@aopslabs/aops-server 0.2.2 → 0.2.3

package/build/server/chunks/{_server.ts-XmKDT59M.js → _server.ts-DbPb54XR.js}

@@ -1,23 +1,26 @@
-import { j as json } from './index.js-BQnOaW3H.js';
-import { g as getAgentDiscoveryDocument } from './discovery-BvDEgiqC.js';
+import { j as json } from './index.js-CWgll4BT.js';
+import { g as getAgentDiscoveryDocument } from './discovery-DL0RzVks.js';
 import { r as resolveRequestBaseUrl } from './request-base-url-zKJpVUv5.js';
-import './agent-gateway-runtime-C7Kvvy0H.js';
+import './agent-gateway-runtime-DV-xLmJx.js';
 import '@aopslabs/host-core';
 import '@aopslabs/manifest';
-import './registry-DO8ob5o1.js';
+import './registry-DIreA2IZ.js';
+import 'node:fs';
+import 'node:os';
 import 'node:path';
-import 'node:module';
 import 'node:url';
+import '@aopslabs/host-admission';
+import '@aopslabs/host-auth';
+import '@aopslabs/host-shell';
+import 'node:worker_threads';
+import '@aopslabs/artifact-trust-contracts';
 import './aops-runtime-config-CHpDUCdE.js';
-import 'node:fs';
 import 'pg';
-import 'node:worker_threads';
-import './admission-snapshot-C2wGfTWE.js';
-import 'node:crypto';
 import 'node:child_process';
+import 'node:module';
 import 'node:util';
 import './project-alias-BdnRxWft.js';
-import './canonical-text-order-DbXJJnFD.js';
+import 'node:crypto';
 import 'ajv';
 import 'zod';
 import './auth-provider-C07OUlnz.js';

package/build/server/chunks/{_server.ts-De9ZrSV0.js → _server.ts-P-bj5Kfv.js}

@@ -1,23 +1,26 @@
-import { j as json } from './index.js-BQnOaW3H.js';
-import { g as getAgentGateway } from './agent-gateway-runtime-C7Kvvy0H.js';
+import { j as json } from './index.js-CWgll4BT.js';
+import { g as getAgentGateway } from './agent-gateway-runtime-DV-xLmJx.js';
 import { r as resolveRequestBaseUrl } from './request-base-url-zKJpVUv5.js';
 import { g as getAuthProvider, i as isTrustedLocalAuthProvider } from './auth-provider-C07OUlnz.js';
 import '@aopslabs/host-core';
 import '@aopslabs/manifest';
-import './registry-DO8ob5o1.js';
+import './registry-DIreA2IZ.js';
+import 'node:fs';
+import 'node:os';
 import 'node:path';
-import 'node:module';
 import 'node:url';
+import '@aopslabs/host-admission';
+import '@aopslabs/host-auth';
+import '@aopslabs/host-shell';
+import 'node:worker_threads';
+import '@aopslabs/artifact-trust-contracts';
 import './aops-runtime-config-CHpDUCdE.js';
-import 'node:fs';
 import 'pg';
-import 'node:worker_threads';
-import './admission-snapshot-C2wGfTWE.js';
-import 'node:crypto';
 import 'node:child_process';
+import 'node:module';
 import 'node:util';
 import './project-alias-BdnRxWft.js';
-import './canonical-text-order-DbXJJnFD.js';
+import 'node:crypto';
 import 'ajv';
 import 'zod';
 

package/build/server/chunks/{_server.ts-AwMeEYiZ.js → _server.ts-p6Wxv_wG.js}

@@ -1,4 +1,4 @@
-import { j as json } from './index.js-BQnOaW3H.js';
+import { j as json } from './index.js-CWgll4BT.js';
 
 const GET = async () => {
   return json({

package/build/server/chunks/{agent-gateway-runtime-C7Kvvy0H.js → agent-gateway-runtime-DV-xLmJx.js}

@@ -1,6 +1,6 @@
 import { dispatchDomainRequest } from '@aopslabs/host-core';
 import { buildAgentGatewayOpenApi, buildFederatedToolCatalog, validateManifest } from '@aopslabs/manifest';
-import { g as getHostConfig, d as checkHostDomainAdmission, f as resetHostPluginRegistry, e as getHostPluginRegistry } from './registry-DO8ob5o1.js';
+import { g as getHostConfig, a as getKernelRuntimeSnapshot, f as checkHostDomainAdmission, h as resetHostPluginRegistry, e as getHostPluginRegistry } from './registry-DIreA2IZ.js';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { createRequire } from 'node:module';
@@ -8,8 +8,7 @@ import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
 import { g as getLogger, h as hasProjectAliasValue } from './project-alias-BdnRxWft.js';
 import { createHash } from 'node:crypto';
-import { c as compareCanonicalText } from './canonical-text-order-DbXJJnFD.js';
-import './admission-snapshot-C2wGfTWE.js';
+import { compareCanonicalText } from '@aopslabs/artifact-trust-contracts';
 import Ajv from 'ajv';
 import { z } from 'zod';
 
@@ -2610,5 +2609,41 @@ function getAgentGatewayDiagnostics() {
     errorCount: 0
   };
 }
+function normalize(value) {
+  return String(value ?? "").trim().toLowerCase();
+}
+async function invokeKernelAgentTool(args) {
+  const catalogGateway = getAgentGateway();
+  const catalog = await catalogGateway.listTools();
+  const catalogTool = catalog.tools.find((tool) => normalize(tool.toolId) === normalize(args.toolId));
+  if (!catalogTool) throw new Error(`tool_not_found:${args.toolId}`);
+  const snapshot = await getKernelRuntimeSnapshot();
+  const plugin = snapshot.registry.get(normalize(catalogTool.domain));
+  if (!plugin) throw new Error(`domain_not_registered:${catalogTool.domain}`);
+  const route = plugin.manifest.routes.find(
+    (candidate) => normalize(candidate.operation) === normalize(catalogTool.operationId)
+  );
+  if (!route) {
+    throw new Error(`operation_route_not_found:${catalogTool.domain}:${catalogTool.operationId}`);
+  }
+  const routeId = normalize(route.id);
+  const kernelToolId = routeId.startsWith(`${normalize(catalogTool.domain)}.`) ? routeId : `${normalize(catalogTool.domain)}.${routeId}`;
+  const result = await snapshot.gateway.invokeTool({
+    toolId: kernelToolId,
+    envelope: args.envelope,
+    context: args.context,
+    ...args.requestHeaders ? { requestHeaders: args.requestHeaders } : {}
+  });
+  return {
+    tool: {
+      ...catalogTool,
+      sourceId: result.tool.sourceId,
+      sourceKind: "local-route"
+    },
+    status: result.status,
+    data: result.data,
+    ...result.headers ? { headers: result.headers } : {}
+  };
+}
 
-export { normalizeToolId as a, getAgentGatewayDiagnostics as b, getAgentGateway as g, normalizeDomain as n, resolveOperationKind as r };
+export { normalizeToolId as a, getAgentGatewayDiagnostics as b, getAgentGateway as g, invokeKernelAgentTool as i, normalizeDomain as n, resolveOperationKind as r };

package/build/server/chunks/commercial-admission-loader-ZGZHRPLe.js

@@ -0,0 +1,480 @@
+import { readVerifiedActiveCommercialArtifact, verifyEntitlementLease, buildAdmittedDomainSnapshot, RELEASE_MANIFEST_PURPOSE, readCommercialIntegrityVerificationSchedule, createInstallationPossessionProof, verifyInstallationPossessionProof, resolveManagedInstallationLayout, ENTITLEMENT_LEASE_PURPOSE, ENTITLEMENT_LEASE_ALGORITHM } from '@aopslabs/artifact-trust-contracts';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { readFileSync, lstatSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+
+function commercialIntegrityReadOptions(storeRoot, requestedMode = "routine") {
+  const layout = resolveManagedInstallationLayout();
+  if (path.resolve(storeRoot) !== path.resolve(layout.storeRoot)) {
+    if (requestedMode === "scheduled") {
+      throw new Error("commercial_integrity_scheduler_requires_managed_store");
+    }
+    return Object.freeze({ verificationMode: "full" });
+  }
+  return Object.freeze({
+    integrityStateRoot: layout.stateRoot,
+    verificationMode: requestedMode
+  });
+}
+const CONFIG_KEYS_V1 = Object.freeze([
+  "domain",
+  "entitlementEpoch",
+  "extensionNamespace",
+  "hostInstanceId",
+  "installationId",
+  "issuer",
+  "leaseFile",
+  "leaseMode",
+  "leaseTrustBundle",
+  "minimumRevocationEpoch",
+  "objectType",
+  "productId",
+  "releaseTrustBundle",
+  "schemaVersion",
+  "storeRoot",
+  "tenantId",
+  "target"
+]);
+const CONFIG_KEYS_V2 = Object.freeze([
+  ...CONFIG_KEYS_V1,
+  "activationChallengeDigest",
+  "installationKeyThumbprint",
+  "installationPrivateKeyFile"
+]);
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, expected, reason) {
+  const actual = Object.keys(value).sort();
+  const sorted = [...expected].sort();
+  if (actual.length !== sorted.length || actual.some((key, index) => key !== sorted[index])) {
+    throw new Error(reason);
+  }
+}
+function text(value, reason) {
+  if (typeof value !== "string" || value !== value.trim() || value.length === 0) {
+    throw new Error(reason);
+  }
+  return value;
+}
+function nullableInteger(value, reason) {
+  if (value === null) return null;
+  if (!Number.isSafeInteger(value) || Number(value) < 0) throw new Error(reason);
+  return Number(value);
+}
+function sha256(value, reason) {
+  const normalized = text(value, reason);
+  if (!SHA256_HEX.test(normalized)) throw new Error(reason);
+  return normalized;
+}
+function digestHex(value, reason) {
+  const normalized = value.startsWith("sha256:") ? value.slice("sha256:".length) : value;
+  if (!SHA256_HEX.test(normalized)) throw new Error(reason);
+  return normalized;
+}
+function safeRegularFile(filePath, reason) {
+  if (!path.isAbsolute(filePath)) throw new Error(reason);
+  try {
+    const stat = lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(reason);
+    return realpathSync.native(filePath);
+  } catch {
+    throw new Error(reason);
+  }
+}
+function verifyOfflineInstallationPossessionAtLoad(input) {
+  const privateKeyPem = readFileSync(
+    safeRegularFile(
+      input.installationPrivateKeyFile,
+      "commercial_installation_private_key_invalid"
+    ),
+    "utf8"
+  );
+  const nonce = randomBytes(32).toString("base64url");
+  const iat = Math.floor(input.now.getTime() / 1e3);
+  const manifestDigest = digestHex(
+    input.receipt.manifestDigest,
+    "commercial_installation_possession_invalid"
+  );
+  const closureDigest = digestHex(
+    input.receipt.closureDigest,
+    "commercial_installation_possession_invalid"
+  );
+  try {
+    const proof = createInstallationPossessionProof({
+      privateKeyPem,
+      proofId: randomUUID(),
+      nonce,
+      installationId: input.installationId,
+      hostInstanceId: input.hostInstanceId,
+      leaseToken: input.leaseToken,
+      activationChallengeDigest: input.activationChallengeDigest,
+      receiptBinding: {
+        receiptId: input.receipt.receiptId,
+        releaseId: input.receipt.releaseId,
+        manifestDigest,
+        closureDigest
+      },
+      iat,
+      exp: iat + 2 * 60
+    });
+    verifyInstallationPossessionProof({
+      token: proof.token,
+      now: input.now,
+      expected: {
+        nonce,
+        installationId: input.installationId,
+        hostInstanceId: input.hostInstanceId,
+        installationKeyThumbprint: input.installationKeyThumbprint,
+        leaseToken: input.leaseToken,
+        activationChallengeDigest: input.activationChallengeDigest,
+        receiptId: input.receipt.receiptId,
+        releaseId: input.receipt.releaseId,
+        manifestDigest,
+        closureDigest
+      }
+    });
+  } catch {
+    throw new Error("commercial_installation_possession_invalid");
+  }
+}
+function safeRuntimeEntrypoint(storeRoot, relativePath) {
+  if (!path.isAbsolute(storeRoot) || path.isAbsolute(relativePath) || relativePath.split(/[\\/]/u).some((segment) => !segment || segment === "." || segment === "..")) throw new Error("commercial_runtime_entrypoint_invalid");
+  const root = realpathSync.native(storeRoot);
+  const candidate = path.resolve(root, relativePath);
+  const relative = path.relative(root, candidate);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error("commercial_runtime_entrypoint_invalid");
+  }
+  const real = safeRegularFile(candidate, "commercial_runtime_entrypoint_invalid");
+  const realRelative = path.relative(root, real);
+  if (!realRelative || realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
+    throw new Error("commercial_runtime_entrypoint_invalid");
+  }
+  return real;
+}
+function parseJsonFile(filePath, reason) {
+  try {
+    return JSON.parse(readFileSync(safeRegularFile(filePath, reason), "utf8"));
+  } catch (error) {
+    if (error instanceof Error && error.message === reason) throw error;
+    throw new Error(reason);
+  }
+}
+function parseConfig(filePath) {
+  const value = parseJsonFile(filePath, "commercial_admission_config_invalid");
+  if (!isRecord(value)) throw new Error("commercial_admission_config_invalid");
+  const schemaVersion = value.schemaVersion;
+  if (schemaVersion !== 1 && schemaVersion !== 2 || value.objectType !== `aops-commercial-admission-config-v${schemaVersion}`) throw new Error("commercial_admission_config_invalid");
+  exactKeys(
+    value,
+    schemaVersion === 1 ? CONFIG_KEYS_V1 : CONFIG_KEYS_V2,
+    "commercial_admission_config_invalid"
+  );
+  const leaseMode = value.leaseMode;
+  if (leaseMode !== null && leaseMode !== "online" && leaseMode !== "offline") {
+    throw new Error("commercial_admission_config_invalid");
+  }
+  if (schemaVersion === 2 && leaseMode !== "offline") {
+    throw new Error("commercial_admission_config_invalid");
+  }
+  return Object.freeze({
+    schemaVersion,
+    target: text(value.target, "commercial_admission_config_invalid"),
+    storeRoot: text(value.storeRoot, "commercial_admission_config_invalid"),
+    releaseTrustBundle: text(value.releaseTrustBundle, "commercial_admission_config_invalid"),
+    leaseFile: text(value.leaseFile, "commercial_admission_config_invalid"),
+    leaseTrustBundle: text(value.leaseTrustBundle, "commercial_admission_config_invalid"),
+    issuer: text(value.issuer, "commercial_admission_config_invalid"),
+    tenantId: text(value.tenantId, "commercial_admission_config_invalid"),
+    installationId: text(value.installationId, "commercial_admission_config_invalid"),
+    hostInstanceId: text(value.hostInstanceId, "commercial_admission_config_invalid"),
+    productId: text(value.productId, "commercial_admission_config_invalid"),
+    domain: text(value.domain, "commercial_admission_config_invalid").toLowerCase(),
+    extensionNamespace: text(value.extensionNamespace, "commercial_admission_config_invalid"),
+    entitlementEpoch: nullableInteger(value.entitlementEpoch, "commercial_admission_config_invalid"),
+    minimumRevocationEpoch: nullableInteger(
+      value.minimumRevocationEpoch,
+      "commercial_admission_config_invalid"
+    ),
+    leaseMode,
+    activationChallengeDigest: schemaVersion === 1 ? null : sha256(value.activationChallengeDigest, "commercial_admission_config_invalid"),
+    installationKeyThumbprint: schemaVersion === 1 ? null : sha256(value.installationKeyThumbprint, "commercial_admission_config_invalid"),
+    installationPrivateKeyFile: schemaVersion === 1 ? null : text(value.installationPrivateKeyFile, "commercial_admission_config_invalid")
+  });
+}
+function parseReleaseTrustBundleFile(filePath) {
+  const value = parseJsonFile(filePath, "release_trust_bundle_invalid");
+  if (!isRecord(value)) throw new Error("release_trust_bundle_invalid");
+  exactKeys(
+    value,
+    ["schemaVersion", "objectType", "purpose", "keys"],
+    "release_trust_bundle_invalid"
+  );
+  if (value.schemaVersion !== 1 || value.objectType !== "aops-release-trust-bundle-v1" || value.purpose !== RELEASE_MANIFEST_PURPOSE || !Array.isArray(value.keys) || value.keys.length === 0) throw new Error("release_trust_bundle_invalid");
+  const keys = value.keys.map((candidate) => {
+    if (!isRecord(candidate)) throw new Error("release_trust_bundle_invalid");
+    const actualKeys = Object.keys(candidate).sort();
+    const legacyKeys = ["alg", "kid", "publicKeyPem", "purpose"];
+    const rotatingKeys = [
+      "alg",
+      "kid",
+      "notAfter",
+      "notBefore",
+      "publicKeyPem",
+      "purpose",
+      "status"
+    ];
+    const rotating = actualKeys.length === rotatingKeys.length && actualKeys.every((key, index) => key === rotatingKeys[index]);
+    if (!rotating && (actualKeys.length !== legacyKeys.length || actualKeys.some((key, index) => key !== legacyKeys[index]))) throw new Error("release_trust_bundle_invalid");
+    if (candidate.alg !== "EdDSA" || candidate.purpose !== RELEASE_MANIFEST_PURPOSE || typeof candidate.kid !== "string" || typeof candidate.publicKeyPem !== "string" || rotating && !["active", "verify-only", "retired", "revoked"].includes(
+      String(candidate.status)
+    ) || rotating && candidate.notBefore !== null && typeof candidate.notBefore !== "string" || rotating && candidate.notAfter !== null && typeof candidate.notAfter !== "string") throw new Error("release_trust_bundle_invalid");
+    if (candidate.kid.toLowerCase().includes("test-ephemeral")) {
+      throw new Error("release_trust_test_key_refused");
+    }
+    return Object.freeze({
+      alg: "EdDSA",
+      purpose: RELEASE_MANIFEST_PURPOSE,
+      kid: candidate.kid,
+      publicKeyPem: candidate.publicKeyPem,
+      ...rotating ? {
+        status: candidate.status,
+        ...candidate.notBefore === null ? {} : { notBefore: candidate.notBefore },
+        ...candidate.notAfter === null ? {} : { notAfter: candidate.notAfter }
+      } : {}
+    });
+  });
+  if (new Set(keys.map((key) => key.kid)).size !== keys.length) {
+    throw new Error("release_trust_bundle_invalid");
+  }
+  return Object.freeze(keys);
+}
+function parseLeaseTrustBundle(filePath) {
+  const value = parseJsonFile(filePath, "lease_trust_bundle_invalid");
+  if (!isRecord(value)) throw new Error("lease_trust_bundle_invalid");
+  exactKeys(
+    value,
+    ["schemaVersion", "objectType", "purpose", "keys"],
+    "lease_trust_bundle_invalid"
+  );
+  if (value.schemaVersion !== 1 || value.objectType !== "aops-entitlement-lease-trust-bundle-v1" || value.purpose !== ENTITLEMENT_LEASE_PURPOSE || !Array.isArray(value.keys) || value.keys.length === 0) throw new Error("lease_trust_bundle_invalid");
+  const keys = value.keys.map((candidate) => {
+    if (!isRecord(candidate)) throw new Error("lease_trust_bundle_invalid");
+    exactKeys(
+      candidate,
+      ["alg", "kid", "notAfter", "notBefore", "publicKeyPem", "purpose", "status"],
+      "lease_trust_bundle_invalid"
+    );
+    if (candidate.alg !== ENTITLEMENT_LEASE_ALGORITHM || candidate.purpose !== ENTITLEMENT_LEASE_PURPOSE || typeof candidate.kid !== "string" || typeof candidate.publicKeyPem !== "string" || candidate.status !== "active" && candidate.status !== "verify-only" || candidate.notBefore !== null && typeof candidate.notBefore !== "string" || candidate.notAfter !== null && typeof candidate.notAfter !== "string") throw new Error("lease_trust_bundle_invalid");
+    return Object.freeze({
+      alg: ENTITLEMENT_LEASE_ALGORITHM,
+      purpose: ENTITLEMENT_LEASE_PURPOSE,
+      kid: candidate.kid,
+      publicKeyPem: candidate.publicKeyPem,
+      status: candidate.status,
+      ...candidate.notBefore === null ? {} : { notBefore: candidate.notBefore },
+      ...candidate.notAfter === null ? {} : { notAfter: candidate.notAfter }
+    });
+  });
+  if (new Set(keys.map((key) => key.kid)).size !== keys.length) {
+    throw new Error("lease_trust_bundle_invalid");
+  }
+  return Object.freeze(keys);
+}
+function parseOperations(dcmBytes, operationCatalogBytes, domain, extension) {
+  let dcmValue;
+  let catalogValue;
+  try {
+    dcmValue = JSON.parse(dcmBytes.toString("utf8"));
+    catalogValue = JSON.parse(operationCatalogBytes.toString("utf8"));
+  } catch {
+    throw new Error("commercial_operation_contract_invalid");
+  }
+  if (!isRecord(dcmValue) || !isRecord(dcmValue.domain) || dcmValue.domain.id !== domain || !isRecord(dcmValue.capabilities) || !Array.isArray(dcmValue.capabilities.operations) || !Array.isArray(catalogValue) || !isRecord(extension)) throw new Error("commercial_operation_contract_invalid");
+  const featureBindings = extension.operationFeatures;
+  if (!Array.isArray(featureBindings)) throw new Error("commercial_operation_contract_invalid");
+  const features = /* @__PURE__ */ new Map();
+  let previousOperationId = "";
+  for (const binding of featureBindings) {
+    if (!isRecord(binding)) throw new Error("commercial_operation_contract_invalid");
+    exactKeys(binding, ["operationId", "requiredFeatureIds"], "commercial_operation_contract_invalid");
+    if (typeof binding.operationId !== "string" || !Array.isArray(binding.requiredFeatureIds)) {
+      throw new Error("commercial_operation_contract_invalid");
+    }
+    const required = binding.requiredFeatureIds.map((entry) => text(entry, "commercial_operation_contract_invalid"));
+    if (binding.operationId <= previousOperationId || required.length === 0 || new Set(required).size !== required.length || required.some((entry, index) => entry !== [...required].sort()[index])) throw new Error("commercial_operation_contract_invalid");
+    previousOperationId = binding.operationId;
+    features.set(binding.operationId, Object.freeze(required));
+  }
+  const catalog = /* @__PURE__ */ new Map();
+  for (const operation of catalogValue) {
+    if (!isRecord(operation) || typeof operation.operationId !== "string" || typeof operation.sideEffect !== "string" || catalog.has(operation.operationId)) throw new Error("commercial_operation_contract_invalid");
+    catalog.set(operation.operationId, operation);
+  }
+  const policies = dcmValue.capabilities.operations.map((operation) => {
+    if (!isRecord(operation) || typeof operation.operationId !== "string" || !["none", "db", "fs", "network", "mixed"].includes(String(operation.sideEffect)) || !features.has(operation.operationId)) throw new Error("commercial_operation_contract_invalid");
+    const catalogOperation = catalog.get(operation.operationId);
+    if (!catalogOperation || catalogOperation.sideEffect !== operation.sideEffect) {
+      throw new Error("commercial_operation_contract_invalid");
+    }
+    return Object.freeze({
+      operationId: operation.operationId,
+      requiredFeatureIds: features.get(operation.operationId),
+      sideEffect: operation.sideEffect,
+      ...isRecord(operation.safety) ? {
+        safety: Object.freeze({
+          destructive: operation.safety.destructive === true,
+          confirmationRequired: operation.safety.confirmationRequired === true,
+          applyRequired: operation.safety.applyRequired === true
+        })
+      } : {}
+    });
+  });
+  if (catalog.size !== policies.length || features.size !== policies.length) {
+    throw new Error("commercial_operation_contract_invalid");
+  }
+  return Object.freeze(policies);
+}
+function loadCommercialAdmissionSnapshot(configFile, freeDomains, now = /* @__PURE__ */ new Date(), generation) {
+  const config = parseConfig(configFile);
+  const active = readVerifiedActiveCommercialArtifact({
+    storeRoot: config.storeRoot,
+    ...commercialIntegrityReadOptions(config.storeRoot),
+    trustKeys: parseReleaseTrustBundleFile(config.releaseTrustBundle),
+    now,
+    expectedIdentity: {
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId
+    }
+  });
+  if (!active) throw new Error("commercial_artifact_not_active");
+  const extension = active.manifest.envelope.payload.extensions[config.extensionNamespace];
+  if (!isRecord(extension) || extension.releaseTier !== "commercial" || !Array.isArray(extension.productIds) || !extension.productIds.includes(config.productId)) throw new Error("commercial_release_extension_invalid");
+  const hostProjection = extension.hostProjection;
+  if (!isRecord(hostProjection)) throw new Error("commercial_release_extension_invalid");
+  exactKeys(
+    hostProjection,
+    ["manifestExport", "pluginFactory"],
+    "commercial_release_extension_invalid"
+  );
+  const pluginFactory = text(
+    hostProjection.pluginFactory,
+    "commercial_release_extension_invalid"
+  );
+  const manifestExport = text(
+    hostProjection.manifestExport,
+    "commercial_release_extension_invalid"
+  );
+  const operations = parseOperations(
+    active.dcmBytes,
+    active.operationCatalogBytes,
+    config.domain,
+    extension
+  );
+  const token = readFileSync(safeRegularFile(config.leaseFile, "entitlement_lease_file_invalid"), "utf8").trim();
+  const lease = verifyEntitlementLease({
+    token,
+    trustKeys: parseLeaseTrustBundle(config.leaseTrustBundle),
+    issuer: config.issuer,
+    now,
+    expected: {
+      tenantId: config.tenantId,
+      installationId: config.installationId,
+      productId: config.productId,
+      domain: config.domain,
+      manifestDigest: active.manifest.manifestDigest,
+      closureDigest: active.receipt.closureDigest,
+      ...config.entitlementEpoch === null ? {} : {
+        entitlementEpoch: config.entitlementEpoch
+      },
+      ...config.minimumRevocationEpoch === null ? {} : {
+        minimumRevocationEpoch: config.minimumRevocationEpoch
+      },
+      ...config.leaseMode === null ? {} : { leaseMode: config.leaseMode },
+      ...config.installationKeyThumbprint === null ? {} : {
+        installationKeyThumbprint: config.installationKeyThumbprint
+      },
+      ...config.activationChallengeDigest === null ? {} : {
+        activationChallengeDigest: config.activationChallengeDigest
+      }
+    }
+  });
+  if (config.schemaVersion === 2) {
+    if (lease.claims.schemaVersion !== 2 || config.installationPrivateKeyFile === null || config.installationKeyThumbprint === null || config.activationChallengeDigest === null) throw new Error("commercial_installation_possession_invalid");
+    verifyOfflineInstallationPossessionAtLoad({
+      installationPrivateKeyFile: config.installationPrivateKeyFile,
+      installationKeyThumbprint: config.installationKeyThumbprint,
+      activationChallengeDigest: config.activationChallengeDigest,
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId,
+      leaseToken: token,
+      receipt: {
+        receiptId: active.receipt.receiptId,
+        releaseId: active.receipt.releaseId,
+        manifestDigest: active.receipt.manifestDigest,
+        closureDigest: active.receipt.closureDigest
+      },
+      now
+    });
+  }
+  const operationIds = new Set(operations.map((operation) => operation.operationId));
+  if (active.manifest.envelope.payload.degradedOperationIds.some(
+    (operationId) => !operationIds.has(operationId)
+  )) throw new Error("commercial_operation_contract_invalid");
+  const manifestEntrypoint = active.receipt.resolvedEntrypoints.manifestProviders[0] ?? active.receipt.resolvedEntrypoints.dcmProviders[0];
+  if (!manifestEntrypoint) throw new Error("commercial_runtime_entrypoint_invalid");
+  const snapshot = buildAdmittedDomainSnapshot({
+    generation: generation ?? Math.max(2, active.receipt.activation.generation + 1),
+    freeDomains,
+    commercialDomains: [{
+      domain: config.domain,
+      productId: config.productId,
+      receipt: active.receipt,
+      manifest: active.manifest,
+      lease,
+      operations
+    }],
+    now
+  });
+  return Object.freeze({
+    snapshot,
+    runtime: Object.freeze({
+      domain: config.domain,
+      pluginModule: safeRuntimeEntrypoint(
+        config.storeRoot,
+        active.receipt.resolvedEntrypoints.plugin
+      ),
+      pluginFactory,
+      manifestModule: safeRuntimeEntrypoint(config.storeRoot, manifestEntrypoint),
+      manifestExport
+    })
+  });
+}
+function readCommercialAdmissionIntegritySchedule(configFile, now = /* @__PURE__ */ new Date()) {
+  const config = parseConfig(configFile);
+  const options = commercialIntegrityReadOptions(config.storeRoot, "scheduled");
+  if (!options.integrityStateRoot) {
+    throw new Error("commercial_integrity_scheduler_requires_managed_store");
+  }
+  return readCommercialIntegrityVerificationSchedule(options.integrityStateRoot, now);
+}
+function resolveCommercialIntegrityWorkerInput(configFile) {
+  const config = parseConfig(configFile);
+  const options = commercialIntegrityReadOptions(config.storeRoot, "scheduled");
+  if (!options.integrityStateRoot) {
+    throw new Error("commercial_integrity_scheduler_requires_managed_store");
+  }
+  return Object.freeze({
+    storeRoot: config.storeRoot,
+    integrityStateRoot: options.integrityStateRoot,
+    trustKeys: parseReleaseTrustBundleFile(config.releaseTrustBundle),
+    expectedIdentity: Object.freeze({
+      installationId: config.installationId,
+      hostInstanceId: config.hostInstanceId
+    })
+  });
+}
+
+export { loadCommercialAdmissionSnapshot, parseReleaseTrustBundleFile, readCommercialAdmissionIntegritySchedule, resolveCommercialIntegrityWorkerInput, verifyOfflineInstallationPossessionAtLoad };

package/build/server/chunks/{discovery-BvDEgiqC.js → discovery-DL0RzVks.js}

@@ -1,5 +1,5 @@
-import { g as getAgentGateway, n as normalizeDomain, a as normalizeToolId, r as resolveOperationKind } from './agent-gateway-runtime-C7Kvvy0H.js';
-import { g as getHostConfig } from './registry-DO8ob5o1.js';
+import { g as getAgentGateway, n as normalizeDomain, a as normalizeToolId, r as resolveOperationKind } from './agent-gateway-runtime-DV-xLmJx.js';
+import { g as getHostConfig } from './registry-DIreA2IZ.js';
 import { g as getAuthProvider, i as isTrustedLocalAuthProvider } from './auth-provider-C07OUlnz.js';
 
 const COMMUNITY_CLIENT_COMPATIBILITY_SCHEMA_VERSION = 1;

package/build/server/chunks/{error.svelte-B9R6O_Hn.js → error.svelte-BTdVSWca.js}

@@ -1,4 +1,4 @@
-import { e as escape_html, g as getContext, n as noop, w as writable } from './index.js-BQnOaW3H.js';
+import { e as escape_html, g as getContext, n as noop, w as writable } from './index.js-CWgll4BT.js';
 
 function create_updated_store() {
   const { set, subscribe } = writable(false);