@serve.zone/interfaces 25.1.1 → 25.3.0

package/ts/runtime.cloudlylegacydeploymentsettlement.ts

@@ -0,0 +1,2884 @@
+import * as plugins from './plugins.runtime.js';
+
+import {
+  canonicalizeStrictJson,
+  deepFreezeValue,
+} from './private/canonicaljson.js';
+
+export const cloudlyLegacyDeploymentSettlementLimits = Object.freeze({
+  maximumIdentifierLength: 200,
+  maximumSourceDocuments: 2000,
+  maximumOperations: 500,
+  maximumPlanBytes: 512 * 1024,
+  maximumSafeResultBytes: 16 * 1024,
+  maximumReceiptBytes: 512 * 1024,
+  maximumAuthorityBytes: 16 * 1024,
+  maximumAuthenticatedArtifactBytes: 768 * 1024,
+  maximumAuthorityLifetimeMs: 24 * 60 * 60 * 1000,
+  maximumFailureReasons: 32,
+});
+
+export const cloudlyLegacyDeploymentSettlementDomains = Object.freeze({
+  authorityAad:
+    'serve.zone/cloudly-legacy-deployment-settlement/authority-aad-v1\0',
+  rehearsalBindingHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/rehearsal-binding-hmac-v1\0',
+  planHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/plan-hmac-v1\0',
+  productionRequestHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/production-request-hmac-v1\0',
+  checkResultHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/check-result-hmac-v1\0',
+  applyResultHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/apply-result-hmac-v1\0',
+  stableOutcomeHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/stable-outcome-hmac-v1\0',
+  scratchReceiptHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/scratch-receipt-hmac-v1\0',
+  productionReceiptHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/production-receipt-hmac-v1\0',
+} as const);
+
+export type TCloudlyLegacyDeploymentSettlementCodecErrorCode =
+  | 'INVALID_DATA'
+  | 'INVALID_SCHEMA'
+  | 'INVALID_VALUE'
+  | 'LIMIT_EXCEEDED'
+  | 'ORDERING_REQUIRED'
+  | 'CROSS_FIELD_MISMATCH';
+
+/** Safe error surface: code and schema path are finite and never contain values. */
+export class CloudlyLegacyDeploymentSettlementCodecError extends Error {
+  public readonly code: TCloudlyLegacyDeploymentSettlementCodecErrorCode;
+  public readonly path: string;
+
+  public constructor(
+    codeArg: TCloudlyLegacyDeploymentSettlementCodecErrorCode,
+    pathArg: string,
+  ) {
+    super(`${codeArg}:${pathArg}`);
+    this.name = 'CloudlyLegacyDeploymentSettlementCodecError';
+    this.code = codeArg;
+    this.path = pathArg;
+  }
+}
+
+export type TCloudlyLegacyDeploymentSettlementClassification =
+  | 'image-recorded-not-current'
+  | 'image-recorded-current-failed'
+  | 'rolling-out-current-failed'
+  | 'rolling-out-superseded';
+
+export interface ICloudlyLegacyDeploymentSettlementClassificationCountsV1 {
+  'image-recorded-not-current': number;
+  'image-recorded-current-failed': number;
+  'rolling-out-current-failed': number;
+  'rolling-out-superseded': number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1 {
+  operationId: string;
+  authorityId: string;
+  keyId: string;
+  keyVersion: 1;
+  authorityMetadataSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1
+{
+  schemaVersion: 1;
+  operationId: string;
+  authorityId: string;
+  keyId: string;
+  keyVersion: 1;
+  settlementId: string;
+  issuedAt: number;
+  expiresAt: number;
+  maintenanceImageDigest: `sha256:${string}`;
+  sourceImageDigest: `sha256:${string}`;
+  targetImageDigest: `sha256:${string}`;
+  targetVersion: string;
+  targetManifestSha256: string;
+  targetConfigSha256: string;
+  backupId: string;
+  backupSnapshotIdSha256: string;
+  backupProofSha256: string;
+  runId: string;
+  rehearsalId: string;
+  scratchServiceId: string;
+  allocationId: string;
+  allocationGeneration: number;
+  allocationBindingSha256: string;
+  allocationReceiptSha256: string;
+  sourceDataSha256: string;
+  restoredDataSha256: string;
+  digestProofSha256: string;
+}
+
+/** Private plaintext HMAC key. Never persist, log, or place in summaries or receipts. */
+export interface ICloudlyLegacyDeploymentSettlementHmacKeyPlaintextV1 {
+  format: 'raw-32-byte-base64url';
+  value: string;
+}
+
+/**
+ * Exact private-file handoff parsed by pinned maintenance containers.
+ * Interfaces only parses and encodes it; consumers own secure generation,
+ * storage, use, and destruction of the plaintext key.
+ * This package never generates, stores, logs, or performs HMAC with the key.
+ */
+export interface ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-authority-handoff-plaintext';
+  authorityMetadata: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1;
+  authorityReference: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  hmacKeyPlaintext: ICloudlyLegacyDeploymentSettlementHmacKeyPlaintextV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementSourceCensusV1 {
+  operations: number;
+  services: number;
+  images: number;
+  releases: number;
+  rolloutOperations: number;
+  routeClaims: number;
+  resourceClaims: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementPlanEntryV1 {
+  operationId: string;
+  serviceId: string;
+  sourceRevision: number;
+  sourceState: 'image-recorded' | 'rolling-out';
+  classification: TCloudlyLegacyDeploymentSettlementClassification;
+  finalRevision: number;
+  sourceDocumentHmac: `hmac-sha256:${string}`;
+  finalDocumentHmac: `hmac-sha256:${string}`;
+  routeClaimsStabilized: number;
+  routeClaimsRemoved: number;
+  resourceClaimsRemoved: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementPlanV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-plan';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  settlementId: string;
+  effectiveAt: number;
+  sourceStateHmac: `hmac-sha256:${string}`;
+  finalStateHmac: `hmac-sha256:${string}`;
+  sourceCensus: ICloudlyLegacyDeploymentSettlementSourceCensusV1;
+  entries: ICloudlyLegacyDeploymentSettlementPlanEntryV1[];
+  classificationCounts: ICloudlyLegacyDeploymentSettlementClassificationCountsV1;
+  operationCount: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionRequestV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-production-request';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  plan: ICloudlyLegacyDeploymentSettlementPlanV1;
+  planSha256: string;
+  rehearsalBinding: ICloudlyLegacyDeploymentSettlementRehearsalBindingV1;
+  rehearsalBindingSha256: string;
+  requestedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementMutationCountsV1 {
+  operationCount: number;
+  routeClaimsStabilized: number;
+  routeClaimsRemoved: number;
+  resourceClaimsRemoved: number;
+}
+
+export type TCloudlyLegacyDeploymentSettlementFailureReason =
+  | 'AUTHORITY_INVALID'
+  | 'AUTHORITY_EXPIRED'
+  | 'REQUEST_MISMATCH'
+  | 'PLAN_MISMATCH'
+  | 'SOURCE_STATE_MISMATCH'
+  | 'FINAL_STATE_MISMATCH'
+  | 'TRANSACTIONS_UNSUPPORTED'
+  | 'OPERATION_DRIFT'
+  | 'CLAIM_DRIFT'
+  | 'CLASSIFICATION_MISMATCH';
+
+interface ICloudlyLegacyDeploymentSettlementSafeResultBaseV1 {
+  schemaVersion: 1;
+  requestSha256: string;
+  planSha256: string;
+  settlementId: string;
+  sourceStateHmac: `hmac-sha256:${string}`;
+  finalStateHmac: `hmac-sha256:${string}`;
+  transactionSupported: boolean;
+  counts: ICloudlyLegacyDeploymentSettlementMutationCountsV1;
+  classificationCounts: ICloudlyLegacyDeploymentSettlementClassificationCountsV1;
+}
+
+export type TCloudlyLegacyDeploymentSettlementCheckResultV1 =
+  | (ICloudlyLegacyDeploymentSettlementSafeResultBaseV1 & {
+      kind: 'cloudly-legacy-deployment-settlement-check-result';
+      status: 'ready';
+      disposition: 'unapplied' | 'exact-replay' | 'no-op';
+      checkedAt: number;
+    })
+  | (ICloudlyLegacyDeploymentSettlementSafeResultBaseV1 & {
+      kind: 'cloudly-legacy-deployment-settlement-check-result';
+      status: 'blocked';
+      disposition: 'unapplied';
+      failureReasons: TCloudlyLegacyDeploymentSettlementFailureReason[];
+      checkedAt: number;
+    });
+
+export type TCloudlyLegacyDeploymentSettlementApplyResultV1 =
+  | (ICloudlyLegacyDeploymentSettlementSafeResultBaseV1 & {
+      kind: 'cloudly-legacy-deployment-settlement-apply-result';
+      status: 'completed';
+      disposition: 'applied' | 'exact-replay' | 'no-op';
+      completedAt: number;
+    })
+  | (ICloudlyLegacyDeploymentSettlementSafeResultBaseV1 & {
+      kind: 'cloudly-legacy-deployment-settlement-apply-result';
+      status: 'rejected';
+      disposition: 'unapplied';
+      failureReasons: TCloudlyLegacyDeploymentSettlementFailureReason[];
+      rejectedAt: number;
+    });
+
+export interface ICloudlyLegacyDeploymentSettlementRehearsalBindingV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-rehearsal-binding';
+  settlementId: string;
+  runId: string;
+  rehearsalId: string;
+  scratchServiceId: string;
+  allocationId: string;
+  allocationGeneration: number;
+  allocationBindingSha256: string;
+  allocationReceiptSha256: string;
+  backupId: string;
+  backupSnapshotIdSha256: string;
+  backupProofSha256: string;
+  sourceDataSha256: string;
+  restoredDataSha256: string;
+  digestProofSha256: string;
+  targetImageDigest: `sha256:${string}`;
+  targetVersion: string;
+  targetManifestSha256: string;
+  targetConfigSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementStableOutcomeV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-stable-outcome';
+  settlementId: string;
+  runId: string;
+  rehearsalBindingSha256: string;
+  effectiveAt: number;
+  planSha256: string;
+  sourceStateHmac: `hmac-sha256:${string}`;
+  finalStateHmac: `hmac-sha256:${string}`;
+  settlements: ICloudlyLegacyDeploymentSettlementStableOutcomeEntryV1[];
+  counts: ICloudlyLegacyDeploymentSettlementMutationCountsV1;
+  classificationCounts: ICloudlyLegacyDeploymentSettlementClassificationCountsV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementStableOutcomeEntryV1 {
+  operationId: string;
+  finalRevision: number;
+  finalDocumentHmac: `hmac-sha256:${string}`;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-rehearsal-binding';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: ICloudlyLegacyDeploymentSettlementRehearsalBindingV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-plan';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: ICloudlyLegacyDeploymentSettlementPlanV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-production-request';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: ICloudlyLegacyDeploymentSettlementProductionRequestV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-check-result';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: TCloudlyLegacyDeploymentSettlementCheckResultV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-apply-result';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: TCloudlyLegacyDeploymentSettlementApplyResultV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-stable-outcome';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: ICloudlyLegacyDeploymentSettlementStableOutcomeV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1, 'mac'>;
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1, 'mac'>;
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1, 'mac'>;
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1, 'mac'>;
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1, 'mac'>;
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1 =
+  Omit<IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1, 'mac'>;
+
+export interface ICloudlyLegacyDeploymentSettlementHmacVerificationInputV1 {
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  domain: typeof cloudlyLegacyDeploymentSettlementDomains[keyof
+    typeof cloudlyLegacyDeploymentSettlementDomains];
+  hmacInput: Uint8Array;
+  mac: string;
+}
+
+/** Consumer-owned verification keeps all HMAC key use outside Interfaces. */
+export type TCloudlyLegacyDeploymentSettlementHmacVerifier = (
+  inputArg: ICloudlyLegacyDeploymentSettlementHmacVerificationInputV1,
+) => boolean | Promise<boolean>;
+
+export interface ICloudlyLegacyDeploymentSettlementScratchReceiptV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-scratch-receipt';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  requestSha256: string;
+  stableOutcome: ICloudlyLegacyDeploymentSettlementStableOutcomeV1;
+  stableOutcomeSha256: string;
+  transactionCommitted: true;
+  disposition: 'applied' | 'exact-replay' | 'no-op';
+  completedAt: number;
+  payloadSha256: string;
+  mac: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionReceiptV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-production-receipt';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  requestSha256: string;
+  scratchReceipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+  scratchReceiptSha256: string;
+  stableOutcome: ICloudlyLegacyDeploymentSettlementStableOutcomeV1;
+  stableOutcomeSha256: string;
+  transactionCommitted: true;
+  disposition: 'applied' | 'exact-replay' | 'no-op';
+  completedAt: number;
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementScratchReceiptPayloadV1 = Omit<
+  ICloudlyLegacyDeploymentSettlementScratchReceiptV1,
+  'payloadSha256' | 'mac'
+>;
+export type TCloudlyLegacyDeploymentSettlementUnsignedScratchReceiptV1 = Omit<
+  ICloudlyLegacyDeploymentSettlementScratchReceiptV1,
+  'mac'
+>;
+export type TCloudlyLegacyDeploymentSettlementProductionReceiptPayloadV1 = Omit<
+  ICloudlyLegacyDeploymentSettlementProductionReceiptV1,
+  'payloadSha256' | 'mac'
+>;
+export type TCloudlyLegacyDeploymentSettlementUnsignedProductionReceiptV1 = Omit<
+  ICloudlyLegacyDeploymentSettlementProductionReceiptV1,
+  'mac'
+>;
+
+const authorityCoreKeys = ['operationId', 'authorityId', 'keyId', 'keyVersion'] as const;
+const authorityReferenceKeys = [...authorityCoreKeys, 'authorityMetadataSha256'] as const;
+const authorityMetadataKeys = [
+  'schemaVersion',
+  ...authorityCoreKeys,
+  'settlementId',
+  'issuedAt',
+  'expiresAt',
+  'maintenanceImageDigest',
+  'sourceImageDigest',
+  'targetImageDigest',
+  'targetVersion',
+  'targetManifestSha256',
+  'targetConfigSha256',
+  'backupId',
+  'backupSnapshotIdSha256',
+  'backupProofSha256',
+  'runId',
+  'rehearsalId',
+  'scratchServiceId',
+  'allocationId',
+  'allocationGeneration',
+  'allocationBindingSha256',
+  'allocationReceiptSha256',
+  'sourceDataSha256',
+  'restoredDataSha256',
+  'digestProofSha256',
+] as const;
+const classificationKeys = [
+  'image-recorded-not-current',
+  'image-recorded-current-failed',
+  'rolling-out-current-failed',
+  'rolling-out-superseded',
+] as const;
+const censusKeys = [
+  'operations',
+  'services',
+  'images',
+  'releases',
+  'rolloutOperations',
+  'routeClaims',
+  'resourceClaims',
+] as const;
+const mutationCountKeys = [
+  'operationCount',
+  'routeClaimsStabilized',
+  'routeClaimsRemoved',
+  'resourceClaimsRemoved',
+] as const;
+const planEntryKeys = [
+  'operationId',
+  'serviceId',
+  'sourceRevision',
+  'sourceState',
+  'classification',
+  'finalRevision',
+  'sourceDocumentHmac',
+  'finalDocumentHmac',
+  'routeClaimsStabilized',
+  'routeClaimsRemoved',
+  'resourceClaimsRemoved',
+] as const;
+const failureReasons = new Set<TCloudlyLegacyDeploymentSettlementFailureReason>([
+  'AUTHORITY_INVALID',
+  'AUTHORITY_EXPIRED',
+  'REQUEST_MISMATCH',
+  'PLAN_MISMATCH',
+  'SOURCE_STATE_MISMATCH',
+  'FINAL_STATE_MISMATCH',
+  'TRANSACTIONS_UNSUPPORTED',
+  'OPERATION_DRIFT',
+  'CLAIM_DRIFT',
+  'CLASSIFICATION_MISMATCH',
+]);
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._@-]{0,199}$/;
+const sha256Pattern = /^[a-f0-9]{64}$/;
+const ociDigestPattern = /^sha256:[a-f0-9]{64}$/;
+const stateHmacPattern = /^hmac-sha256:[a-f0-9]{64}$/;
+const macPattern = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+const raw32ByteBase64UrlPattern = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+
+const fail = (
+  codeArg: TCloudlyLegacyDeploymentSettlementCodecErrorCode,
+  pathArg: string,
+): never => {
+  throw new CloudlyLegacyDeploymentSettlementCodecError(codeArg, pathArg);
+};
+
+const readRecord = (valueArg: unknown, pathArg: string): Record<string, unknown> => {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+    return fail('INVALID_DATA', pathArg);
+  }
+  const prototype = Object.getPrototypeOf(valueArg);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return fail('INVALID_DATA', pathArg);
+  }
+  const record = valueArg as Record<string, unknown>;
+  for (const key of Reflect.ownKeys(record)) {
+    if (typeof key !== 'string') return fail('INVALID_DATA', pathArg);
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+      return fail('INVALID_DATA', pathArg);
+    }
+  }
+  return record;
+};
+
+const readArray = (
+  valueArg: unknown,
+  pathArg: string,
+  maximumLengthArg: number,
+  minimumLengthArg = 0,
+): unknown[] => {
+  if (!Array.isArray(valueArg) || Object.getPrototypeOf(valueArg) !== Array.prototype) {
+    return fail('INVALID_DATA', pathArg);
+  }
+  if (valueArg.length < minimumLengthArg || valueArg.length > maximumLengthArg) {
+    return fail('LIMIT_EXCEEDED', pathArg);
+  }
+  for (let index = 0; index < valueArg.length; index++) {
+    if (!Object.hasOwn(valueArg, index)) return fail('INVALID_DATA', `${pathArg}[${index}]`);
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+      return fail('INVALID_DATA', `${pathArg}[${index}]`);
+    }
+  }
+  for (const key of Reflect.ownKeys(valueArg)) {
+    if (key === 'length') continue;
+    if (typeof key !== 'string'
+      || !/^(?:0|[1-9][0-9]*)$/.test(key)
+      || Number(key) >= valueArg.length) {
+      return fail('INVALID_DATA', pathArg);
+    }
+  }
+  return valueArg;
+};
+
+const assertExactKeys = (
+  valueArg: Record<string, unknown>,
+  keysArg: readonly string[],
+  pathArg: string,
+): void => {
+  const actual = Object.keys(valueArg).sort((leftArg, rightArg) => (
+    leftArg < rightArg ? -1 : leftArg > rightArg ? 1 : 0
+  ));
+  const expected = [...keysArg].sort((leftArg, rightArg) => (
+    leftArg < rightArg ? -1 : leftArg > rightArg ? 1 : 0
+  ));
+  if (actual.length !== expected.length
+    || actual.some((keyArg, indexArg) => keyArg !== expected[indexArg])) {
+    fail('INVALID_SCHEMA', pathArg);
+  }
+};
+
+const readIdentifier = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !identifierPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readSha256 = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !sha256Pattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readOciDigest = (valueArg: unknown, pathArg: string): `sha256:${string}` => {
+  if (typeof valueArg !== 'string' || !ociDigestPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg as `sha256:${string}`;
+};
+
+const readStateHmac = (valueArg: unknown, pathArg: string): `hmac-sha256:${string}` => {
+  if (typeof valueArg !== 'string' || !stateHmacPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg as `hmac-sha256:${string}`;
+};
+
+const readMac = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !macPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  const bytes = Buffer.from(valueArg, 'base64url');
+  if (bytes.byteLength !== 32 || bytes.toString('base64url') !== valueArg) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readInteger = (
+  valueArg: unknown,
+  pathArg: string,
+  minimumArg = 0,
+  maximumArg = Number.MAX_SAFE_INTEGER,
+): number => {
+  if (typeof valueArg !== 'number'
+    || !Number.isSafeInteger(valueArg)
+    || Object.is(valueArg, -0)
+    || valueArg < minimumArg
+    || valueArg > maximumArg) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readBoolean = (valueArg: unknown, pathArg: string): boolean => {
+  if (typeof valueArg !== 'boolean') return fail('INVALID_VALUE', pathArg);
+  return valueArg;
+};
+
+const readLiteral = <TLiteral extends string>(
+  valueArg: unknown,
+  literalsArg: readonly TLiteral[],
+  pathArg: string,
+): TLiteral => {
+  if (typeof valueArg !== 'string' || !literalsArg.includes(valueArg as TLiteral)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg as TLiteral;
+};
+
+const canonicalize = (valueArg: unknown, pathArg: string): string => (
+  canonicalizeStrictJson(
+    valueArg,
+    () => fail('INVALID_DATA', pathArg),
+    pathArg,
+  )
+);
+
+const finalize = <T>(
+  valueArg: T,
+  maximumBytesArg: number,
+  pathArg: string,
+): Readonly<T> => {
+  const json = canonicalize(valueArg, pathArg);
+  if (Buffer.byteLength(json, 'utf8') > maximumBytesArg) {
+    return fail('LIMIT_EXCEEDED', pathArg);
+  }
+  return deepFreezeValue(valueArg);
+};
+
+const encodeNormalized = (valueArg: unknown, pathArg: string): Uint8Array => (
+  new Uint8Array(Buffer.from(canonicalize(valueArg, pathArg), 'utf8'))
+);
+
+const frame = (domainArg: string, payloadArg: Uint8Array): Uint8Array => {
+  const domain = Buffer.from(domainArg, 'utf8');
+  const output = new Uint8Array(domain.byteLength + payloadArg.byteLength);
+  output.set(domain, 0);
+  output.set(new Uint8Array(payloadArg), domain.byteLength);
+  return output;
+};
+
+const digestBytes = (valueArg: Uint8Array): string => (
+  plugins.crypto.createHash('sha256').update(new Uint8Array(valueArg)).digest('hex')
+);
+
+const normalizeAuthorityReferenceInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authorityReferenceKeys, pathArg);
+  if (value.keyVersion !== 1) fail('INVALID_VALUE', `${pathArg}.keyVersion`);
+  return {
+    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
+    authorityId: readIdentifier(value.authorityId, `${pathArg}.authorityId`),
+    keyId: readIdentifier(value.keyId, `${pathArg}.keyId`),
+    keyVersion: 1,
+    authorityMetadataSha256: readSha256(
+      value.authorityMetadataSha256,
+      `${pathArg}.authorityMetadataSha256`,
+    ),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthorityReference = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1> => finalize(
+  normalizeAuthorityReferenceInternal(valueArg, 'authorityReference'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
+  'authorityReference',
+);
+
+const normalizeAuthorityMetadataInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authorityMetadataKeys, pathArg);
+  if (value.schemaVersion !== 1 || value.keyVersion !== 1) {
+    fail('INVALID_VALUE', `${pathArg}.schemaVersion`);
+  }
+  const issuedAt = readInteger(value.issuedAt, `${pathArg}.issuedAt`, 1);
+  const expiresAt = readInteger(value.expiresAt, `${pathArg}.expiresAt`, 1);
+  if (expiresAt <= issuedAt
+    || expiresAt - issuedAt
+      > cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityLifetimeMs) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.expiresAt`);
+  }
+  const sourceDataSha256 = readSha256(
+    value.sourceDataSha256,
+    `${pathArg}.sourceDataSha256`,
+  );
+  const restoredDataSha256 = readSha256(
+    value.restoredDataSha256,
+    `${pathArg}.restoredDataSha256`,
+  );
+  if (sourceDataSha256 !== restoredDataSha256) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.restoredDataSha256`);
+  }
+  return {
+    schemaVersion: 1,
+    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
+    authorityId: readIdentifier(value.authorityId, `${pathArg}.authorityId`),
+    keyId: readIdentifier(value.keyId, `${pathArg}.keyId`),
+    keyVersion: 1,
+    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
+    issuedAt,
+    expiresAt,
+    maintenanceImageDigest: readOciDigest(
+      value.maintenanceImageDigest,
+      `${pathArg}.maintenanceImageDigest`,
+    ),
+    sourceImageDigest: readOciDigest(value.sourceImageDigest, `${pathArg}.sourceImageDigest`),
+    targetImageDigest: readOciDigest(value.targetImageDigest, `${pathArg}.targetImageDigest`),
+    targetVersion: readIdentifier(value.targetVersion, `${pathArg}.targetVersion`),
+    targetManifestSha256: readSha256(
+      value.targetManifestSha256,
+      `${pathArg}.targetManifestSha256`,
+    ),
+    targetConfigSha256: readSha256(value.targetConfigSha256, `${pathArg}.targetConfigSha256`),
+    backupId: readIdentifier(value.backupId, `${pathArg}.backupId`),
+    backupSnapshotIdSha256: readSha256(
+      value.backupSnapshotIdSha256,
+      `${pathArg}.backupSnapshotIdSha256`,
+    ),
+    backupProofSha256: readSha256(value.backupProofSha256, `${pathArg}.backupProofSha256`),
+    runId: readIdentifier(value.runId, `${pathArg}.runId`),
+    rehearsalId: readIdentifier(value.rehearsalId, `${pathArg}.rehearsalId`),
+    scratchServiceId: readIdentifier(value.scratchServiceId, `${pathArg}.scratchServiceId`),
+    allocationId: readIdentifier(value.allocationId, `${pathArg}.allocationId`),
+    allocationGeneration: readInteger(
+      value.allocationGeneration,
+      `${pathArg}.allocationGeneration`,
+      1,
+    ),
+    allocationBindingSha256: readSha256(
+      value.allocationBindingSha256,
+      `${pathArg}.allocationBindingSha256`,
+    ),
+    allocationReceiptSha256: readSha256(
+      value.allocationReceiptSha256,
+      `${pathArg}.allocationReceiptSha256`,
+    ),
+    sourceDataSha256,
+    restoredDataSha256,
+    digestProofSha256: readSha256(value.digestProofSha256, `${pathArg}.digestProofSha256`),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1> => finalize(
+  normalizeAuthorityMetadataInternal(valueArg, 'authorityMetadata'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
+  'authorityMetadata',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementAuthorityMetadata = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(valueArg),
+  'authorityMetadata',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementAuthorityMetadataAad = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.authorityAad,
+  encodeCloudlyLegacyDeploymentSettlementAuthorityMetadata(valueArg),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementAuthorityMetadata = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementAuthorityMetadata(valueArg));
+
+export const createCloudlyLegacyDeploymentSettlementAuthorityReference = (
+  metadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  return finalize({
+    operationId: metadata.operationId,
+    authorityId: metadata.authorityId,
+    keyId: metadata.keyId,
+    keyVersion: metadata.keyVersion,
+    authorityMetadataSha256:
+      digestCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadata),
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes, 'authorityReference');
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthorityReferenceForMetadata = (
+  referenceArg: unknown,
+  metadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1> => {
+  const reference = normalizeCloudlyLegacyDeploymentSettlementAuthorityReference(referenceArg);
+  const expected = createCloudlyLegacyDeploymentSettlementAuthorityReference(metadataArg);
+  if (canonicalize(reference, 'authorityReference')
+      !== canonicalize(expected, 'authorityReference.expected')) {
+    fail('CROSS_FIELD_MISMATCH', 'authorityReference');
+  }
+  return reference;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1> => {
+  const value = readRecord(valueArg, 'authorityHandoffPlaintext');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'authorityMetadata',
+    'authorityReference',
+    'hmacKeyPlaintext',
+  ], 'authorityHandoffPlaintext');
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-authority-handoff-plaintext') {
+    fail('INVALID_VALUE', 'authorityHandoffPlaintext.kind');
+  }
+  const authorityMetadata = normalizeAuthorityMetadataInternal(
+    value.authorityMetadata,
+    'authorityHandoffPlaintext.authorityMetadata',
+  );
+  const authorityReference = normalizeCloudlyLegacyDeploymentSettlementAuthorityReferenceForMetadata(
+    value.authorityReference,
+    authorityMetadata,
+  );
+  const key = readRecord(
+    value.hmacKeyPlaintext,
+    'authorityHandoffPlaintext.hmacKeyPlaintext',
+  );
+  assertExactKeys(
+    key,
+    ['format', 'value'],
+    'authorityHandoffPlaintext.hmacKeyPlaintext',
+  );
+  const keyValue = typeof key.value === 'string'
+    ? key.value
+    : fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext.value');
+  if (key.format !== 'raw-32-byte-base64url'
+    || !raw32ByteBase64UrlPattern.test(keyValue)) {
+    fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext');
+  }
+  const keyBytes = Buffer.from(keyValue, 'base64url');
+  if (keyBytes.byteLength !== 32 || keyBytes.toString('base64url') !== keyValue) {
+    fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext.value');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-authority-handoff-plaintext',
+    authorityMetadata,
+    authorityReference,
+    hmacKeyPlaintext: { format: 'raw-32-byte-base64url', value: keyValue },
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes, 'authorityHandoffPlaintext');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(valueArg),
+  'authorityHandoffPlaintext',
+);
+
+const normalizeClassificationCounts = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementClassificationCountsV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, classificationKeys, pathArg);
+  return {
+    'image-recorded-not-current': readInteger(
+      value['image-recorded-not-current'],
+      `${pathArg}.image-recorded-not-current`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+    ),
+    'image-recorded-current-failed': readInteger(
+      value['image-recorded-current-failed'],
+      `${pathArg}.image-recorded-current-failed`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+    ),
+    'rolling-out-current-failed': readInteger(
+      value['rolling-out-current-failed'],
+      `${pathArg}.rolling-out-current-failed`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+    ),
+    'rolling-out-superseded': readInteger(
+      value['rolling-out-superseded'],
+      `${pathArg}.rolling-out-superseded`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+    ),
+  };
+};
+
+const sumClassificationCounts = (
+  valueArg: ICloudlyLegacyDeploymentSettlementClassificationCountsV1,
+): number => classificationKeys.reduce((sumArg, keyArg) => sumArg + valueArg[keyArg], 0);
+
+const normalizeSourceCensus = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementSourceCensusV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, censusKeys, pathArg);
+  const output = Object.fromEntries(censusKeys.map((keyArg) => [
+    keyArg,
+    readInteger(
+      value[keyArg],
+      `${pathArg}.${keyArg}`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumSourceDocuments,
+    ),
+  ])) as unknown as ICloudlyLegacyDeploymentSettlementSourceCensusV1;
+  if (censusKeys.reduce((sumArg, keyArg) => sumArg + output[keyArg], 0)
+    > cloudlyLegacyDeploymentSettlementLimits.maximumSourceDocuments) {
+    fail('LIMIT_EXCEEDED', pathArg);
+  }
+  return output;
+};
+
+const normalizeMutationCounts = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementMutationCountsV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, mutationCountKeys, pathArg);
+  return {
+    operationCount: readInteger(
+      value.operationCount,
+      `${pathArg}.operationCount`,
+      0,
+      cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+    ),
+    routeClaimsStabilized: readInteger(value.routeClaimsStabilized, `${pathArg}.routeClaimsStabilized`),
+    routeClaimsRemoved: readInteger(value.routeClaimsRemoved, `${pathArg}.routeClaimsRemoved`),
+    resourceClaimsRemoved: readInteger(value.resourceClaimsRemoved, `${pathArg}.resourceClaimsRemoved`),
+  };
+};
+
+const assertCountsMatchClassifications = (
+  countsArg: ICloudlyLegacyDeploymentSettlementMutationCountsV1,
+  classificationsArg: ICloudlyLegacyDeploymentSettlementClassificationCountsV1,
+  pathArg: string,
+): void => {
+  if (countsArg.operationCount !== sumClassificationCounts(classificationsArg)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const normalizePlanEntry = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementPlanEntryV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, planEntryKeys, pathArg);
+  const sourceRevision = readInteger(value.sourceRevision, `${pathArg}.sourceRevision`, 0);
+  const finalRevision = readInteger(value.finalRevision, `${pathArg}.finalRevision`, 0);
+  if (finalRevision !== sourceRevision + 3 || !Number.isSafeInteger(sourceRevision + 3)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.finalRevision`);
+  }
+  const sourceState = readLiteral(
+    value.sourceState,
+    ['image-recorded', 'rolling-out'],
+    `${pathArg}.sourceState`,
+  );
+  const classification = readLiteral(
+    value.classification,
+    classificationKeys,
+    `${pathArg}.classification`,
+  );
+  if ((classification.startsWith('image-recorded-') && sourceState !== 'image-recorded')
+    || (classification.startsWith('rolling-out-') && sourceState !== 'rolling-out')) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.classification`);
+  }
+  return {
+    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
+    serviceId: readIdentifier(value.serviceId, `${pathArg}.serviceId`),
+    sourceRevision,
+    sourceState,
+    classification,
+    finalRevision,
+    sourceDocumentHmac: readStateHmac(value.sourceDocumentHmac, `${pathArg}.sourceDocumentHmac`),
+    finalDocumentHmac: readStateHmac(value.finalDocumentHmac, `${pathArg}.finalDocumentHmac`),
+    routeClaimsStabilized: readInteger(value.routeClaimsStabilized, `${pathArg}.routeClaimsStabilized`),
+    routeClaimsRemoved: readInteger(value.routeClaimsRemoved, `${pathArg}.routeClaimsRemoved`),
+    resourceClaimsRemoved: readInteger(value.resourceClaimsRemoved, `${pathArg}.resourceClaimsRemoved`),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementPlan = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementPlanV1> => {
+  const value = readRecord(valueArg, 'plan');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'authority',
+    'settlementId',
+    'effectiveAt',
+    'sourceStateHmac',
+    'finalStateHmac',
+    'sourceCensus',
+    'entries',
+    'classificationCounts',
+    'operationCount',
+  ], 'plan');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-plan') {
+    fail('INVALID_VALUE', 'plan.kind');
+  }
+  const entries = readArray(
+    value.entries,
+    'plan.entries',
+    cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+  ).map((entryArg, indexArg) => normalizePlanEntry(entryArg, `plan.entries[${indexArg}]`));
+  for (let index = 1; index < entries.length; index++) {
+    if (entries[index - 1].operationId >= entries[index].operationId) {
+      fail('ORDERING_REQUIRED', `plan.entries[${index}].operationId`);
+    }
+  }
+  const classificationCounts = normalizeClassificationCounts(
+    value.classificationCounts,
+    'plan.classificationCounts',
+  );
+  const operationCount = readInteger(
+    value.operationCount,
+    'plan.operationCount',
+    0,
+    cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+  );
+  if (operationCount !== entries.length
+    || operationCount !== sumClassificationCounts(classificationCounts)) {
+    fail('CROSS_FIELD_MISMATCH', 'plan.operationCount');
+  }
+  const actualCounts = Object.fromEntries(classificationKeys.map((keyArg) => [
+    keyArg,
+    entries.filter((entryArg) => entryArg.classification === keyArg).length,
+  ]));
+  if (classificationKeys.some((keyArg) => actualCounts[keyArg] !== classificationCounts[keyArg])) {
+    fail('CROSS_FIELD_MISMATCH', 'plan.classificationCounts');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-plan',
+    authority: normalizeAuthorityReferenceInternal(value.authority, 'plan.authority'),
+    settlementId: readIdentifier(value.settlementId, 'plan.settlementId'),
+    effectiveAt: readInteger(value.effectiveAt, 'plan.effectiveAt', 1),
+    sourceStateHmac: readStateHmac(value.sourceStateHmac, 'plan.sourceStateHmac'),
+    finalStateHmac: readStateHmac(value.finalStateHmac, 'plan.finalStateHmac'),
+    sourceCensus: normalizeSourceCensus(value.sourceCensus, 'plan.sourceCensus'),
+    entries,
+    classificationCounts,
+    operationCount,
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumPlanBytes, 'plan');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementPlan = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(normalizeCloudlyLegacyDeploymentSettlementPlan(valueArg), 'plan');
+
+export const encodeCloudlyLegacyDeploymentSettlementPlanHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.planHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedPlanInternal(valueArg, 'unsignedAuthenticatedPlan'),
+    'unsignedAuthenticatedPlan',
+  ),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementPlan = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementPlan(valueArg));
+
+const normalizeFailureReasons = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementFailureReason[] => {
+  const values = readArray(
+    valueArg,
+    pathArg,
+    cloudlyLegacyDeploymentSettlementLimits.maximumFailureReasons,
+    1,
+  );
+  const output = values.map((entryArg, indexArg) => {
+    if (typeof entryArg !== 'string'
+      || !failureReasons.has(entryArg as TCloudlyLegacyDeploymentSettlementFailureReason)) {
+      return fail('INVALID_VALUE', `${pathArg}[${indexArg}]`);
+    }
+    return entryArg as TCloudlyLegacyDeploymentSettlementFailureReason;
+  });
+  for (let index = 1; index < output.length; index++) {
+    if (output[index - 1] >= output[index]) {
+      fail('ORDERING_REQUIRED', `${pathArg}[${index}]`);
+    }
+  }
+  return output;
+};
+
+const normalizeSafeResultBase = (
+  valueArg: Record<string, unknown>,
+  pathArg: string,
+): Omit<ICloudlyLegacyDeploymentSettlementSafeResultBaseV1, 'schemaVersion'> => {
+  const counts = normalizeMutationCounts(valueArg.counts, `${pathArg}.counts`);
+  const classificationCounts = normalizeClassificationCounts(
+    valueArg.classificationCounts,
+    `${pathArg}.classificationCounts`,
+  );
+  assertCountsMatchClassifications(counts, classificationCounts, `${pathArg}.counts.operationCount`);
+  return {
+    requestSha256: readSha256(valueArg.requestSha256, `${pathArg}.requestSha256`),
+    planSha256: readSha256(valueArg.planSha256, `${pathArg}.planSha256`),
+    settlementId: readIdentifier(valueArg.settlementId, `${pathArg}.settlementId`),
+    sourceStateHmac: readStateHmac(valueArg.sourceStateHmac, `${pathArg}.sourceStateHmac`),
+    finalStateHmac: readStateHmac(valueArg.finalStateHmac, `${pathArg}.finalStateHmac`),
+    transactionSupported: readBoolean(
+      valueArg.transactionSupported,
+      `${pathArg}.transactionSupported`,
+    ),
+    counts,
+    classificationCounts,
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementCheckResult = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementCheckResultV1> => {
+  const value = readRecord(valueArg, 'checkResult');
+  const status = readLiteral(value.status, ['ready', 'blocked'], 'checkResult.status');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'status',
+    'requestSha256',
+    'planSha256',
+    'settlementId',
+    'sourceStateHmac',
+    'finalStateHmac',
+    'transactionSupported',
+    'disposition',
+    'counts',
+    'classificationCounts',
+    ...(status === 'blocked' ? ['failureReasons'] : []),
+    'checkedAt',
+  ], 'checkResult');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-check-result') {
+    fail('INVALID_VALUE', 'checkResult.kind');
+  }
+  const base = normalizeSafeResultBase(value, 'checkResult');
+  const result: TCloudlyLegacyDeploymentSettlementCheckResultV1 = status === 'ready'
+    ? {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-check-result',
+        status,
+        ...base,
+        disposition: readLiteral(
+          value.disposition,
+          ['unapplied', 'exact-replay', 'no-op'],
+          'checkResult.disposition',
+        ),
+        checkedAt: readInteger(value.checkedAt, 'checkResult.checkedAt', 1),
+      }
+    : {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-check-result',
+        status,
+        ...base,
+        disposition: readLiteral(value.disposition, ['unapplied'], 'checkResult.disposition'),
+        failureReasons: normalizeFailureReasons(value.failureReasons, 'checkResult.failureReasons'),
+        checkedAt: readInteger(value.checkedAt, 'checkResult.checkedAt', 1),
+      };
+  const transactionFailurePresent = result.status === 'blocked'
+    && result.failureReasons.includes('TRANSACTIONS_UNSUPPORTED');
+  if ((result.status === 'ready' && !result.transactionSupported)
+    || (result.status === 'blocked'
+      && transactionFailurePresent === result.transactionSupported)) {
+    fail('CROSS_FIELD_MISMATCH', 'checkResult.transactionSupported');
+  }
+  return finalize(
+    result,
+    cloudlyLegacyDeploymentSettlementLimits.maximumSafeResultBytes,
+    'checkResult',
+  );
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementCheckResult = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementCheckResult(valueArg),
+  'checkResult',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementCheckResultHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.checkResultHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedCheckResultInternal(
+      valueArg,
+      'unsignedAuthenticatedCheckResult',
+    ),
+    'unsignedAuthenticatedCheckResult',
+  ),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementCheckResult = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementCheckResult(valueArg));
+
+export const normalizeCloudlyLegacyDeploymentSettlementApplyResult = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementApplyResultV1> => {
+  const value = readRecord(valueArg, 'applyResult');
+  const status = readLiteral(value.status, ['completed', 'rejected'], 'applyResult.status');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'status',
+    'requestSha256',
+    'planSha256',
+    'settlementId',
+    'sourceStateHmac',
+    'finalStateHmac',
+    'transactionSupported',
+    'disposition',
+    'counts',
+    'classificationCounts',
+    ...(status === 'rejected' ? ['failureReasons', 'rejectedAt'] : ['completedAt']),
+  ], 'applyResult');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-apply-result') {
+    fail('INVALID_VALUE', 'applyResult.kind');
+  }
+  const base = normalizeSafeResultBase(value, 'applyResult');
+  const result: TCloudlyLegacyDeploymentSettlementApplyResultV1 = status === 'completed'
+    ? {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-apply-result',
+        status,
+        ...base,
+        disposition: readLiteral(
+          value.disposition,
+          ['applied', 'exact-replay', 'no-op'],
+          'applyResult.disposition',
+        ),
+        completedAt: readInteger(value.completedAt, 'applyResult.completedAt', 1),
+      }
+    : {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-apply-result',
+        status,
+        ...base,
+        disposition: readLiteral(value.disposition, ['unapplied'], 'applyResult.disposition'),
+        failureReasons: normalizeFailureReasons(value.failureReasons, 'applyResult.failureReasons'),
+        rejectedAt: readInteger(value.rejectedAt, 'applyResult.rejectedAt', 1),
+      };
+  const transactionFailurePresent = result.status === 'rejected'
+    && result.failureReasons.includes('TRANSACTIONS_UNSUPPORTED');
+  if ((result.status === 'completed' && !result.transactionSupported)
+    || (result.status === 'rejected'
+      && transactionFailurePresent === result.transactionSupported)) {
+    fail('CROSS_FIELD_MISMATCH', 'applyResult.transactionSupported');
+  }
+  return finalize(
+    result,
+    cloudlyLegacyDeploymentSettlementLimits.maximumSafeResultBytes,
+    'applyResult',
+  );
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementApplyResult = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementApplyResult(valueArg),
+  'applyResult',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementApplyResultHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.applyResultHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedApplyResultInternal(
+      valueArg,
+      'unsignedAuthenticatedApplyResult',
+    ),
+    'unsignedAuthenticatedApplyResult',
+  ),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementApplyResult = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementApplyResult(valueArg));
+
+const rehearsalBindingKeys = [
+  'schemaVersion',
+  'kind',
+  'settlementId',
+  'runId',
+  'rehearsalId',
+  'scratchServiceId',
+  'allocationId',
+  'allocationGeneration',
+  'allocationBindingSha256',
+  'allocationReceiptSha256',
+  'backupId',
+  'backupSnapshotIdSha256',
+  'backupProofSha256',
+  'sourceDataSha256',
+  'restoredDataSha256',
+  'digestProofSha256',
+  'targetImageDigest',
+  'targetVersion',
+  'targetManifestSha256',
+  'targetConfigSha256',
+] as const;
+
+const normalizeRehearsalBindingInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementRehearsalBindingV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, rehearsalBindingKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-rehearsal-binding') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const sourceDataSha256 = readSha256(value.sourceDataSha256, `${pathArg}.sourceDataSha256`);
+  const restoredDataSha256 = readSha256(
+    value.restoredDataSha256,
+    `${pathArg}.restoredDataSha256`,
+  );
+  if (sourceDataSha256 !== restoredDataSha256) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.restoredDataSha256`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-rehearsal-binding',
+    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
+    runId: readIdentifier(value.runId, `${pathArg}.runId`),
+    rehearsalId: readIdentifier(value.rehearsalId, `${pathArg}.rehearsalId`),
+    scratchServiceId: readIdentifier(value.scratchServiceId, `${pathArg}.scratchServiceId`),
+    allocationId: readIdentifier(value.allocationId, `${pathArg}.allocationId`),
+    allocationGeneration: readInteger(
+      value.allocationGeneration,
+      `${pathArg}.allocationGeneration`,
+      1,
+    ),
+    allocationBindingSha256: readSha256(
+      value.allocationBindingSha256,
+      `${pathArg}.allocationBindingSha256`,
+    ),
+    allocationReceiptSha256: readSha256(
+      value.allocationReceiptSha256,
+      `${pathArg}.allocationReceiptSha256`,
+    ),
+    backupId: readIdentifier(value.backupId, `${pathArg}.backupId`),
+    backupSnapshotIdSha256: readSha256(
+      value.backupSnapshotIdSha256,
+      `${pathArg}.backupSnapshotIdSha256`,
+    ),
+    backupProofSha256: readSha256(value.backupProofSha256, `${pathArg}.backupProofSha256`),
+    sourceDataSha256,
+    restoredDataSha256,
+    digestProofSha256: readSha256(value.digestProofSha256, `${pathArg}.digestProofSha256`),
+    targetImageDigest: readOciDigest(value.targetImageDigest, `${pathArg}.targetImageDigest`),
+    targetVersion: readIdentifier(value.targetVersion, `${pathArg}.targetVersion`),
+    targetManifestSha256: readSha256(
+      value.targetManifestSha256,
+      `${pathArg}.targetManifestSha256`,
+    ),
+    targetConfigSha256: readSha256(value.targetConfigSha256, `${pathArg}.targetConfigSha256`),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementRehearsalBinding = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementRehearsalBindingV1> => finalize(
+  normalizeRehearsalBindingInternal(valueArg, 'rehearsalBinding'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
+  'rehearsalBinding',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementRehearsalBinding = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementRehearsalBinding(valueArg),
+  'rehearsalBinding',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementRehearsalBindingHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.rehearsalBindingHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedRehearsalBindingInternal(
+      valueArg,
+      'unsignedAuthenticatedRehearsalBinding',
+    ),
+    'unsignedAuthenticatedRehearsalBinding',
+  ),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementRehearsalBinding = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementRehearsalBinding(valueArg));
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionRequest = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionRequestV1> => {
+  const value = readRecord(valueArg, 'productionRequest');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'authority',
+    'plan',
+    'planSha256',
+    'rehearsalBinding',
+    'rehearsalBindingSha256',
+    'requestedAt',
+  ], 'productionRequest');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-production-request') {
+    fail('INVALID_VALUE', 'productionRequest.kind');
+  }
+  const authority = normalizeAuthorityReferenceInternal(
+    value.authority,
+    'productionRequest.authority',
+  );
+  const plan = normalizeCloudlyLegacyDeploymentSettlementPlan(value.plan);
+  const planSha256 = readSha256(value.planSha256, 'productionRequest.planSha256');
+  const rehearsalBinding = normalizeRehearsalBindingInternal(
+    value.rehearsalBinding,
+    'productionRequest.rehearsalBinding',
+  );
+  const rehearsalBindingSha256 = readSha256(
+    value.rehearsalBindingSha256,
+    'productionRequest.rehearsalBindingSha256',
+  );
+  if (canonicalize(authority, 'productionRequest.authority')
+      !== canonicalize(plan.authority, 'productionRequest.plan.authority')) {
+    fail('CROSS_FIELD_MISMATCH', 'productionRequest.authority');
+  }
+  if (planSha256 !== digestCloudlyLegacyDeploymentSettlementPlan(plan)) {
+    fail('CROSS_FIELD_MISMATCH', 'productionRequest.planSha256');
+  }
+  if (rehearsalBindingSha256
+      !== digestCloudlyLegacyDeploymentSettlementRehearsalBinding(rehearsalBinding)) {
+    fail('CROSS_FIELD_MISMATCH', 'productionRequest.rehearsalBindingSha256');
+  }
+  if (plan.settlementId !== rehearsalBinding.settlementId) {
+    fail('CROSS_FIELD_MISMATCH', 'productionRequest.rehearsalBinding.settlementId');
+  }
+  const requestedAt = readInteger(value.requestedAt, 'productionRequest.requestedAt', 1);
+  if (requestedAt < plan.effectiveAt) {
+    fail('CROSS_FIELD_MISMATCH', 'productionRequest.requestedAt');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-production-request',
+    authority,
+    plan,
+    planSha256,
+    rehearsalBinding,
+    rehearsalBindingSha256,
+    requestedAt,
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumAuthenticatedArtifactBytes, 'productionRequest');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionRequest = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementProductionRequest(valueArg),
+  'productionRequest',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementProductionRequest = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementProductionRequest(valueArg));
+
+const stableOutcomeKeys = [
+  'schemaVersion',
+  'kind',
+  'settlementId',
+  'runId',
+  'rehearsalBindingSha256',
+  'effectiveAt',
+  'planSha256',
+  'sourceStateHmac',
+  'finalStateHmac',
+  'settlements',
+  'counts',
+  'classificationCounts',
+] as const;
+
+const normalizeStableOutcomeInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementStableOutcomeV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, stableOutcomeKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-stable-outcome') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const counts = normalizeMutationCounts(value.counts, `${pathArg}.counts`);
+  const classificationCounts = normalizeClassificationCounts(
+    value.classificationCounts,
+    `${pathArg}.classificationCounts`,
+  );
+  assertCountsMatchClassifications(counts, classificationCounts, `${pathArg}.counts.operationCount`);
+  const settlements = readArray(
+    value.settlements,
+    `${pathArg}.settlements`,
+    cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+  ).map((entryArg, indexArg) => {
+    const entryPath = `${pathArg}.settlements[${indexArg}]`;
+    const entry = readRecord(entryArg, entryPath);
+    assertExactKeys(entry, ['operationId', 'finalRevision', 'finalDocumentHmac'], entryPath);
+    return {
+      operationId: readIdentifier(entry.operationId, `${entryPath}.operationId`),
+      finalRevision: readInteger(entry.finalRevision, `${entryPath}.finalRevision`, 1),
+      finalDocumentHmac: readStateHmac(
+        entry.finalDocumentHmac,
+        `${entryPath}.finalDocumentHmac`,
+      ),
+    };
+  });
+  for (let index = 1; index < settlements.length; index++) {
+    if (settlements[index - 1].operationId >= settlements[index].operationId) {
+      fail('ORDERING_REQUIRED', `${pathArg}.settlements[${index}].operationId`);
+    }
+  }
+  if (settlements.length !== counts.operationCount) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.settlements`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-stable-outcome',
+    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
+    runId: readIdentifier(value.runId, `${pathArg}.runId`),
+    rehearsalBindingSha256: readSha256(
+      value.rehearsalBindingSha256,
+      `${pathArg}.rehearsalBindingSha256`,
+    ),
+    effectiveAt: readInteger(value.effectiveAt, `${pathArg}.effectiveAt`, 1),
+    planSha256: readSha256(value.planSha256, `${pathArg}.planSha256`),
+    sourceStateHmac: readStateHmac(value.sourceStateHmac, `${pathArg}.sourceStateHmac`),
+    finalStateHmac: readStateHmac(value.finalStateHmac, `${pathArg}.finalStateHmac`),
+    settlements,
+    counts,
+    classificationCounts,
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementStableOutcome = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementStableOutcomeV1> => finalize(
+  normalizeStableOutcomeInternal(valueArg, 'stableOutcome'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+  'stableOutcome',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementStableOutcome = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementStableOutcome(valueArg),
+  'stableOutcome',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementStableOutcomeHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.stableOutcomeHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedStableOutcomeInternal(
+      valueArg,
+      'unsignedAuthenticatedStableOutcome',
+    ),
+    'unsignedAuthenticatedStableOutcome',
+  ),
+);
+
+export const digestCloudlyLegacyDeploymentSettlementStableOutcome = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementStableOutcome(valueArg));
+
+type TAuthenticatedSettlementArtifactKind =
+  | 'authenticated-cloudly-legacy-deployment-settlement-rehearsal-binding'
+  | 'authenticated-cloudly-legacy-deployment-settlement-plan'
+  | 'authenticated-cloudly-legacy-deployment-settlement-production-request'
+  | 'authenticated-cloudly-legacy-deployment-settlement-check-result'
+  | 'authenticated-cloudly-legacy-deployment-settlement-apply-result'
+  | 'authenticated-cloudly-legacy-deployment-settlement-stable-outcome';
+
+interface IUnsignedAuthenticatedSettlementArtifact<TPayload> {
+  schemaVersion: 1;
+  kind: TAuthenticatedSettlementArtifactKind;
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: TPayload;
+  payloadSha256: string;
+}
+
+const authenticatedArtifactKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'payload',
+  'payloadSha256',
+  'mac',
+] as const;
+const unsignedAuthenticatedArtifactKeys = authenticatedArtifactKeys.filter(
+  (keyArg) => keyArg !== 'mac',
+);
+
+const normalizeUnsignedAuthenticatedArtifactInternal = <TPayload>(
+  valueArg: unknown,
+  pathArg: string,
+  kindArg: TAuthenticatedSettlementArtifactKind,
+  normalizePayloadArg: (valueArg: unknown) => Readonly<TPayload>,
+  getPayloadAuthorityArg?: (
+    payloadArg: Readonly<TPayload>,
+  ) => ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1,
+): IUnsignedAuthenticatedSettlementArtifact<TPayload> => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedAuthenticatedArtifactKeys, pathArg);
+  if (value.schemaVersion !== 1 || value.kind !== kindArg) {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`);
+  const payload = normalizePayloadArg(value.payload);
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256 !== digestBytes(encodeNormalized(payload, `${pathArg}.payload`))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  if (getPayloadAuthorityArg
+    && canonicalize(authority, `${pathArg}.authority`)
+      !== canonicalize(getPayloadAuthorityArg(payload), `${pathArg}.payload.authority`)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.authority`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: kindArg,
+    authority,
+    payload: payload as TPayload,
+    payloadSha256,
+  };
+};
+
+const normalizeAuthenticatedArtifactInternal = <TPayload>(
+  valueArg: unknown,
+  pathArg: string,
+  kindArg: TAuthenticatedSettlementArtifactKind,
+  normalizePayloadArg: (valueArg: unknown) => Readonly<TPayload>,
+  getPayloadAuthorityArg?: (
+    payloadArg: Readonly<TPayload>,
+  ) => ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1,
+): IUnsignedAuthenticatedSettlementArtifact<TPayload> & { mac: string } => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authenticatedArtifactKeys, pathArg);
+  const unsignedInput = Object.fromEntries(unsignedAuthenticatedArtifactKeys.map((keyArg) => [
+    keyArg,
+    value[keyArg],
+  ]));
+  return {
+    ...normalizeUnsignedAuthenticatedArtifactInternal(
+      unsignedInput,
+      `${pathArg}.unsigned`,
+      kindArg,
+      normalizePayloadArg,
+      getPayloadAuthorityArg,
+    ),
+    mac: readMac(value.mac, `${pathArg}.mac`),
+  };
+};
+
+const normalizeUnsignedAuthenticatedRehearsalBindingInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-rehearsal-binding',
+    normalizeCloudlyLegacyDeploymentSettlementRehearsalBinding,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1
+);
+
+const normalizeUnsignedAuthenticatedPlanInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-plan',
+    normalizeCloudlyLegacyDeploymentSettlementPlan,
+    (payloadArg) => payloadArg.authority,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1
+);
+
+const normalizeUnsignedAuthenticatedProductionRequestInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-production-request',
+    normalizeCloudlyLegacyDeploymentSettlementProductionRequest,
+    (payloadArg) => payloadArg.authority,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1
+);
+
+const normalizeUnsignedAuthenticatedCheckResultInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-check-result',
+    normalizeCloudlyLegacyDeploymentSettlementCheckResult,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1
+);
+
+const normalizeUnsignedAuthenticatedApplyResultInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-apply-result',
+    normalizeCloudlyLegacyDeploymentSettlementApplyResult,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1
+);
+
+const normalizeUnsignedAuthenticatedStableOutcomeInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1 => (
+  normalizeUnsignedAuthenticatedArtifactInternal(
+    valueArg,
+    pathArg,
+    'authenticated-cloudly-legacy-deployment-settlement-stable-outcome',
+    normalizeCloudlyLegacyDeploymentSettlementStableOutcome,
+  ) as TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1
+);
+
+const finalizeAuthenticatedArtifact = <T>(valueArg: T, pathArg: string): Readonly<T> => finalize(
+  valueArg,
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthenticatedArtifactBytes,
+  pathArg,
+);
+
+/** Structural only. Use the async ForAuthority variant to authenticate its MAC. */
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedRehearsalBindingStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedRehearsalBinding',
+    'authenticated-cloudly-legacy-deployment-settlement-rehearsal-binding',
+    normalizeCloudlyLegacyDeploymentSettlementRehearsalBinding,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1,
+  'authenticatedRehearsalBinding')
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedPlan',
+    'authenticated-cloudly-legacy-deployment-settlement-plan',
+    normalizeCloudlyLegacyDeploymentSettlementPlan,
+    (payloadArg) => payloadArg.authority,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1, 'authenticatedPlan')
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedProductionRequest',
+    'authenticated-cloudly-legacy-deployment-settlement-production-request',
+    normalizeCloudlyLegacyDeploymentSettlementProductionRequest,
+    (payloadArg) => payloadArg.authority,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1,
+  'authenticatedProductionRequest')
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedCheckResult',
+    'authenticated-cloudly-legacy-deployment-settlement-check-result',
+    normalizeCloudlyLegacyDeploymentSettlementCheckResult,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1, 'authenticatedCheckResult')
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedApplyResult',
+    'authenticated-cloudly-legacy-deployment-settlement-apply-result',
+    normalizeCloudlyLegacyDeploymentSettlementApplyResult,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1, 'authenticatedApplyResult')
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedStableOutcomeStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1> => (
+  finalizeAuthenticatedArtifact(normalizeAuthenticatedArtifactInternal(
+    valueArg,
+    'authenticatedStableOutcome',
+    'authenticated-cloudly-legacy-deployment-settlement-stable-outcome',
+    normalizeCloudlyLegacyDeploymentSettlementStableOutcome,
+  ) as IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1,
+  'authenticatedStableOutcome')
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionRequestHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.productionRequestHmac,
+  encodeNormalized(
+    normalizeUnsignedAuthenticatedProductionRequestInternal(
+      valueArg,
+      'unsignedAuthenticatedProductionRequest',
+    ),
+    'unsignedAuthenticatedProductionRequest',
+  ),
+);
+
+const encodeAuthenticatedArtifact = <T>(
+  valueArg: unknown,
+  normalizeArg: (valueArg: unknown) => Readonly<T>,
+  pathArg: string,
+): Uint8Array => encodeNormalized(normalizeArg(valueArg), pathArg);
+
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBinding = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedRehearsalBindingStructure,
+  'authenticatedRehearsalBinding',
+);
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementPlan = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure,
+  'authenticatedPlan',
+);
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequest = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure,
+  'authenticatedProductionRequest',
+);
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementCheckResult = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructure,
+  'authenticatedCheckResult',
+);
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementApplyResult = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructure,
+  'authenticatedApplyResult',
+);
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcome = (
+  valueArg: unknown,
+): Uint8Array => encodeAuthenticatedArtifact(
+  valueArg,
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedStableOutcomeStructure,
+  'authenticatedStableOutcome',
+);
+
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBinding = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBinding(valueArg),
+);
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementPlan = (
+  valueArg: unknown,
+): string => digestBytes(encodeAuthenticatedCloudlyLegacyDeploymentSettlementPlan(valueArg));
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequest = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequest(valueArg),
+);
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementCheckResult = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeAuthenticatedCloudlyLegacyDeploymentSettlementCheckResult(valueArg),
+);
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementApplyResult = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeAuthenticatedCloudlyLegacyDeploymentSettlementApplyResult(valueArg),
+);
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcome = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcome(valueArg),
+);
+
+const scratchReceiptKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'requestSha256',
+  'stableOutcome',
+  'stableOutcomeSha256',
+  'transactionCommitted',
+  'disposition',
+  'completedAt',
+  'payloadSha256',
+  'mac',
+] as const;
+const scratchReceiptPayloadKeys = scratchReceiptKeys.filter((keyArg) => (
+  keyArg !== 'payloadSha256' && keyArg !== 'mac'
+));
+const unsignedScratchReceiptKeys = scratchReceiptKeys.filter((keyArg) => keyArg !== 'mac');
+
+const scratchReceiptPayload = (
+  valueArg: Omit<ICloudlyLegacyDeploymentSettlementScratchReceiptV1, 'payloadSha256' | 'mac'>,
+): unknown => ({
+  schemaVersion: valueArg.schemaVersion,
+  kind: valueArg.kind,
+  authority: valueArg.authority,
+  requestSha256: valueArg.requestSha256,
+  stableOutcome: valueArg.stableOutcome,
+  stableOutcomeSha256: valueArg.stableOutcomeSha256,
+  transactionCommitted: valueArg.transactionCommitted,
+  disposition: valueArg.disposition,
+  completedAt: valueArg.completedAt,
+});
+
+const normalizeScratchReceiptPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementScratchReceiptPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, scratchReceiptPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-scratch-receipt'
+    || value.transactionCommitted !== true) {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const output = {
+    schemaVersion: 1 as const,
+    kind: 'cloudly-legacy-deployment-settlement-scratch-receipt' as const,
+    authority: normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`),
+    requestSha256: readSha256(value.requestSha256, `${pathArg}.requestSha256`),
+    stableOutcome: normalizeStableOutcomeInternal(value.stableOutcome, `${pathArg}.stableOutcome`),
+    stableOutcomeSha256: readSha256(
+      value.stableOutcomeSha256,
+      `${pathArg}.stableOutcomeSha256`,
+    ),
+    transactionCommitted: true as const,
+    disposition: readLiteral(
+      value.disposition,
+      ['applied', 'exact-replay', 'no-op'],
+      `${pathArg}.disposition`,
+    ),
+    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
+  };
+  if (output.stableOutcomeSha256
+    !== digestBytes(encodeNormalized(output.stableOutcome, `${pathArg}.stableOutcome`))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.stableOutcomeSha256`);
+  }
+  return output;
+};
+
+const normalizeUnsignedScratchReceiptInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementUnsignedScratchReceiptV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedScratchReceiptKeys, pathArg);
+  const payloadInput = Object.fromEntries(scratchReceiptPayloadKeys.map((keyArg) => [
+    keyArg,
+    value[keyArg],
+  ]));
+  const payload = normalizeScratchReceiptPayloadInternal(payloadInput, `${pathArg}.payload`);
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256 !== digestBytes(encodeNormalized(
+    scratchReceiptPayload(payload),
+    `${pathArg}.payload`,
+  ))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+const normalizeScratchReceiptInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementScratchReceiptV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, scratchReceiptKeys, pathArg);
+  const unsignedInput = Object.fromEntries(unsignedScratchReceiptKeys.map((keyArg) => [
+    keyArg,
+    value[keyArg],
+  ]));
+  const unsigned = normalizeUnsignedScratchReceiptInternal(unsignedInput, `${pathArg}.unsigned`);
+  return {
+    ...unsigned,
+    mac: readMac(value.mac, `${pathArg}.mac`),
+  };
+};
+
+export const digestCloudlyLegacyDeploymentSettlementScratchReceiptPayload = (
+  valueArg: unknown,
+): string => {
+  const payload = normalizeScratchReceiptPayloadInternal(valueArg, 'scratchReceiptPayload');
+  return digestBytes(encodeNormalized(
+    scratchReceiptPayload(payload),
+    'scratchReceiptPayload',
+  ));
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementScratchReceipt = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementScratchReceiptV1> => finalize(
+  normalizeScratchReceiptInternal(valueArg, 'scratchReceipt'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+  'scratchReceipt',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementScratchReceipt = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(valueArg),
+  'scratchReceipt',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementScratchReceiptHmacInput = (
+  valueArg: unknown,
+): Uint8Array => {
+  const authenticated = finalize(
+    normalizeUnsignedScratchReceiptInternal(valueArg, 'unsignedScratchReceipt'),
+    cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+    'unsignedScratchReceipt',
+  );
+  return frame(
+    cloudlyLegacyDeploymentSettlementDomains.scratchReceiptHmac,
+    encodeNormalized(authenticated, 'scratchReceipt.authenticated'),
+  );
+};
+
+export const digestCloudlyLegacyDeploymentSettlementScratchReceipt = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementScratchReceipt(valueArg));
+
+const productionReceiptKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'requestSha256',
+  'scratchReceipt',
+  'scratchReceiptSha256',
+  'stableOutcome',
+  'stableOutcomeSha256',
+  'transactionCommitted',
+  'disposition',
+  'completedAt',
+  'payloadSha256',
+  'mac',
+] as const;
+const productionReceiptPayloadKeys = productionReceiptKeys.filter((keyArg) => (
+  keyArg !== 'payloadSha256' && keyArg !== 'mac'
+));
+const unsignedProductionReceiptKeys = productionReceiptKeys.filter((keyArg) => keyArg !== 'mac');
+
+const productionReceiptPayload = (
+  valueArg: Omit<ICloudlyLegacyDeploymentSettlementProductionReceiptV1, 'payloadSha256' | 'mac'>,
+): unknown => ({
+  schemaVersion: valueArg.schemaVersion,
+  kind: valueArg.kind,
+  authority: valueArg.authority,
+  requestSha256: valueArg.requestSha256,
+  scratchReceipt: valueArg.scratchReceipt,
+  scratchReceiptSha256: valueArg.scratchReceiptSha256,
+  stableOutcome: valueArg.stableOutcome,
+  stableOutcomeSha256: valueArg.stableOutcomeSha256,
+  transactionCommitted: valueArg.transactionCommitted,
+  disposition: valueArg.disposition,
+  completedAt: valueArg.completedAt,
+});
+
+const normalizeProductionReceiptPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementProductionReceiptPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, productionReceiptPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-production-receipt'
+    || value.transactionCommitted !== true) {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const scratchReceipt = normalizeScratchReceiptInternal(
+    value.scratchReceipt,
+    `${pathArg}.scratchReceipt`,
+  );
+  const stableOutcome = normalizeStableOutcomeInternal(
+    value.stableOutcome,
+    `${pathArg}.stableOutcome`,
+  );
+  const stableOutcomeSha256 = readSha256(
+    value.stableOutcomeSha256,
+    `${pathArg}.stableOutcomeSha256`,
+  );
+  const authority = normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`);
+  if (canonicalize(authority, `${pathArg}.authority`)
+    !== canonicalize(scratchReceipt.authority, `${pathArg}.scratchReceipt.authority`)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.authority`);
+  }
+  const requestSha256 = readSha256(value.requestSha256, `${pathArg}.requestSha256`);
+  const disposition = readLiteral(
+    value.disposition,
+    ['applied', 'exact-replay', 'no-op'],
+    `${pathArg}.disposition`,
+  );
+  if (requestSha256 !== scratchReceipt.requestSha256
+    || disposition !== scratchReceipt.disposition) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.scratchReceipt`);
+  }
+  if (canonicalize(stableOutcome, `${pathArg}.stableOutcome`)
+      !== canonicalize(scratchReceipt.stableOutcome, `${pathArg}.scratchReceipt.stableOutcome`)
+    || stableOutcomeSha256 !== scratchReceipt.stableOutcomeSha256
+    || stableOutcomeSha256
+      !== digestBytes(encodeNormalized(stableOutcome, `${pathArg}.stableOutcome`))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.stableOutcome`);
+  }
+  const scratchReceiptSha256 = readSha256(
+    value.scratchReceiptSha256,
+    `${pathArg}.scratchReceiptSha256`,
+  );
+  if (scratchReceiptSha256
+    !== digestBytes(encodeNormalized(scratchReceipt, `${pathArg}.scratchReceipt`))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.scratchReceiptSha256`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-production-receipt',
+    authority,
+    requestSha256,
+    scratchReceipt,
+    scratchReceiptSha256,
+    stableOutcome,
+    stableOutcomeSha256,
+    transactionCommitted: true,
+    disposition,
+    completedAt: readInteger(
+      value.completedAt,
+      `${pathArg}.completedAt`,
+      scratchReceipt.completedAt,
+    ),
+  };
+};
+
+const normalizeUnsignedProductionReceiptInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementUnsignedProductionReceiptV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedProductionReceiptKeys, pathArg);
+  const payloadInput = Object.fromEntries(productionReceiptPayloadKeys.map((keyArg) => [
+    keyArg,
+    value[keyArg],
+  ]));
+  const payload = normalizeProductionReceiptPayloadInternal(payloadInput, `${pathArg}.payload`);
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256 !== digestBytes(encodeNormalized(
+    productionReceiptPayload(payload),
+    `${pathArg}.payload`,
+  ))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const digestCloudlyLegacyDeploymentSettlementProductionReceiptPayload = (
+  valueArg: unknown,
+): string => {
+  const payload = normalizeProductionReceiptPayloadInternal(
+    valueArg,
+    'productionReceiptPayload',
+  );
+  return digestBytes(encodeNormalized(
+    productionReceiptPayload(payload),
+    'productionReceiptPayload',
+  ));
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceipt = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionReceiptV1> => {
+  const value = readRecord(valueArg, 'productionReceipt');
+  assertExactKeys(value, productionReceiptKeys, 'productionReceipt');
+  const unsignedInput = Object.fromEntries(unsignedProductionReceiptKeys.map((keyArg) => [
+    keyArg,
+    value[keyArg],
+  ]));
+  const unsigned = normalizeUnsignedProductionReceiptInternal(
+    unsignedInput,
+    'productionReceipt.unsigned',
+  );
+  return finalize({
+    ...unsigned,
+    mac: readMac(value.mac, 'productionReceipt.mac'),
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes, 'productionReceipt');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionReceipt = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementProductionReceipt(valueArg),
+  'productionReceipt',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionReceiptHmacInput = (
+  valueArg: unknown,
+): Uint8Array => {
+  const authenticated = finalize(
+    normalizeUnsignedProductionReceiptInternal(valueArg, 'unsignedProductionReceipt'),
+    cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+    'unsignedProductionReceipt',
+  );
+  return frame(
+    cloudlyLegacyDeploymentSettlementDomains.productionReceiptHmac,
+    encodeNormalized(authenticated, 'productionReceipt.authenticated'),
+  );
+};
+
+export const digestCloudlyLegacyDeploymentSettlementProductionReceipt = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementProductionReceipt(valueArg));
+
+const withoutArtifactMac = <TArtifact extends { mac: string }>(
+  artifactArg: TArtifact,
+): Omit<TArtifact, 'mac'> => {
+  const { mac: _mac, ...unsigned } = artifactArg;
+  return unsigned;
+};
+
+const requireConsumerVerifiedHmac = async (
+  authorityArg: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1,
+  domainArg: ICloudlyLegacyDeploymentSettlementHmacVerificationInputV1['domain'],
+  hmacInputArg: Uint8Array,
+  macArg: string,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+  pathArg: string,
+): Promise<void> => {
+  let verified = false;
+  try {
+    verified = await verifierArg({
+      authority: authorityArg,
+      domain: domainArg,
+      hmacInput: new Uint8Array(hmacInputArg),
+      mac: macArg,
+    });
+  } catch {
+    verified = false;
+  }
+  if (!verified) fail('INVALID_VALUE', pathArg);
+};
+
+const assertAuthorityTimestamp = (
+  timestampArg: number,
+  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  pathArg: string,
+): void => {
+  if (timestampArg < metadataArg.issuedAt || timestampArg >= metadataArg.expiresAt) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const assertAuthorityReferenceMatchesMetadata = (
+  referenceArg: unknown,
+  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  pathArg: string,
+): void => {
+  try {
+    normalizeCloudlyLegacyDeploymentSettlementAuthorityReferenceForMetadata(
+      referenceArg,
+      metadataArg,
+    );
+  } catch {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const assertRehearsalBindingMatchesAuthorityMetadata = (
+  bindingArg: ICloudlyLegacyDeploymentSettlementRehearsalBindingV1,
+  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  pathArg: string,
+): void => {
+  const expected = {
+    settlementId: metadataArg.settlementId,
+    runId: metadataArg.runId,
+    rehearsalId: metadataArg.rehearsalId,
+    scratchServiceId: metadataArg.scratchServiceId,
+    allocationId: metadataArg.allocationId,
+    allocationGeneration: metadataArg.allocationGeneration,
+    allocationBindingSha256: metadataArg.allocationBindingSha256,
+    allocationReceiptSha256: metadataArg.allocationReceiptSha256,
+    backupId: metadataArg.backupId,
+    backupSnapshotIdSha256: metadataArg.backupSnapshotIdSha256,
+    backupProofSha256: metadataArg.backupProofSha256,
+    sourceDataSha256: metadataArg.sourceDataSha256,
+    restoredDataSha256: metadataArg.restoredDataSha256,
+    digestProofSha256: metadataArg.digestProofSha256,
+    targetImageDigest: metadataArg.targetImageDigest,
+    targetVersion: metadataArg.targetVersion,
+    targetManifestSha256: metadataArg.targetManifestSha256,
+    targetConfigSha256: metadataArg.targetConfigSha256,
+  };
+  const actual = {
+    settlementId: bindingArg.settlementId,
+    runId: bindingArg.runId,
+    rehearsalId: bindingArg.rehearsalId,
+    scratchServiceId: bindingArg.scratchServiceId,
+    allocationId: bindingArg.allocationId,
+    allocationGeneration: bindingArg.allocationGeneration,
+    allocationBindingSha256: bindingArg.allocationBindingSha256,
+    allocationReceiptSha256: bindingArg.allocationReceiptSha256,
+    backupId: bindingArg.backupId,
+    backupSnapshotIdSha256: bindingArg.backupSnapshotIdSha256,
+    backupProofSha256: bindingArg.backupProofSha256,
+    sourceDataSha256: bindingArg.sourceDataSha256,
+    restoredDataSha256: bindingArg.restoredDataSha256,
+    digestProofSha256: bindingArg.digestProofSha256,
+    targetImageDigest: bindingArg.targetImageDigest,
+    targetVersion: bindingArg.targetVersion,
+    targetManifestSha256: bindingArg.targetManifestSha256,
+    targetConfigSha256: bindingArg.targetConfigSha256,
+  };
+  if (canonicalize(actual, pathArg) !== canonicalize(expected, `${pathArg}.expected`)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementRehearsalBindingForAuthority = (
+  bindingArg: unknown,
+  metadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementRehearsalBindingV1> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const binding = normalizeCloudlyLegacyDeploymentSettlementRehearsalBinding(bindingArg);
+  assertRehearsalBindingMatchesAuthorityMetadata(binding, metadata, 'rehearsalBinding.authority');
+  return binding;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementPlanForAuthority = (
+  planArg: unknown,
+  metadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementPlanV1> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const plan = normalizeCloudlyLegacyDeploymentSettlementPlan(planArg);
+  assertAuthorityReferenceMatchesMetadata(plan.authority, metadata, 'plan.authority');
+  if (plan.settlementId !== metadata.settlementId) {
+    fail('CROSS_FIELD_MISMATCH', 'plan.settlementId');
+  }
+  assertAuthorityTimestamp(plan.effectiveAt, metadata, 'plan.effectiveAt');
+  return plan;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionRequestForAuthority = (
+  requestArg: unknown,
+  metadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionRequestV1> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = normalizeCloudlyLegacyDeploymentSettlementProductionRequest(requestArg);
+  assertAuthorityReferenceMatchesMetadata(
+    request.authority,
+    metadata,
+    'productionRequest.authority',
+  );
+  normalizeCloudlyLegacyDeploymentSettlementPlanForAuthority(request.plan, metadata);
+  normalizeCloudlyLegacyDeploymentSettlementRehearsalBindingForAuthority(
+    request.rehearsalBinding,
+    metadata,
+  );
+  assertAuthorityTimestamp(request.requestedAt, metadata, 'productionRequest.requestedAt');
+  return request;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingForAuthority = async (
+  bindingArg: unknown,
+  metadataArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const binding = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedRehearsalBindingStructure(
+    bindingArg,
+  );
+  assertAuthorityReferenceMatchesMetadata(binding.authority, metadata, 'rehearsalBinding.authority');
+  normalizeCloudlyLegacyDeploymentSettlementRehearsalBindingForAuthority(
+    binding.payload,
+    metadata,
+  );
+  await requireConsumerVerifiedHmac(
+    binding.authority,
+    cloudlyLegacyDeploymentSettlementDomains.rehearsalBindingHmac,
+    encodeCloudlyLegacyDeploymentSettlementRehearsalBindingHmacInput(
+      withoutArtifactMac(binding),
+    ),
+    binding.mac,
+    verifierArg,
+    'rehearsalBinding.mac',
+  );
+  return binding;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority = async (
+  planArg: unknown,
+  metadataArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const plan = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(planArg);
+  assertAuthorityReferenceMatchesMetadata(plan.authority, metadata, 'plan.authority');
+  normalizeCloudlyLegacyDeploymentSettlementPlanForAuthority(plan.payload, metadata);
+  await requireConsumerVerifiedHmac(
+    plan.authority,
+    cloudlyLegacyDeploymentSettlementDomains.planHmac,
+    encodeCloudlyLegacyDeploymentSettlementPlanHmacInput(withoutArtifactMac(plan)),
+    plan.mac,
+    verifierArg,
+    'plan.mac',
+  );
+  return plan;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority = async (
+  requestArg: unknown,
+  metadataArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    request.authority,
+    metadata,
+    'productionRequest.authority',
+  );
+  normalizeCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    request.payload,
+    metadata,
+  );
+  await requireConsumerVerifiedHmac(
+    request.authority,
+    cloudlyLegacyDeploymentSettlementDomains.productionRequestHmac,
+    encodeCloudlyLegacyDeploymentSettlementProductionRequestHmacInput(
+      withoutArtifactMac(request),
+    ),
+    request.mac,
+    verifierArg,
+    'productionRequest.mac',
+  );
+  return request;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultForAuthority = async (
+  resultArg: unknown,
+  metadataArg: unknown,
+  requestArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    requestArg,
+    metadata,
+    verifierArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructureForRequest(
+    resultArg,
+    request,
+  );
+  assertAuthorityReferenceMatchesMetadata(result.authority, metadata, 'checkResult.authority');
+  assertAuthorityTimestamp(result.payload.checkedAt, metadata, 'checkResult.checkedAt');
+  await requireConsumerVerifiedHmac(
+    result.authority,
+    cloudlyLegacyDeploymentSettlementDomains.checkResultHmac,
+    encodeCloudlyLegacyDeploymentSettlementCheckResultHmacInput(withoutArtifactMac(result)),
+    result.mac,
+    verifierArg,
+    'checkResult.mac',
+  );
+  return result;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultForAuthority = async (
+  resultArg: unknown,
+  metadataArg: unknown,
+  requestArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    requestArg,
+    metadata,
+    verifierArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructureForRequest(
+    resultArg,
+    request,
+  );
+  assertAuthorityReferenceMatchesMetadata(result.authority, metadata, 'applyResult.authority');
+  assertAuthorityTimestamp(
+    result.payload.status === 'completed'
+      ? result.payload.completedAt
+      : result.payload.rejectedAt,
+    metadata,
+    'applyResult.completedAt',
+  );
+  await requireConsumerVerifiedHmac(
+    result.authority,
+    cloudlyLegacyDeploymentSettlementDomains.applyResultHmac,
+    encodeCloudlyLegacyDeploymentSettlementApplyResultHmacInput(withoutArtifactMac(result)),
+    result.mac,
+    verifierArg,
+    'applyResult.mac',
+  );
+  return result;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeForAuthority = async (
+  outcomeArg: unknown,
+  metadataArg: unknown,
+  requestArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    requestArg,
+    metadata,
+    verifierArg,
+  );
+  const outcome = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedStableOutcomeStructureForRequest(
+    outcomeArg,
+    request,
+  );
+  assertAuthorityReferenceMatchesMetadata(outcome.authority, metadata, 'stableOutcome.authority');
+  if (outcome.payload.settlementId !== metadata.settlementId
+    || outcome.payload.runId !== metadata.runId) {
+    fail('CROSS_FIELD_MISMATCH', 'stableOutcome.authority');
+  }
+  assertAuthorityTimestamp(outcome.payload.effectiveAt, metadata, 'stableOutcome.effectiveAt');
+  await requireConsumerVerifiedHmac(
+    outcome.authority,
+    cloudlyLegacyDeploymentSettlementDomains.stableOutcomeHmac,
+    encodeCloudlyLegacyDeploymentSettlementStableOutcomeHmacInput(
+      withoutArtifactMac(outcome),
+    ),
+    outcome.mac,
+    verifierArg,
+    'stableOutcome.mac',
+  );
+  return outcome;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority = async (
+  receiptArg: unknown,
+  metadataArg: unknown,
+  requestArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementScratchReceiptV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    requestArg,
+    metadata,
+    verifierArg,
+  );
+  const receipt = normalizeCloudlyLegacyDeploymentSettlementScratchReceiptStructureForRequest(
+    receiptArg,
+    request,
+  );
+  assertAuthorityReferenceMatchesMetadata(receipt.authority, metadata, 'scratchReceipt.authority');
+  if (receipt.stableOutcome.settlementId !== metadata.settlementId
+    || receipt.stableOutcome.runId !== metadata.runId) {
+    fail('CROSS_FIELD_MISMATCH', 'scratchReceipt.stableOutcome');
+  }
+  assertAuthorityTimestamp(receipt.stableOutcome.effectiveAt, metadata, 'scratchReceipt.effectiveAt');
+  assertAuthorityTimestamp(receipt.completedAt, metadata, 'scratchReceipt.completedAt');
+  await requireConsumerVerifiedHmac(
+    receipt.authority,
+    cloudlyLegacyDeploymentSettlementDomains.scratchReceiptHmac,
+    encodeCloudlyLegacyDeploymentSettlementScratchReceiptHmacInput(
+      withoutArtifactMac(receipt),
+    ),
+    receipt.mac,
+    verifierArg,
+    'scratchReceipt.mac',
+  );
+  return receipt;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptForAuthority = async (
+  receiptArg: unknown,
+  metadataArg: unknown,
+  requestArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementProductionReceiptV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const request = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    requestArg,
+    metadata,
+    verifierArg,
+  );
+  const receipt = normalizeCloudlyLegacyDeploymentSettlementProductionReceiptStructureForRequest(
+    receiptArg,
+    request,
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    receipt.authority,
+    metadata,
+    'productionReceipt.authority',
+  );
+  await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+    receipt.scratchReceipt,
+    metadata,
+    request,
+    verifierArg,
+  );
+  if (receipt.stableOutcome.settlementId !== metadata.settlementId
+    || receipt.stableOutcome.runId !== metadata.runId) {
+    fail('CROSS_FIELD_MISMATCH', 'productionReceipt.stableOutcome');
+  }
+  assertAuthorityTimestamp(receipt.completedAt, metadata, 'productionReceipt.completedAt');
+  await requireConsumerVerifiedHmac(
+    receipt.authority,
+    cloudlyLegacyDeploymentSettlementDomains.productionReceiptHmac,
+    encodeCloudlyLegacyDeploymentSettlementProductionReceiptHmacInput(
+      withoutArtifactMac(receipt),
+    ),
+    receipt.mac,
+    verifierArg,
+    'productionReceipt.mac',
+  );
+  return receipt;
+};
+
+const assertAuthenticatedAuthorityMatches = (
+  authorityArg: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1,
+  expectedArg: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1,
+  pathArg: string,
+): void => {
+  if (canonicalize(authorityArg, pathArg) !== canonicalize(expectedArg, `${pathArg}.expected`)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const assertSummaryMatchesProductionRequest = (
+  summaryArg: ICloudlyLegacyDeploymentSettlementSafeResultBaseV1,
+  requestArg: ICloudlyLegacyDeploymentSettlementProductionRequestV1,
+  pathArg: string,
+): void => {
+  if (summaryArg.requestSha256
+      !== digestCloudlyLegacyDeploymentSettlementProductionRequest(requestArg)
+    || summaryArg.planSha256 !== requestArg.planSha256
+    || summaryArg.settlementId !== requestArg.plan.settlementId
+    || summaryArg.sourceStateHmac !== requestArg.plan.sourceStateHmac
+    || summaryArg.finalStateHmac !== requestArg.plan.finalStateHmac
+    || canonicalize(summaryArg.counts, `${pathArg}.counts`)
+      !== canonicalize({
+        operationCount: requestArg.plan.operationCount,
+        routeClaimsStabilized: requestArg.plan.entries.reduce(
+          (sumArg, entryArg) => sumArg + entryArg.routeClaimsStabilized,
+          0,
+        ),
+        routeClaimsRemoved: requestArg.plan.entries.reduce(
+          (sumArg, entryArg) => sumArg + entryArg.routeClaimsRemoved,
+          0,
+        ),
+        resourceClaimsRemoved: requestArg.plan.entries.reduce(
+          (sumArg, entryArg) => sumArg + entryArg.resourceClaimsRemoved,
+          0,
+        ),
+      }, `${pathArg}.expectedCounts`)
+    || canonicalize(summaryArg.classificationCounts, `${pathArg}.classificationCounts`)
+      !== canonicalize(
+        requestArg.plan.classificationCounts,
+        `${pathArg}.expectedClassificationCounts`,
+      )) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const assertStableOutcomeMatchesProductionRequest = (
+  stableOutcomeArg: ICloudlyLegacyDeploymentSettlementStableOutcomeV1,
+  requestArg: ICloudlyLegacyDeploymentSettlementProductionRequestV1,
+  pathArg: string,
+): void => {
+  const expectedSettlements: ICloudlyLegacyDeploymentSettlementStableOutcomeEntryV1[] =
+    requestArg.plan.entries.map((entryArg) => ({
+      operationId: entryArg.operationId,
+      finalRevision: entryArg.finalRevision,
+      finalDocumentHmac: entryArg.finalDocumentHmac,
+    }));
+  if (stableOutcomeArg.settlementId !== requestArg.plan.settlementId
+    || stableOutcomeArg.runId !== requestArg.rehearsalBinding.runId
+    || stableOutcomeArg.rehearsalBindingSha256 !== requestArg.rehearsalBindingSha256
+    || stableOutcomeArg.effectiveAt !== requestArg.plan.effectiveAt
+    || stableOutcomeArg.planSha256 !== requestArg.planSha256
+    || stableOutcomeArg.sourceStateHmac !== requestArg.plan.sourceStateHmac
+    || stableOutcomeArg.finalStateHmac !== requestArg.plan.finalStateHmac
+    || canonicalize(stableOutcomeArg.settlements, `${pathArg}.settlements`)
+      !== canonicalize(expectedSettlements, `${pathArg}.expectedSettlements`)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+  assertSummaryMatchesProductionRequest({
+    schemaVersion: 1,
+    requestSha256: digestCloudlyLegacyDeploymentSettlementProductionRequest(requestArg),
+    planSha256: stableOutcomeArg.planSha256,
+    settlementId: stableOutcomeArg.settlementId,
+    sourceStateHmac: stableOutcomeArg.sourceStateHmac,
+    finalStateHmac: stableOutcomeArg.finalStateHmac,
+    transactionSupported: true,
+    counts: stableOutcomeArg.counts,
+    classificationCounts: stableOutcomeArg.classificationCounts,
+  }, requestArg, pathArg);
+};
+
+/** Structural/request binding only; this function does not authenticate MACs. */
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructureForRequest = (
+  resultArg: unknown,
+  requestArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructure(resultArg);
+  assertAuthenticatedAuthorityMatches(result.authority, request.authority, 'checkResult.authority');
+  assertSummaryMatchesProductionRequest(result.payload, request.payload, 'checkResult.payload');
+  if (result.payload.checkedAt < request.payload.requestedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'checkResult.payload.checkedAt');
+  }
+  return result;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructureForRequest = (
+  resultArg: unknown,
+  requestArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructure(resultArg);
+  assertAuthenticatedAuthorityMatches(result.authority, request.authority, 'applyResult.authority');
+  assertSummaryMatchesProductionRequest(result.payload, request.payload, 'applyResult.payload');
+  const resultAt = result.payload.status === 'completed'
+    ? result.payload.completedAt
+    : result.payload.rejectedAt;
+  if (resultAt < request.payload.requestedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'applyResult.payload.completedAt');
+  }
+  return result;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedStableOutcomeStructureForRequest = (
+  outcomeArg: unknown,
+  requestArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementStableOutcomeV1> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const outcome = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedStableOutcomeStructure(outcomeArg);
+  assertAuthenticatedAuthorityMatches(
+    outcome.authority,
+    request.authority,
+    'stableOutcome.authority',
+  );
+  assertStableOutcomeMatchesProductionRequest(
+    outcome.payload,
+    request.payload,
+    'stableOutcome.payload',
+  );
+  return outcome;
+};
+
+/** Structural/request binding only; this function does not authenticate MACs. */
+export const normalizeCloudlyLegacyDeploymentSettlementScratchReceiptStructureForRequest = (
+  receiptArg: unknown,
+  requestArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementScratchReceiptV1> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const receipt = normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(receiptArg);
+  assertAuthenticatedAuthorityMatches(receipt.authority, request.authority, 'scratchReceipt.authority');
+  if (receipt.requestSha256
+      !== digestCloudlyLegacyDeploymentSettlementProductionRequest(request.payload)
+    || receipt.completedAt < request.payload.requestedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'scratchReceipt.requestSha256');
+  }
+  assertStableOutcomeMatchesProductionRequest(
+    receipt.stableOutcome,
+    request.payload,
+    'scratchReceipt.stableOutcome',
+  );
+  return receipt;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptStructureForRequest = (
+  receiptArg: unknown,
+  requestArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionReceiptV1> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const receipt = normalizeCloudlyLegacyDeploymentSettlementProductionReceipt(receiptArg);
+  normalizeCloudlyLegacyDeploymentSettlementScratchReceiptStructureForRequest(
+    receipt.scratchReceipt,
+    request,
+  );
+  assertAuthenticatedAuthorityMatches(
+    receipt.authority,
+    request.authority,
+    'productionReceipt.authority',
+  );
+  if (receipt.requestSha256
+      !== digestCloudlyLegacyDeploymentSettlementProductionRequest(request.payload)
+    || receipt.completedAt < request.payload.requestedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'productionReceipt.requestSha256');
+  }
+  return receipt;
+};
+
+export { cloudlyLegacyDeploymentSettlementGoldenVectors } from './runtime.cloudlylegacydeploymentsettlement.golden.js';