= claims.refreshAfter,
+    verifiedAt: now.toISOString()
+  });
+  verifiedEntitlementLeases.add(verified);
+  return verified;
+}
+const DOMAIN_ID = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+const OPERATION_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/;
+function fail(stage, reason) {
+  throw new CommercialArtifactError(stage, reason);
+}
+function sortedUnique(values, reason) {
+  const sorted = [...values].sort();
+  if (new Set(values).size !== values.length || values.some((value, index) => value !== sorted[index])) {
+    fail("admission", reason);
+  }
+  return Object.freeze(sorted);
+}
+function canonicalUnique(values, reason) {
+  if (new Set(values).size !== values.length)
+    fail("admission", reason);
+  return Object.freeze([...values].sort());
+}
+function normalizedDomain(value) {
+  const domain = value.trim().toLowerCase();
+  if (!DOMAIN_ID.test(domain))
+    fail("admission", "domain_invalid");
+  return domain;
+}
+function assertOperation(operation) {
+  if (!OPERATION_ID.test(operation.operationId))
+    fail("admission", "operation_id_invalid");
+  const features = operation.requiredFeatureIds ?? [];
+  sortedUnique(features, "operation_feature_ids_not_canonical");
+  if (!["none", "db", "fs", "network", "mixed"].includes(operation.sideEffect)) {
+    fail("admission", "operation_side_effect_invalid");
+  }
+}
+function degradedBaselineEligible(operation) {
+  return operation.sideEffect === "none" && operation.safety?.destructive !== true && operation.safety?.confirmationRequired !== true && operation.safety?.applyRequired !== true;
+}
+function assertEvidence(input) {
+  const payload = input.manifest.envelope.payload;
+  const claims = input.lease.claims;
+  if (input.receipt.manifestDigest !== input.manifest.manifestDigest || input.receipt.closureDigest !== payload.closureDigest || input.receipt.releaseId !== payload.release.releaseId || input.receipt.installationId !== claims.installationId)
+    fail("admission", "verified_chain_mismatch");
+  const manifestDigest = input.manifest.manifestDigest.replace(/^sha256:/, "");
+  const closureDigest = input.receipt.closureDigest.replace(/^sha256:/, "");
+  if (!claims.productIds.includes(input.productId) || !claims.domainConstraints.includes(input.domain) || !claims.releaseConstraint.manifestDigests.includes(manifestDigest) || !claims.releaseConstraint.closureDigests.includes(closureDigest))
+    fail("admission", "lease_projection_mismatch");
+}
+function commercialDecision(input) {
+  const domain = normalizedDomain(input.domain);
+  assertEvidence({ ...input, domain });
+  const operations = [...input.operations].sort((left, right) => left.operationId < right.operationId ? -1 : left.operationId > right.operationId ? 1 : 0);
+  if (new Set(operations.map((operation) => operation.operationId)).size !== operations.length)
+    fail("admission", "operation_id_duplicate");
+  for (const operation of operations)
+    assertOperation(operation);
+  const covered = operations.filter((operation) => (operation.requiredFeatureIds ?? []).every((feature) => input.lease.claims.featureIds.includes(feature)));
+  const manifestDegraded = new Set(input.manifest.envelope.payload.degradedOperationIds);
+  const degraded = covered.filter((operation) => degradedBaselineEligible(operation) && manifestDegraded.has(operation.operationId));
+  const allowed = input.lease.mode === "full" ? covered : degraded;
+  return Object.freeze({
+    domain,
+    plane: "commercial",
+    state: input.lease.mode,
+    reason: "verified_chain",
+    allowedOperationIds: new Set(allowed.map((operation) => operation.operationId)),
+    degradedOperationIds: new Set(degraded.map((operation) => operation.operationId)),
+    productId: input.productId,
+    manifestDigest: input.manifest.manifestDigest,
+    closureDigest: input.receipt.closureDigest,
+    receiptId: input.receipt.receiptId,
+    leaseId: input.lease.claims.jti,
+    entitlementEpoch: input.lease.claims.entitlementEpoch,
+    revocationEpoch: input.lease.claims.revocationEpoch,
+    refreshAfter: input.lease.claims.refreshAfter,
+    fullUntil: input.lease.claims.fullUntil,
+    expiresAt: input.lease.claims.exp,
+    migrationEligible: input.lease.mode === "full"
+  });
+}
+function buildAdmittedDomainSnapshot(input) {
+  if (!Number.isSafeInteger(input.generation) || input.generation < 1) {
+    fail("admission", "snapshot_generation_invalid");
+  }
+  const createdAt = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const domains = /* @__PURE__ */ new Map();
+  const freeDomains = canonicalUnique(input.freeDomains.map(normalizedDomain), "free_domain_set_not_canonical");
+  for (const domain of freeDomains) {
+    domains.set(domain, Object.freeze({
+      domain,
+      plane: "community",
+      state: "free",
+      reason: "community_builtin",
+      allowedOperationIds: null,
+      degradedOperationIds: null,
+      productId: null,
+      manifestDigest: null,
+      closureDigest: null,
+      receiptId: null,
+      leaseId: null,
+      entitlementEpoch: null,
+      revocationEpoch: null,
+      refreshAfter: null,
+      fullUntil: null,
+      expiresAt: null,
+      migrationEligible: true
+    }));
+  }
+  const commercial = [...input.commercialDomains ?? []].sort((left, right) => left.domain < right.domain ? -1 : left.domain > right.domain ? 1 : 0);
+  for (const candidate of commercial) {
+    const decision = commercialDecision(candidate);
+    if (domains.has(decision.domain))
+      fail("admission", "domain_authority_collision");
+    domains.set(decision.domain, decision);
+  }
+  const orderedDomains = Object.freeze([...domains.values()]);
+  return Object.freeze({
+    schemaVersion: 1,
+    objectType: "aops-admitted-domain-snapshot-v1",
+    generation: input.generation,
+    createdAt,
+    domains,
+    orderedDomains
+  });
+}
+function checkDomainAdmission(snapshot, domainInput, operationId, now = /* @__PURE__ */ new Date()) {
+  const domain = normalizedDomain(domainInput);
+  const decision = snapshot.domains.get(domain);
+  if (!decision)
+    return Object.freeze({ allowed: false, domain, reason: "domain_not_admitted" });
+  if (decision.expiresAt !== null && Math.floor(now.getTime() / 1e3) >= decision.expiresAt)
+    return Object.freeze({ allowed: false, domain, reason: "lease_expired" });
+  const nowSeconds = Math.floor(now.getTime() / 1e3);
+  const effectiveDecision = decision.state === "full" && decision.fullUntil !== null && nowSeconds >= decision.fullUntil ? Object.freeze({
+    ...decision,
+    state: "degraded",
+    allowedOperationIds: decision.degradedOperationIds,
+    migrationEligible: false
+  }) : decision;
+  if (operationId !== void 0 && effectiveDecision.allowedOperationIds !== null && !effectiveDecision.allowedOperationIds.has(operationId))
+    return Object.freeze({ allowed: false, domain, reason: "operation_not_admitted" });
+  return Object.freeze({ allowed: true, decision: effectiveDecision });
+}
+class AdmissionDecisionCache {
+  #snapshot;
+  #lastSeenMs;
+  constructor(initial) {
+    this.#snapshot = initial;
+    this.#lastSeenMs = Date.parse(initial.createdAt);
+    if (!Number.isFinite(this.#lastSeenMs))
+      fail("admission", "snapshot_time_invalid");
+  }
+  read() {
+    return this.#snapshot;
+  }
+  replace(next) {
+    if (next.generation <= this.#snapshot.generation) {
+      fail("admission", "snapshot_generation_not_monotonic");
+    }
+    this.#snapshot = next;
+  }
+  check(domain, operationId, now) {
+    const observedMs = (now ?? /* @__PURE__ */ new Date()).getTime();
+    if (!Number.isFinite(observedMs))
+      fail("admission", "clock_invalid");
+    this.#lastSeenMs = Math.max(this.#lastSeenMs, observedMs);
+    return checkDomainAdmission(this.#snapshot, domain, operationId, new Date(this.#lastSeenMs));
+  }
+}
+
+export { AdmissionDecisionCache as A, CommercialArtifactError as C, ENTITLEMENT_LEASE_PURPOSE as E, RELEASE_MANIFEST_PURPOSE as R, verifyReleaseManifestEnvelope as a, buildAdmittedDomainSnapshot as b, canonicalCommercialJson as c, ENTITLEMENT_LEASE_ALGORITHM as d, assertCommercialRuntimeCompatible as e, sha256Commercial as s, verifyEntitlementLease as v };