@serve.zone/interfaces 27.3.1 → 27.4.0

package/ts/runtime.cloudlylegacydeploymentsettlement.offlineexport.ts

@@ -0,0 +1,2470 @@
+import * as plugins from './plugins.runtime.js';
+
+import {
+  canonicalizeStrictJson,
+  deepFreezeValue,
+} from './private/canonicaljson.js';
+import {
+  cloudlyLegacyDeploymentSettlementLimits,
+} from './runtime.cloudlylegacydeploymentsettlement.js';
+import type {
+  ICorestoreDatabaseAllocationReference,
+} from './runtime.corestore.js';
+import {
+  normalizeCorestoreDatabaseAllocationReference,
+} from './runtime.corestore.js';
+
+const maximumExactExportBytes = 96 * 1024 * 1024 + 1;
+
+export const cloudlyLegacyDeploymentSettlementOfflineExportLimits = Object.freeze({
+  maximumIdentifierLength:
+    cloudlyLegacyDeploymentSettlementLimits.maximumIdentifierLength,
+  maximumSourceDocuments:
+    cloudlyLegacyDeploymentSettlementLimits.maximumSourceDocuments,
+  maximumOperations: cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
+  maximumExactExportBytes,
+  maximumJournalGrowthBytes: 64 * 1024,
+  maximumJournalCanonicalBytes: 32 * 1024,
+  maximumReceiptBytes: 16 * 1024,
+  maximumResultBytes: 16 * 1024,
+  maximumAuthorityBytes: 16 * 1024,
+  maximumPlanBytes: 768 * 1024,
+  maximumAuthenticatedArtifactBytes: 768 * 1024,
+  maximumAuthorityLifetimeMs:
+    cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityLifetimeMs,
+} as const);
+
+export const cloudlyLegacyDeploymentSettlementOfflineExportDomains = Object.freeze({
+  rehearsalAttestationHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/rehearsal-attestation-hmac-v1\0',
+  productionTransformAuthorizationHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/production-transform-authorization-hmac-v1\0',
+  attemptJournalHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/attempt-journal-hmac-v1\0',
+  completeOutputReceiptHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/complete-output-receipt-hmac-v1\0',
+} as const);
+
+export const cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName =
+  'cloudly_legacy_deployment_settlement_export_attempt_v1' as const;
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode =
+  | 'INVALID_DATA'
+  | 'INVALID_SCHEMA'
+  | 'INVALID_VALUE'
+  | 'LIMIT_EXCEEDED'
+  | 'ORDERING_REQUIRED'
+  | 'CROSS_FIELD_MISMATCH';
+
+export class CloudlyLegacyDeploymentSettlementOfflineExportCodecError extends Error {
+  public readonly code: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode;
+  public readonly path: string;
+
+  public constructor(
+    codeArg: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode,
+    pathArg: string,
+  ) {
+    super(`${codeArg}:${pathArg}`);
+    this.name = 'CloudlyLegacyDeploymentSettlementOfflineExportCodecError';
+    this.code = codeArg;
+    this.path = pathArg;
+  }
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportClassification =
+  | 'image-recorded-not-current'
+  | 'image-recorded-current-failed'
+  | 'rolling-out-current-failed'
+  | 'rolling-out-superseded';
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1 {
+  'image-recorded-not-current': number;
+  'image-recorded-current-failed': number;
+  'rolling-out-current-failed': number;
+  'rolling-out-superseded': number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1 {
+  operations: number;
+  services: number;
+  images: number;
+  releases: number;
+  rolloutOperations: number;
+  routeClaims: number;
+  resourceClaims: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1 {
+  operationCount: number;
+  routeClaimsStabilized: number;
+  routeClaimsRemoved: number;
+  resourceClaimsRemoved: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1 {
+  operationId: string;
+  serviceId: string;
+  sourceRevision: number;
+  sourceState: 'image-recorded' | 'rolling-out';
+  classification: TCloudlyLegacyDeploymentSettlementOfflineExportClassification;
+  finalRevision: number;
+  sourceDocumentHmac: `hmac-sha256:${string}`;
+  finalDocumentHmac: `hmac-sha256:${string}`;
+  routeClaimsStabilized: number;
+  routeClaimsRemoved: number;
+  resourceClaimsRemoved: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1 {
+  format: 'smartdb.database.export.v1';
+  databaseName: string;
+  byteLength: number;
+  sha256: string;
+  lineFeedTerminator: 'single-lf';
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1 {
+  backupId: string;
+  sourceServiceId: string;
+  snapshotId: string;
+  backupReceiptSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-plan';
+  operationId: string;
+  settlementId: string;
+  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  effectiveAt: number;
+  sourceStateHmac: `hmac-sha256:${string}`;
+  finalStateHmac: `hmac-sha256:${string}`;
+  sourceCensus: ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1;
+  entries: ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1[];
+  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
+  classificationCounts:
+    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
+}
+
+interface ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference';
+  operationId: string;
+  settlementId: string;
+  authorityId: string;
+  keyId: string;
+  keyVersion: 1;
+  authorityMetadataSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
+  role: 'source-rehearsal';
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
+  role: 'production-transform';
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1 =
+  | ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
+  | ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-source-authority';
+  role: 'source-rehearsal';
+  operationId: string;
+  settlementId: string;
+  authorityId: string;
+  keyId: string;
+  keyVersion: 1;
+  issuedAt: number;
+  expiresAt: number;
+  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  approvedSourceBackup:
+    ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1;
+  planSha256: string;
+  rehearsalRequestSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation';
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  plan: ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1;
+  planSha256: string;
+  rehearsalRequestSha256: string;
+  scratchAllocation: ICorestoreDatabaseAllocationReference;
+  outcome: 'transform-required' | 'no-op';
+  observedFinalStateHmac: `hmac-sha256:${string}`;
+  observedCounts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
+  observedClassificationCounts:
+    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
+  completedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 {
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedRehearsalAttestationV1 =
+  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1, 'mac'>;
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority';
+  role: 'production-transform';
+  operationId: string;
+  settlementId: string;
+  authorityId: string;
+  keyId: string;
+  keyVersion: 1;
+  issuedAt: number;
+  expiresAt: number;
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  authenticatedRehearsalAttestationSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization';
+  authority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  attemptId: string;
+  authenticatedRehearsalAttestationSha256: string;
+  planSha256: string;
+  requestSha256: string;
+  requestedAt: number;
+  authorizedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 {
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedProductionTransformAuthorizationV1 =
+  Omit<
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1,
+    'mac'
+  >;
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 {
+  schemaVersion: 1;
+  kind: typeof cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName;
+  purpose: 'production-transform';
+  operationId: string;
+  settlementId: string;
+  attemptId: string;
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  productionTransformAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
+  authenticatedRehearsalAttestationSha256: string;
+  transformAuthorizationSha256: string;
+  planSha256: string;
+  requestSha256: string;
+  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  transformedCoreFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  sourceStateHmac: `hmac-sha256:${string}`;
+  finalStateHmac: `hmac-sha256:${string}`;
+  outcome: 'transformed' | 'no-op';
+  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
+  classificationCounts:
+    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
+  completedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 {
+  _id: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedAttemptJournalV1 =
+  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1, 'mac'>;
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt';
+  authority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  operationId: string;
+  settlementId: string;
+  attemptId: string;
+  journalSha256: string;
+  transformedCoreFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  completeOutputFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
+  journalGrowthBytes: number;
+  completedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
+extends ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 {
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedCompleteOutputReceiptV1 =
+  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1, 'mac'>;
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-offline-export-transform-result';
+  status: 'completed';
+  operationId: string;
+  settlementId: string;
+  attemptId: string;
+  sourceAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
+  productionTransformAuthority:
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
+  planSha256: string;
+  requestSha256: string;
+  completeOutputReceiptSha256: string;
+  outcome: 'transformed' | 'no-op';
+  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
+  classificationCounts:
+    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
+  completedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1 {
+  authority: TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1;
+  domain: typeof cloudlyLegacyDeploymentSettlementOfflineExportDomains[keyof
+    typeof cloudlyLegacyDeploymentSettlementOfflineExportDomains];
+  hmacInput: Uint8Array;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier = (
+  inputArg: ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1,
+) => boolean | Promise<boolean>;
+
+const classificationKeys = [
+  'image-recorded-not-current',
+  'image-recorded-current-failed',
+  'rolling-out-current-failed',
+  'rolling-out-superseded',
+] as const;
+const censusKeys = [
+  'operations',
+  'services',
+  'images',
+  'releases',
+  'rolloutOperations',
+  'routeClaims',
+  'resourceClaims',
+] as const;
+const mutationCountKeys = [
+  'operationCount',
+  'routeClaimsStabilized',
+  'routeClaimsRemoved',
+  'resourceClaimsRemoved',
+] as const;
+const planEntryKeys = [
+  'operationId',
+  'serviceId',
+  'sourceRevision',
+  'sourceState',
+  'classification',
+  'finalRevision',
+  'sourceDocumentHmac',
+  'finalDocumentHmac',
+  'routeClaimsStabilized',
+  'routeClaimsRemoved',
+  'resourceClaimsRemoved',
+] as const;
+const fileIdentityKeys = [
+  'format',
+  'databaseName',
+  'byteLength',
+  'sha256',
+  'lineFeedTerminator',
+] as const;
+const approvedSourceBackupKeys = [
+  'backupId',
+  'sourceServiceId',
+  'snapshotId',
+  'backupReceiptSha256',
+] as const;
+const authorityReferenceKeys = [
+  'schemaVersion',
+  'kind',
+  'role',
+  'operationId',
+  'settlementId',
+  'authorityId',
+  'keyId',
+  'keyVersion',
+  'authorityMetadataSha256',
+] as const;
+const sourceAuthorityKeys = [
+  'schemaVersion',
+  'kind',
+  'role',
+  'operationId',
+  'settlementId',
+  'authorityId',
+  'keyId',
+  'keyVersion',
+  'issuedAt',
+  'expiresAt',
+  'sourceFile',
+  'approvedSourceBackup',
+  'planSha256',
+  'rehearsalRequestSha256',
+] as const;
+const productionTransformAuthorityKeys = [
+  'schemaVersion',
+  'kind',
+  'role',
+  'operationId',
+  'settlementId',
+  'authorityId',
+  'keyId',
+  'keyVersion',
+  'issuedAt',
+  'expiresAt',
+  'sourceAuthority',
+  'authenticatedRehearsalAttestationSha256',
+] as const;
+const rehearsalPayloadKeys = [
+  'schemaVersion',
+  'kind',
+  'sourceAuthority',
+  'plan',
+  'planSha256',
+  'rehearsalRequestSha256',
+  'scratchAllocation',
+  'outcome',
+  'observedFinalStateHmac',
+  'observedCounts',
+  'observedClassificationCounts',
+  'completedAt',
+] as const;
+const rehearsalUnsignedKeys = [...rehearsalPayloadKeys, 'payloadSha256'] as const;
+const rehearsalKeys = [...rehearsalUnsignedKeys, 'mac'] as const;
+const authorizationPayloadKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'sourceAuthority',
+  'attemptId',
+  'authenticatedRehearsalAttestationSha256',
+  'planSha256',
+  'requestSha256',
+  'requestedAt',
+  'authorizedAt',
+] as const;
+const authorizationUnsignedKeys = [...authorizationPayloadKeys, 'payloadSha256'] as const;
+const authorizationKeys = [...authorizationUnsignedKeys, 'mac'] as const;
+const journalSeedKeys = [
+  'schemaVersion',
+  'kind',
+  'purpose',
+  'operationId',
+  'settlementId',
+  'attemptId',
+  'sourceAuthority',
+  'productionTransformAuthority',
+  'authenticatedRehearsalAttestationSha256',
+  'transformAuthorizationSha256',
+  'planSha256',
+  'requestSha256',
+  'sourceFile',
+  'transformedCoreFile',
+  'sourceStateHmac',
+  'finalStateHmac',
+  'outcome',
+  'counts',
+  'classificationCounts',
+  'completedAt',
+] as const;
+const journalUnsignedKeys = ['_id', ...journalSeedKeys] as const;
+const journalKeys = [...journalUnsignedKeys, 'mac'] as const;
+const completeOutputReceiptPayloadKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'sourceAuthority',
+  'operationId',
+  'settlementId',
+  'attemptId',
+  'journalSha256',
+  'transformedCoreFile',
+  'completeOutputFile',
+  'journalGrowthBytes',
+  'completedAt',
+] as const;
+const completeOutputReceiptUnsignedKeys = [
+  ...completeOutputReceiptPayloadKeys,
+  'payloadSha256',
+] as const;
+const completeOutputReceiptKeys = [...completeOutputReceiptUnsignedKeys, 'mac'] as const;
+
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._@-]{0,199}$/;
+const sha256Pattern = /^[a-f0-9]{64}$/;
+const stateHmacPattern = /^hmac-sha256:[a-f0-9]{64}$/;
+const macPattern = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+
+const fail = (
+  codeArg: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode,
+  pathArg: string,
+): never => {
+  throw new CloudlyLegacyDeploymentSettlementOfflineExportCodecError(codeArg, pathArg);
+};
+
+const normalizeScratchAllocation = (
+  valueArg: unknown,
+  pathArg: string,
+): ICorestoreDatabaseAllocationReference => {
+  try {
+    return normalizeCorestoreDatabaseAllocationReference(
+      valueArg,
+    ) as ICorestoreDatabaseAllocationReference;
+  } catch {
+    return fail('INVALID_VALUE', pathArg);
+  }
+};
+
+const readRecord = (valueArg: unknown, pathArg: string): Record<string, unknown> => {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+    return fail('INVALID_DATA', pathArg);
+  }
+  const prototype = Object.getPrototypeOf(valueArg);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return fail('INVALID_DATA', pathArg);
+  }
+  const value = valueArg as Record<string, unknown>;
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== 'string') return fail('INVALID_DATA', pathArg);
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+      return fail('INVALID_DATA', pathArg);
+    }
+  }
+  return value;
+};
+
+const readArray = (
+  valueArg: unknown,
+  pathArg: string,
+  maximumLengthArg: number,
+): unknown[] => {
+  if (!Array.isArray(valueArg) || Object.getPrototypeOf(valueArg) !== Array.prototype
+    || valueArg.length > maximumLengthArg) {
+    return fail(
+      Array.isArray(valueArg) ? 'LIMIT_EXCEEDED' : 'INVALID_DATA',
+      pathArg,
+    );
+  }
+  for (let index = 0; index < valueArg.length; index++) {
+    if (!Object.hasOwn(valueArg, index)) return fail('INVALID_DATA', `${pathArg}[${index}]`);
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+      return fail('INVALID_DATA', `${pathArg}[${index}]`);
+    }
+  }
+  for (const key of Reflect.ownKeys(valueArg)) {
+    if (key === 'length') continue;
+    if (typeof key !== 'string'
+      || !/^(?:0|[1-9][0-9]*)$/.test(key)
+      || Number(key) >= valueArg.length) {
+      return fail('INVALID_DATA', pathArg);
+    }
+  }
+  return valueArg;
+};
+
+const assertExactKeys = (
+  valueArg: Record<string, unknown>,
+  keysArg: readonly string[],
+  pathArg: string,
+): void => {
+  const actual = Object.keys(valueArg).sort();
+  const expected = [...keysArg].sort();
+  if (actual.length !== expected.length
+    || actual.some((keyArg, indexArg) => keyArg !== expected[indexArg])) {
+    fail('INVALID_SCHEMA', pathArg);
+  }
+};
+
+const readIdentifier = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !identifierPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readSha256 = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !sha256Pattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readStateHmac = (
+  valueArg: unknown,
+  pathArg: string,
+): `hmac-sha256:${string}` => {
+  if (typeof valueArg !== 'string' || !stateHmacPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg as `hmac-sha256:${string}`;
+};
+
+const readMac = (valueArg: unknown, pathArg: string): string => {
+  if (typeof valueArg !== 'string' || !macPattern.test(valueArg)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  const bytes = Buffer.from(valueArg, 'base64url');
+  if (bytes.byteLength !== 32 || bytes.toString('base64url') !== valueArg) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readInteger = (
+  valueArg: unknown,
+  pathArg: string,
+  minimumArg = 0,
+  maximumArg = Number.MAX_SAFE_INTEGER,
+): number => {
+  if (typeof valueArg !== 'number'
+    || !Number.isSafeInteger(valueArg)
+    || Object.is(valueArg, -0)
+    || valueArg < minimumArg
+    || valueArg > maximumArg) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg;
+};
+
+const readLiteral = <TLiteral extends string>(
+  valueArg: unknown,
+  literalsArg: readonly TLiteral[],
+  pathArg: string,
+): TLiteral => {
+  if (typeof valueArg !== 'string' || !literalsArg.includes(valueArg as TLiteral)) {
+    return fail('INVALID_VALUE', pathArg);
+  }
+  return valueArg as TLiteral;
+};
+
+const canonicalize = (valueArg: unknown, pathArg: string): string => canonicalizeStrictJson(
+  valueArg,
+  () => fail('INVALID_DATA', pathArg),
+  pathArg,
+);
+
+const finalize = <T>(
+  valueArg: T,
+  maximumBytesArg: number,
+  pathArg: string,
+): Readonly<T> => {
+  const canonical = canonicalize(valueArg, pathArg);
+  if (Buffer.byteLength(canonical, 'utf8') > maximumBytesArg) {
+    return fail('LIMIT_EXCEEDED', pathArg);
+  }
+  return deepFreezeValue(valueArg);
+};
+
+const encodeNormalized = (valueArg: unknown, pathArg: string): Uint8Array => (
+  Buffer.from(canonicalize(valueArg, pathArg), 'utf8')
+);
+
+const digestBytes = (valueArg: Uint8Array): string => plugins.crypto
+  .createHash('sha256')
+  .update(new Uint8Array(valueArg))
+  .digest('hex');
+
+const frame = (domainArg: string, payloadArg: Uint8Array): Uint8Array => {
+  const domain = Buffer.from(domainArg, 'utf8');
+  const output = new Uint8Array(domain.byteLength + payloadArg.byteLength);
+  output.set(domain, 0);
+  output.set(payloadArg, domain.byteLength);
+  return output;
+};
+
+const canonicalEqual = (leftArg: unknown, rightArg: unknown, pathArg: string): boolean => (
+  canonicalize(leftArg, `${pathArg}.left`) === canonicalize(rightArg, `${pathArg}.right`)
+);
+
+const normalizeFileIdentityInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, fileIdentityKeys, pathArg);
+  if (value.format !== 'smartdb.database.export.v1'
+    || value.lineFeedTerminator !== 'single-lf') {
+    fail('INVALID_VALUE', `${pathArg}.format`);
+  }
+  return {
+    format: 'smartdb.database.export.v1',
+    databaseName: readIdentifier(value.databaseName, `${pathArg}.databaseName`),
+    byteLength: readInteger(
+      value.byteLength,
+      `${pathArg}.byteLength`,
+      1,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumExactExportBytes,
+    ),
+    sha256: readSha256(value.sha256, `${pathArg}.sha256`),
+    lineFeedTerminator: 'single-lf',
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1> => finalize(
+  normalizeFileIdentityInternal(valueArg, 'offlineExportFileIdentity'),
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportFileIdentity',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity(valueArg),
+  'offlineExportFileIdentity',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity(valueArg),
+);
+
+const normalizeApprovedSourceBackupInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, approvedSourceBackupKeys, pathArg);
+  return {
+    backupId: readIdentifier(value.backupId, `${pathArg}.backupId`),
+    sourceServiceId: readIdentifier(value.sourceServiceId, `${pathArg}.sourceServiceId`),
+    snapshotId: readIdentifier(value.snapshotId, `${pathArg}.snapshotId`),
+    backupReceiptSha256: readSha256(
+      value.backupReceiptSha256,
+      `${pathArg}.backupReceiptSha256`,
+    ),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentity = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1
+> => finalize(
+  normalizeApprovedSourceBackupInternal(valueArg, 'approvedSourceBackup'),
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'approvedSourceBackup',
+);
+
+const normalizeClassificationCounts = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, classificationKeys, pathArg);
+  return {
+    'image-recorded-not-current': readInteger(
+      value['image-recorded-not-current'],
+      `${pathArg}.image-recorded-not-current`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+    ),
+    'image-recorded-current-failed': readInteger(
+      value['image-recorded-current-failed'],
+      `${pathArg}.image-recorded-current-failed`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+    ),
+    'rolling-out-current-failed': readInteger(
+      value['rolling-out-current-failed'],
+      `${pathArg}.rolling-out-current-failed`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+    ),
+    'rolling-out-superseded': readInteger(
+      value['rolling-out-superseded'],
+      `${pathArg}.rolling-out-superseded`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+    ),
+  };
+};
+
+const sumClassificationCounts = (
+  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1,
+): number => classificationKeys.reduce((sumArg, keyArg) => sumArg + valueArg[keyArg], 0);
+
+const normalizeSourceCensus = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, censusKeys, pathArg);
+  const output = Object.fromEntries(censusKeys.map((keyArg) => [
+    keyArg,
+    readInteger(
+      value[keyArg],
+      `${pathArg}.${keyArg}`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumSourceDocuments,
+    ),
+  ])) as unknown as ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1;
+  if (censusKeys.reduce((sumArg, keyArg) => sumArg + output[keyArg], 0)
+    > cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumSourceDocuments) {
+    fail('LIMIT_EXCEEDED', pathArg);
+  }
+  return output;
+};
+
+const normalizeMutationCounts = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, mutationCountKeys, pathArg);
+  const counts = {
+    operationCount: readInteger(
+      value.operationCount,
+      `${pathArg}.operationCount`,
+      0,
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+    ),
+    routeClaimsStabilized: readInteger(
+      value.routeClaimsStabilized,
+      `${pathArg}.routeClaimsStabilized`,
+    ),
+    routeClaimsRemoved: readInteger(
+      value.routeClaimsRemoved,
+      `${pathArg}.routeClaimsRemoved`,
+    ),
+    resourceClaimsRemoved: readInteger(
+      value.resourceClaimsRemoved,
+      `${pathArg}.resourceClaimsRemoved`,
+    ),
+  };
+  if (counts.operationCount === 0
+    && mutationCountKeys.some((keyArg) => counts[keyArg] !== 0)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+  return counts;
+};
+
+const hasNoMutations = (
+  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1,
+): boolean => mutationCountKeys.every((keyArg) => valueArg[keyArg] === 0);
+
+const assertCountsMatchClassifications = (
+  countsArg: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1,
+  classificationCountsArg:
+    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1,
+  pathArg: string,
+): void => {
+  if (countsArg.operationCount !== sumClassificationCounts(classificationCountsArg)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const normalizePlanEntry = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, planEntryKeys, pathArg);
+  const sourceRevision = readInteger(value.sourceRevision, `${pathArg}.sourceRevision`);
+  const finalRevision = readInteger(value.finalRevision, `${pathArg}.finalRevision`);
+  if (!Number.isSafeInteger(sourceRevision + 3) || finalRevision !== sourceRevision + 3) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.finalRevision`);
+  }
+  const sourceState = readLiteral(
+    value.sourceState,
+    ['image-recorded', 'rolling-out'],
+    `${pathArg}.sourceState`,
+  );
+  const classification = readLiteral(
+    value.classification,
+    classificationKeys,
+    `${pathArg}.classification`,
+  );
+  if ((classification.startsWith('image-recorded-') && sourceState !== 'image-recorded')
+    || (classification.startsWith('rolling-out-') && sourceState !== 'rolling-out')) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.classification`);
+  }
+  return {
+    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
+    serviceId: readIdentifier(value.serviceId, `${pathArg}.serviceId`),
+    sourceRevision,
+    sourceState,
+    classification,
+    finalRevision,
+    sourceDocumentHmac: readStateHmac(
+      value.sourceDocumentHmac,
+      `${pathArg}.sourceDocumentHmac`,
+    ),
+    finalDocumentHmac: readStateHmac(
+      value.finalDocumentHmac,
+      `${pathArg}.finalDocumentHmac`,
+    ),
+    routeClaimsStabilized: readInteger(
+      value.routeClaimsStabilized,
+      `${pathArg}.routeClaimsStabilized`,
+    ),
+    routeClaimsRemoved: readInteger(
+      value.routeClaimsRemoved,
+      `${pathArg}.routeClaimsRemoved`,
+    ),
+    resourceClaimsRemoved: readInteger(
+      value.resourceClaimsRemoved,
+      `${pathArg}.resourceClaimsRemoved`,
+    ),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1> => {
+  const value = readRecord(valueArg, 'offlineExportPlan');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'operationId',
+    'settlementId',
+    'sourceFile',
+    'effectiveAt',
+    'sourceStateHmac',
+    'finalStateHmac',
+    'sourceCensus',
+    'entries',
+    'counts',
+    'classificationCounts',
+  ], 'offlineExportPlan');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-offline-export-plan') {
+    fail('INVALID_VALUE', 'offlineExportPlan.kind');
+  }
+  const entries = readArray(
+    value.entries,
+    'offlineExportPlan.entries',
+    cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
+  ).map((entryArg, indexArg) => normalizePlanEntry(
+    entryArg,
+    `offlineExportPlan.entries[${indexArg}]`,
+  ));
+  for (let index = 1; index < entries.length; index++) {
+    if (entries[index - 1].operationId >= entries[index].operationId) {
+      fail('ORDERING_REQUIRED', `offlineExportPlan.entries[${index}].operationId`);
+    }
+  }
+  const counts = normalizeMutationCounts(value.counts, 'offlineExportPlan.counts');
+  const classificationCounts = normalizeClassificationCounts(
+    value.classificationCounts,
+    'offlineExportPlan.classificationCounts',
+  );
+  const sourceStateHmac = readStateHmac(
+    value.sourceStateHmac,
+    'offlineExportPlan.sourceStateHmac',
+  );
+  const finalStateHmac = readStateHmac(
+    value.finalStateHmac,
+    'offlineExportPlan.finalStateHmac',
+  );
+  const expectedCounts = {
+    operationCount: entries.length,
+    routeClaimsStabilized: entries.reduce(
+      (sumArg, entryArg) => sumArg + entryArg.routeClaimsStabilized,
+      0,
+    ),
+    routeClaimsRemoved: entries.reduce(
+      (sumArg, entryArg) => sumArg + entryArg.routeClaimsRemoved,
+      0,
+    ),
+    resourceClaimsRemoved: entries.reduce(
+      (sumArg, entryArg) => sumArg + entryArg.resourceClaimsRemoved,
+      0,
+    ),
+  };
+  const actualClassifications = Object.fromEntries(classificationKeys.map((keyArg) => [
+    keyArg,
+    entries.filter((entryArg) => entryArg.classification === keyArg).length,
+  ]));
+  if (!Object.values(expectedCounts).every((valueArg) => Number.isSafeInteger(valueArg))
+    || !canonicalEqual(counts, expectedCounts, 'offlineExportPlan.counts')
+    || classificationKeys.some((keyArg) => (
+      classificationCounts[keyArg] !== actualClassifications[keyArg]
+    ))
+    || (entries.length === 0) !== (sourceStateHmac === finalStateHmac)) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportPlan.counts');
+  }
+  assertCountsMatchClassifications(
+    counts,
+    classificationCounts,
+    'offlineExportPlan.classificationCounts',
+  );
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-plan',
+    operationId: readIdentifier(value.operationId, 'offlineExportPlan.operationId'),
+    settlementId: readIdentifier(value.settlementId, 'offlineExportPlan.settlementId'),
+    sourceFile: normalizeFileIdentityInternal(value.sourceFile, 'offlineExportPlan.sourceFile'),
+    effectiveAt: readInteger(value.effectiveAt, 'offlineExportPlan.effectiveAt', 1),
+    sourceStateHmac,
+    finalStateHmac,
+    sourceCensus: normalizeSourceCensus(
+      value.sourceCensus,
+      'offlineExportPlan.sourceCensus',
+    ),
+    entries,
+    counts,
+    classificationCounts,
+  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1,
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumPlanBytes,
+  'offlineExportPlan');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan(valueArg),
+  'offlineExportPlan',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementOfflineExportPlan(valueArg));
+
+const normalizeAuthorityReferenceInternal = <
+  TRole extends TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1['role'],
+>(
+  valueArg: unknown,
+  pathArg: string,
+  roleArg: TRole,
+): Extract<
+  TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
+  { role: TRole }
+> => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authorityReferenceKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-authority-reference'
+    || value.role !== roleArg
+    || value.keyVersion !== 1) {
+    fail('INVALID_VALUE', `${pathArg}.role`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
+    role: roleArg,
+    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
+    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
+    authorityId: readIdentifier(value.authorityId, `${pathArg}.authorityId`),
+    keyId: readIdentifier(value.keyId, `${pathArg}.keyId`),
+    keyVersion: 1,
+    authorityMetadataSha256: readSha256(
+      value.authorityMetadataSha256,
+      `${pathArg}.authorityMetadataSha256`,
+    ),
+  } as Extract<
+    TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
+    { role: TRole }
+  >;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
+> => finalize(
+  normalizeAuthorityReferenceInternal(valueArg, 'offlineExportSourceAuthorityReference', 'source-rehearsal'),
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportSourceAuthorityReference',
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
+> => finalize(
+  normalizeAuthorityReferenceInternal(
+    valueArg,
+    'offlineExportProductionTransformAuthorityReference',
+    'production-transform',
+  ),
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportProductionTransformAuthorityReference',
+);
+
+const normalizeAuthorityWindow = (
+  valueArg: Record<string, unknown>,
+  pathArg: string,
+): { issuedAt: number; expiresAt: number } => {
+  const issuedAt = readInteger(valueArg.issuedAt, `${pathArg}.issuedAt`, 1);
+  const expiresAt = readInteger(valueArg.expiresAt, `${pathArg}.expiresAt`, 1);
+  if (expiresAt <= issuedAt
+    || expiresAt - issuedAt
+      > cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityLifetimeMs) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.expiresAt`);
+  }
+  return { issuedAt, expiresAt };
+};
+
+const assertTimestampWithinAuthority = (
+  timestampArg: number,
+  authorityArg: { issuedAt: number; expiresAt: number },
+  pathArg: string,
+): void => {
+  if (timestampArg < authorityArg.issuedAt || timestampArg >= authorityArg.expiresAt) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1> => {
+  const value = readRecord(valueArg, 'offlineExportSourceAuthority');
+  assertExactKeys(value, sourceAuthorityKeys, 'offlineExportSourceAuthority');
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-source-authority'
+    || value.role !== 'source-rehearsal'
+    || value.keyVersion !== 1) {
+    fail('INVALID_VALUE', 'offlineExportSourceAuthority.kind');
+  }
+  const window = normalizeAuthorityWindow(value, 'offlineExportSourceAuthority');
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-source-authority',
+    role: 'source-rehearsal',
+    operationId: readIdentifier(value.operationId, 'offlineExportSourceAuthority.operationId'),
+    settlementId: readIdentifier(value.settlementId, 'offlineExportSourceAuthority.settlementId'),
+    authorityId: readIdentifier(value.authorityId, 'offlineExportSourceAuthority.authorityId'),
+    keyId: readIdentifier(value.keyId, 'offlineExportSourceAuthority.keyId'),
+    keyVersion: 1,
+    ...window,
+    sourceFile: normalizeFileIdentityInternal(
+      value.sourceFile,
+      'offlineExportSourceAuthority.sourceFile',
+    ),
+    approvedSourceBackup: normalizeApprovedSourceBackupInternal(
+      value.approvedSourceBackup,
+      'offlineExportSourceAuthority.approvedSourceBackup',
+    ),
+    planSha256: readSha256(value.planSha256, 'offlineExportSourceAuthority.planSha256'),
+    rehearsalRequestSha256: readSha256(
+      value.rehearsalRequestSha256,
+      'offlineExportSourceAuthority.rehearsalRequestSha256',
+    ),
+  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1,
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportSourceAuthority');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(valueArg),
+  'offlineExportSourceAuthority',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(valueArg),
+);
+
+export const createCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference = (
+  authorityArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
+> => {
+  const authority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
+    authorityArg,
+  );
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
+    role: 'source-rehearsal',
+    operationId: authority.operationId,
+    settlementId: authority.settlementId,
+    authorityId: authority.authorityId,
+    keyId: authority.keyId,
+    keyVersion: 1,
+    authorityMetadataSha256:
+      digestCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(authority),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportSourceAuthorityReference');
+};
+
+const assertSourceReferenceMatchesAuthority = (
+  referenceArg: unknown,
+  authorityArg: unknown,
+  pathArg: string,
+): void => {
+  const reference = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference(
+    referenceArg,
+  );
+  const expected = createCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference(
+    authorityArg,
+  );
+  if (!canonicalEqual(reference, expected, pathArg)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const normalizeRehearsalPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, rehearsalPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+    'source-rehearsal',
+  );
+  const plan = normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan(value.plan);
+  const planSha256 = readSha256(value.planSha256, `${pathArg}.planSha256`);
+  const outcome = readLiteral(
+    value.outcome,
+    ['transform-required', 'no-op'],
+    `${pathArg}.outcome`,
+  );
+  const observedCounts = normalizeMutationCounts(
+    value.observedCounts,
+    `${pathArg}.observedCounts`,
+  );
+  const observedClassificationCounts = normalizeClassificationCounts(
+    value.observedClassificationCounts,
+    `${pathArg}.observedClassificationCounts`,
+  );
+  if (sourceAuthority.operationId !== plan.operationId
+    || sourceAuthority.settlementId !== plan.settlementId
+    || planSha256 !== digestCloudlyLegacyDeploymentSettlementOfflineExportPlan(plan)
+    || value.observedFinalStateHmac !== plan.finalStateHmac
+    || !canonicalEqual(observedCounts, plan.counts, `${pathArg}.observedCounts`)
+    || !canonicalEqual(
+      observedClassificationCounts,
+      plan.classificationCounts,
+      `${pathArg}.observedClassificationCounts`,
+    )
+    || (outcome === 'no-op') !== hasNoMutations(plan.counts)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.plan`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation',
+    sourceAuthority,
+    plan: plan as ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1,
+    planSha256,
+    rehearsalRequestSha256: readSha256(
+      value.rehearsalRequestSha256,
+      `${pathArg}.rehearsalRequestSha256`,
+    ),
+    scratchAllocation: normalizeScratchAllocation(
+      value.scratchAllocation,
+      `${pathArg}.scratchAllocation`,
+    ),
+    outcome,
+    observedFinalStateHmac: readStateHmac(
+      value.observedFinalStateHmac,
+      `${pathArg}.observedFinalStateHmac`,
+    ),
+    observedCounts,
+    observedClassificationCounts,
+    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
+  };
+};
+
+const rehearsalPayload = (
+  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1,
+): unknown => Object.fromEntries(rehearsalPayloadKeys.map((keyArg) => [
+  keyArg,
+  valueArg[keyArg],
+]));
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayload = (
+  valueArg: unknown,
+): string => digestBytes(encodeNormalized(
+  rehearsalPayload(normalizeRehearsalPayloadInternal(
+    valueArg,
+    'offlineExportRehearsalAttestationPayload',
+  )),
+  'offlineExportRehearsalAttestationPayload',
+));
+
+const normalizeUnsignedRehearsalInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedRehearsalAttestationV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, rehearsalUnsignedKeys, pathArg);
+  const payload = normalizeRehearsalPayloadInternal(
+    Object.fromEntries(rehearsalPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
+    `${pathArg}.payload`,
+  );
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256
+    !== digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayload(
+      payload,
+    )) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
+> => {
+  const value = readRecord(valueArg, 'offlineExportRehearsalAttestation');
+  assertExactKeys(value, rehearsalKeys, 'offlineExportRehearsalAttestation');
+  return finalize({
+    ...normalizeUnsignedRehearsalInternal(
+      Object.fromEntries(rehearsalUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
+      'offlineExportRehearsalAttestation.unsigned',
+    ),
+    mac: readMac(value.mac, 'offlineExportRehearsalAttestation.mac'),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
+  'offlineExportRehearsalAttestation');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(valueArg),
+  'offlineExportRehearsalAttestation',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(valueArg),
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementOfflineExportDomains.rehearsalAttestationHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedRehearsalInternal(
+        valueArg,
+        'offlineExportUnsignedRehearsalAttestation',
+      ),
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
+      'offlineExportUnsignedRehearsalAttestation',
+    ),
+    'offlineExportUnsignedRehearsalAttestation',
+  ),
+);
+
+const requireVerifiedHmac = async (
+  authorityArg: TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
+  domainArg: ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1['domain'],
+  hmacInputArg: Uint8Array,
+  macArg: string,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+  pathArg: string,
+): Promise<void> => {
+  let verified = false;
+  try {
+    verified = await verifierArg({
+      authority: authorityArg,
+      domain: domainArg,
+      hmacInput: new Uint8Array(hmacInputArg),
+      mac: macArg,
+    });
+  } catch {
+    verified = false;
+  }
+  if (!verified) fail('INVALID_VALUE', pathArg);
+};
+
+const withoutMac = <TValue extends { mac: string }>(
+  valueArg: TValue,
+): Omit<TValue, 'mac'> => {
+  const { mac: _mac, ...unsigned } = valueArg;
+  return unsigned;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority = async (
+  attestationArg: unknown,
+  sourceAuthorityArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
+>> => {
+  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
+    sourceAuthorityArg,
+  );
+  const attestation =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(
+      attestationArg,
+    );
+  assertSourceReferenceMatchesAuthority(
+    attestation.sourceAuthority,
+    sourceAuthority,
+    'offlineExportRehearsalAttestation.sourceAuthority',
+  );
+  if (attestation.planSha256 !== sourceAuthority.planSha256
+    || attestation.rehearsalRequestSha256 !== sourceAuthority.rehearsalRequestSha256
+    || !canonicalEqual(
+      attestation.plan.sourceFile,
+      sourceAuthority.sourceFile,
+      'offlineExportRehearsalAttestation.plan.sourceFile',
+    )
+    || attestation.plan.operationId !== sourceAuthority.operationId
+    || attestation.plan.settlementId !== sourceAuthority.settlementId) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportRehearsalAttestation.sourceProof');
+  }
+  assertTimestampWithinAuthority(
+    attestation.plan.effectiveAt,
+    sourceAuthority,
+    'offlineExportRehearsalAttestation.plan.effectiveAt',
+  );
+  assertTimestampWithinAuthority(
+    attestation.completedAt,
+    sourceAuthority,
+    'offlineExportRehearsalAttestation.completedAt',
+  );
+  if (attestation.completedAt < attestation.plan.effectiveAt) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportRehearsalAttestation.completedAt');
+  }
+  await requireVerifiedHmac(
+    attestation.sourceAuthority,
+    cloudlyLegacyDeploymentSettlementOfflineExportDomains.rehearsalAttestationHmac,
+    encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationHmacInput(
+      withoutMac(attestation),
+    ),
+    attestation.mac,
+    verifierArg,
+    'offlineExportRehearsalAttestation.mac',
+  );
+  return attestation;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1
+> => {
+  const value = readRecord(valueArg, 'offlineExportProductionTransformAuthority');
+  assertExactKeys(
+    value,
+    productionTransformAuthorityKeys,
+    'offlineExportProductionTransformAuthority',
+  );
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority'
+    || value.role !== 'production-transform'
+    || value.keyVersion !== 1) {
+    fail('INVALID_VALUE', 'offlineExportProductionTransformAuthority.kind');
+  }
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    'offlineExportProductionTransformAuthority.sourceAuthority',
+    'source-rehearsal',
+  );
+  const operationId = readIdentifier(
+    value.operationId,
+    'offlineExportProductionTransformAuthority.operationId',
+  );
+  const settlementId = readIdentifier(
+    value.settlementId,
+    'offlineExportProductionTransformAuthority.settlementId',
+  );
+  const authorityId = readIdentifier(
+    value.authorityId,
+    'offlineExportProductionTransformAuthority.authorityId',
+  );
+  const keyId = readIdentifier(
+    value.keyId,
+    'offlineExportProductionTransformAuthority.keyId',
+  );
+  if (operationId !== sourceAuthority.operationId
+    || settlementId !== sourceAuthority.settlementId
+    || authorityId === sourceAuthority.authorityId
+    || keyId === sourceAuthority.keyId) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthority.sourceAuthority');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority',
+    role: 'production-transform',
+    operationId,
+    settlementId,
+    authorityId,
+    keyId,
+    keyVersion: 1,
+    ...normalizeAuthorityWindow(value, 'offlineExportProductionTransformAuthority'),
+    sourceAuthority,
+    authenticatedRehearsalAttestationSha256: readSha256(
+      value.authenticatedRehearsalAttestationSha256,
+      'offlineExportProductionTransformAuthority.authenticatedRehearsalAttestationSha256',
+    ),
+  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1,
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportProductionTransformAuthority');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(valueArg),
+  'offlineExportProductionTransformAuthority',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(valueArg),
+);
+
+export const createCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference = (
+  authorityArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
+> => {
+  const authority =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
+      authorityArg,
+    );
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
+    role: 'production-transform',
+    operationId: authority.operationId,
+    settlementId: authority.settlementId,
+    authorityId: authority.authorityId,
+    keyId: authority.keyId,
+    keyVersion: 1,
+    authorityMetadataSha256:
+      digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
+        authority,
+      ),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
+  'offlineExportProductionTransformAuthorityReference');
+};
+
+const assertProductionReferenceMatchesAuthority = (
+  referenceArg: unknown,
+  authorityArg: unknown,
+  pathArg: string,
+): void => {
+  const reference =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference(
+      referenceArg,
+    );
+  const expected =
+    createCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference(
+      authorityArg,
+    );
+  if (!canonicalEqual(reference, expected, pathArg)) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityForRehearsal = async (
+  productionAuthorityArg: unknown,
+  sourceAuthorityArg: unknown,
+  rehearsalAttestationArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1
+>> => {
+  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
+    sourceAuthorityArg,
+  );
+  const rehearsal =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority(
+      rehearsalAttestationArg,
+      sourceAuthority,
+      verifierArg,
+    );
+  const productionAuthority =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
+      productionAuthorityArg,
+    );
+  assertSourceReferenceMatchesAuthority(
+    productionAuthority.sourceAuthority,
+    sourceAuthority,
+    'offlineExportProductionTransformAuthority.sourceAuthority',
+  );
+  if (productionAuthority.authenticatedRehearsalAttestationSha256
+      !== digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(rehearsal)
+    || productionAuthority.issuedAt <= rehearsal.completedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthority.rehearsal');
+  }
+  return productionAuthority;
+};
+
+const normalizeAuthorizationPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authorizationPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(
+    value.authority,
+    `${pathArg}.authority`,
+    'production-transform',
+  );
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+    'source-rehearsal',
+  );
+  const requestedAt = readInteger(value.requestedAt, `${pathArg}.requestedAt`, 1);
+  const authorizedAt = readInteger(value.authorizedAt, `${pathArg}.authorizedAt`, requestedAt);
+  if (authority.operationId !== sourceAuthority.operationId
+    || authority.settlementId !== sourceAuthority.settlementId
+    || authority.authorityId === sourceAuthority.authorityId
+    || authority.keyId === sourceAuthority.keyId
+    || canonicalEqual(authority, sourceAuthority, `${pathArg}.authorities`)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.authority`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization',
+    authority,
+    sourceAuthority,
+    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
+    authenticatedRehearsalAttestationSha256: readSha256(
+      value.authenticatedRehearsalAttestationSha256,
+      `${pathArg}.authenticatedRehearsalAttestationSha256`,
+    ),
+    planSha256: readSha256(value.planSha256, `${pathArg}.planSha256`),
+    requestSha256: readSha256(value.requestSha256, `${pathArg}.requestSha256`),
+    requestedAt,
+    authorizedAt,
+  };
+};
+
+const authorizationPayload = (
+  valueArg:
+    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1,
+): unknown => Object.fromEntries(authorizationPayloadKeys.map((keyArg) => [
+  keyArg,
+  valueArg[keyArg],
+]));
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayload = (
+  valueArg: unknown,
+): string => digestBytes(encodeNormalized(
+  authorizationPayload(normalizeAuthorizationPayloadInternal(
+    valueArg,
+    'offlineExportProductionTransformAuthorizationPayload',
+  )),
+  'offlineExportProductionTransformAuthorizationPayload',
+));
+
+const normalizeUnsignedAuthorizationInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedProductionTransformAuthorizationV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, authorizationUnsignedKeys, pathArg);
+  const payload = normalizeAuthorizationPayloadInternal(
+    Object.fromEntries(authorizationPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
+    `${pathArg}.payload`,
+  );
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256
+    !== digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayload(
+      payload,
+    )) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
+> => {
+  const value = readRecord(valueArg, 'offlineExportProductionTransformAuthorization');
+  assertExactKeys(value, authorizationKeys, 'offlineExportProductionTransformAuthorization');
+  return finalize({
+    ...normalizeUnsignedAuthorizationInternal(
+      Object.fromEntries(authorizationUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
+      'offlineExportProductionTransformAuthorization.unsigned',
+    ),
+    mac: readMac(value.mac, 'offlineExportProductionTransformAuthorization.mac'),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
+  'offlineExportProductionTransformAuthorization');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
+    valueArg,
+  ),
+  'offlineExportProductionTransformAuthorization',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(valueArg),
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementOfflineExportDomains
+    .productionTransformAuthorizationHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedAuthorizationInternal(
+        valueArg,
+        'offlineExportUnsignedProductionTransformAuthorization',
+      ),
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
+      'offlineExportUnsignedProductionTransformAuthorization',
+    ),
+    'offlineExportUnsignedProductionTransformAuthorization',
+  ),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationForAuthorities = async (
+  authorizationArg: unknown,
+  productionAuthorityArg: unknown,
+  sourceAuthorityArg: unknown,
+  rehearsalAttestationArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
+>> => {
+  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
+    sourceAuthorityArg,
+  );
+  const rehearsal =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority(
+      rehearsalAttestationArg,
+      sourceAuthority,
+      verifierArg,
+    );
+  const productionAuthority =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityForRehearsal(
+      productionAuthorityArg,
+      sourceAuthority,
+      rehearsal,
+      verifierArg,
+    );
+  const authorization =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
+      authorizationArg,
+    );
+  assertProductionReferenceMatchesAuthority(
+    authorization.authority,
+    productionAuthority,
+    'offlineExportProductionTransformAuthorization.authority',
+  );
+  assertSourceReferenceMatchesAuthority(
+    authorization.sourceAuthority,
+    sourceAuthority,
+    'offlineExportProductionTransformAuthorization.sourceAuthority',
+  );
+  if (authorization.authenticatedRehearsalAttestationSha256
+      !== productionAuthority.authenticatedRehearsalAttestationSha256
+    || authorization.planSha256 !== rehearsal.planSha256
+    || authorization.requestedAt < productionAuthority.issuedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthorization.sourceProof');
+  }
+  assertTimestampWithinAuthority(
+    authorization.requestedAt,
+    productionAuthority,
+    'offlineExportProductionTransformAuthorization.requestedAt',
+  );
+  assertTimestampWithinAuthority(
+    authorization.authorizedAt,
+    productionAuthority,
+    'offlineExportProductionTransformAuthorization.authorizedAt',
+  );
+  await requireVerifiedHmac(
+    authorization.authority,
+    cloudlyLegacyDeploymentSettlementOfflineExportDomains
+      .productionTransformAuthorizationHmac,
+    encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationHmacInput(
+      withoutMac(authorization),
+    ),
+    authorization.mac,
+    verifierArg,
+    'offlineExportProductionTransformAuthorization.mac',
+  );
+  return authorization;
+};
+
+const normalizeJournalSeedInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, journalSeedKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName
+    || value.purpose !== 'production-transform') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
+  const settlementId = readIdentifier(value.settlementId, `${pathArg}.settlementId`);
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+    'source-rehearsal',
+  );
+  const productionTransformAuthority = normalizeAuthorityReferenceInternal(
+    value.productionTransformAuthority,
+    `${pathArg}.productionTransformAuthority`,
+    'production-transform',
+  );
+  const sourceFile = normalizeFileIdentityInternal(value.sourceFile, `${pathArg}.sourceFile`);
+  const transformedCoreFile = normalizeFileIdentityInternal(
+    value.transformedCoreFile,
+    `${pathArg}.transformedCoreFile`,
+  );
+  const sourceStateHmac = readStateHmac(
+    value.sourceStateHmac,
+    `${pathArg}.sourceStateHmac`,
+  );
+  const finalStateHmac = readStateHmac(
+    value.finalStateHmac,
+    `${pathArg}.finalStateHmac`,
+  );
+  const outcome = readLiteral(
+    value.outcome,
+    ['transformed', 'no-op'],
+    `${pathArg}.outcome`,
+  );
+  const counts = normalizeMutationCounts(value.counts, `${pathArg}.counts`);
+  const classificationCounts = normalizeClassificationCounts(
+    value.classificationCounts,
+    `${pathArg}.classificationCounts`,
+  );
+  assertCountsMatchClassifications(counts, classificationCounts, `${pathArg}.counts`);
+  if (operationId !== sourceAuthority.operationId
+    || operationId !== productionTransformAuthority.operationId
+    || settlementId !== sourceAuthority.settlementId
+    || settlementId !== productionTransformAuthority.settlementId
+    || sourceAuthority.authorityId === productionTransformAuthority.authorityId
+    || sourceAuthority.keyId === productionTransformAuthority.keyId
+    || sourceFile.databaseName !== transformedCoreFile.databaseName
+    || (outcome === 'no-op') !== hasNoMutations(counts)
+    || (outcome === 'no-op') !== (sourceStateHmac === finalStateHmac)
+    || (outcome === 'no-op') !== canonicalEqual(
+      sourceFile,
+      transformedCoreFile,
+      `${pathArg}.fileIdentity`,
+    )) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.sourceProof`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName,
+    purpose: 'production-transform',
+    operationId,
+    settlementId,
+    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
+    sourceAuthority,
+    productionTransformAuthority,
+    authenticatedRehearsalAttestationSha256: readSha256(
+      value.authenticatedRehearsalAttestationSha256,
+      `${pathArg}.authenticatedRehearsalAttestationSha256`,
+    ),
+    transformAuthorizationSha256: readSha256(
+      value.transformAuthorizationSha256,
+      `${pathArg}.transformAuthorizationSha256`,
+    ),
+    planSha256: readSha256(value.planSha256, `${pathArg}.planSha256`),
+    requestSha256: readSha256(value.requestSha256, `${pathArg}.requestSha256`),
+    sourceFile,
+    transformedCoreFile,
+    sourceStateHmac,
+    finalStateHmac,
+    outcome,
+    counts,
+    classificationCounts,
+    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
+  };
+};
+
+export const createCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalId = (
+  seedArg: unknown,
+): string => {
+  const seed = normalizeJournalSeedInternal(seedArg, 'offlineExportAttemptJournal.seed');
+  return `offline-export-attempt-${digestBytes(encodeNormalized(
+    seed,
+    'offlineExportAttemptJournal.seed',
+  )).slice(0, 40)}`;
+};
+
+const normalizeUnsignedJournalInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedAttemptJournalV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, journalUnsignedKeys, pathArg);
+  const seed = normalizeJournalSeedInternal(
+    Object.fromEntries(journalSeedKeys.map((keyArg) => [keyArg, value[keyArg]])),
+    `${pathArg}.seed`,
+  );
+  const id = readIdentifier(value._id, `${pathArg}._id`);
+  if (id !== createCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalId(seed)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}._id`);
+  }
+  return { _id: id, ...seed };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1> => {
+  const value = readRecord(valueArg, 'offlineExportAttemptJournal');
+  assertExactKeys(value, journalKeys, 'offlineExportAttemptJournal');
+  return finalize({
+    ...normalizeUnsignedJournalInternal(
+      Object.fromEntries(journalUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
+      'offlineExportAttemptJournal.unsigned',
+    ),
+    mac: readMac(value.mac, 'offlineExportAttemptJournal.mac'),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalCanonicalBytes,
+  'offlineExportAttemptJournal');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(valueArg),
+  'offlineExportAttemptJournal',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(valueArg),
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementOfflineExportDomains.attemptJournalHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedJournalInternal(valueArg, 'offlineExportUnsignedAttemptJournal'),
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalCanonicalBytes,
+      'offlineExportUnsignedAttemptJournal',
+    ),
+    'offlineExportUnsignedAttemptJournal',
+  ),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalForAuthorities = async (
+  journalArg: unknown,
+  authorizationArg: unknown,
+  productionAuthorityArg: unknown,
+  sourceAuthorityArg: unknown,
+  rehearsalAttestationArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1>> => {
+  const authorization =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationForAuthorities(
+      authorizationArg,
+      productionAuthorityArg,
+      sourceAuthorityArg,
+      rehearsalAttestationArg,
+      verifierArg,
+    );
+  const productionAuthority =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
+      productionAuthorityArg,
+    );
+  const rehearsal =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(
+      rehearsalAttestationArg,
+    );
+  const journal = normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(
+    journalArg,
+  );
+  if (!canonicalEqual(
+      journal.sourceAuthority,
+      authorization.sourceAuthority,
+      'offlineExportAttemptJournal.sourceAuthority',
+    )
+    || !canonicalEqual(
+      journal.productionTransformAuthority,
+      authorization.authority,
+      'offlineExportAttemptJournal.productionTransformAuthority',
+    )
+    || journal.attemptId !== authorization.attemptId
+    || journal.authenticatedRehearsalAttestationSha256
+      !== authorization.authenticatedRehearsalAttestationSha256
+    || journal.transformAuthorizationSha256
+      !== digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
+        authorization,
+      )
+    || journal.planSha256 !== authorization.planSha256
+    || journal.requestSha256 !== authorization.requestSha256
+    || !canonicalEqual(
+      journal.sourceFile,
+      rehearsal.plan.sourceFile,
+      'offlineExportAttemptJournal.sourceFile',
+    )
+    || journal.sourceStateHmac !== rehearsal.plan.sourceStateHmac
+    || journal.finalStateHmac !== rehearsal.plan.finalStateHmac
+    || !canonicalEqual(journal.counts, rehearsal.plan.counts, 'offlineExportAttemptJournal.counts')
+    || !canonicalEqual(
+      journal.classificationCounts,
+      rehearsal.plan.classificationCounts,
+      'offlineExportAttemptJournal.classificationCounts',
+    )
+    || journal.completedAt < authorization.authorizedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportAttemptJournal.sourceProof');
+  }
+  assertTimestampWithinAuthority(
+    journal.completedAt,
+    productionAuthority,
+    'offlineExportAttemptJournal.completedAt',
+  );
+  await requireVerifiedHmac(
+    journal.productionTransformAuthority,
+    cloudlyLegacyDeploymentSettlementOfflineExportDomains.attemptJournalHmac,
+    encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalHmacInput(
+      withoutMac(journal),
+    ),
+    journal.mac,
+    verifierArg,
+    'offlineExportAttemptJournal.mac',
+  );
+  return journal;
+};
+
+const normalizeCompleteOutputReceiptPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, completeOutputReceiptPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(
+    value.authority,
+    `${pathArg}.authority`,
+    'production-transform',
+  );
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+    'source-rehearsal',
+  );
+  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
+  const settlementId = readIdentifier(value.settlementId, `${pathArg}.settlementId`);
+  const transformedCoreFile = normalizeFileIdentityInternal(
+    value.transformedCoreFile,
+    `${pathArg}.transformedCoreFile`,
+  );
+  const completeOutputFile = normalizeFileIdentityInternal(
+    value.completeOutputFile,
+    `${pathArg}.completeOutputFile`,
+  );
+  const journalGrowthBytes = readInteger(
+    value.journalGrowthBytes,
+    `${pathArg}.journalGrowthBytes`,
+    1,
+    cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalGrowthBytes,
+  );
+  if (operationId !== authority.operationId
+    || operationId !== sourceAuthority.operationId
+    || settlementId !== authority.settlementId
+    || settlementId !== sourceAuthority.settlementId
+    || authority.authorityId === sourceAuthority.authorityId
+    || authority.keyId === sourceAuthority.keyId
+    || transformedCoreFile.databaseName !== completeOutputFile.databaseName
+    || completeOutputFile.byteLength - transformedCoreFile.byteLength !== journalGrowthBytes) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.completeOutputFile`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt',
+    authority,
+    sourceAuthority,
+    operationId,
+    settlementId,
+    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
+    journalSha256: readSha256(value.journalSha256, `${pathArg}.journalSha256`),
+    transformedCoreFile,
+    completeOutputFile,
+    journalGrowthBytes,
+    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
+  };
+};
+
+const completeOutputReceiptPayload = (
+  valueArg:
+    ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1,
+): unknown => Object.fromEntries(completeOutputReceiptPayloadKeys.map((keyArg) => [
+  keyArg,
+  valueArg[keyArg],
+]));
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayload = (
+  valueArg: unknown,
+): string => digestBytes(encodeNormalized(
+  completeOutputReceiptPayload(normalizeCompleteOutputReceiptPayloadInternal(
+    valueArg,
+    'offlineExportCompleteOutputReceiptPayload',
+  )),
+  'offlineExportCompleteOutputReceiptPayload',
+));
+
+const normalizeUnsignedCompleteOutputReceiptInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedCompleteOutputReceiptV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, completeOutputReceiptUnsignedKeys, pathArg);
+  const payload = normalizeCompleteOutputReceiptPayloadInternal(
+    Object.fromEntries(completeOutputReceiptPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
+    `${pathArg}.payload`,
+  );
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256
+    !== digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayload(
+      payload,
+    )) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
+  valueArg: unknown,
+): Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
+> => {
+  const value = readRecord(valueArg, 'offlineExportCompleteOutputReceipt');
+  assertExactKeys(value, completeOutputReceiptKeys, 'offlineExportCompleteOutputReceipt');
+  return finalize({
+    ...normalizeUnsignedCompleteOutputReceiptInternal(
+      Object.fromEntries(completeOutputReceiptUnsignedKeys.map((keyArg) => [
+        keyArg,
+        value[keyArg],
+      ])),
+      'offlineExportCompleteOutputReceipt.unsigned',
+    ),
+    mac: readMac(value.mac, 'offlineExportCompleteOutputReceipt.mac'),
+  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumReceiptBytes,
+  'offlineExportCompleteOutputReceipt');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(valueArg),
+  'offlineExportCompleteOutputReceipt',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(valueArg),
+);
+
+const assertCompleteOutputReceiptMatchesJournal = (
+  receiptArg: Readonly<
+    ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
+  >,
+  journalArg: Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1>,
+  pathArg: string,
+): void => {
+  if (!canonicalEqual(receiptArg.authority, journalArg.productionTransformAuthority, pathArg)
+    || !canonicalEqual(receiptArg.sourceAuthority, journalArg.sourceAuthority, pathArg)
+    || receiptArg.operationId !== journalArg.operationId
+    || receiptArg.settlementId !== journalArg.settlementId
+    || receiptArg.attemptId !== journalArg.attemptId
+    || receiptArg.journalSha256
+      !== digestCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg)
+    || !canonicalEqual(receiptArg.transformedCoreFile, journalArg.transformedCoreFile, pathArg)
+    || receiptArg.journalGrowthBytes
+      < encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg).byteLength
+    || receiptArg.completedAt < journalArg.completedAt) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementOfflineExportDomains.completeOutputReceiptHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedCompleteOutputReceiptInternal(
+        valueArg,
+        'offlineExportUnsignedCompleteOutputReceipt',
+      ),
+      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumReceiptBytes,
+      'offlineExportUnsignedCompleteOutputReceipt',
+    ),
+    'offlineExportUnsignedCompleteOutputReceipt',
+  ),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptForAuthorities = async (
+  receiptArg: unknown,
+  journalArg: unknown,
+  authorizationArg: unknown,
+  productionAuthorityArg: unknown,
+  sourceAuthorityArg: unknown,
+  rehearsalAttestationArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
+>> => {
+  const journal =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalForAuthorities(
+      journalArg,
+      authorizationArg,
+      productionAuthorityArg,
+      sourceAuthorityArg,
+      rehearsalAttestationArg,
+      verifierArg,
+    );
+  const productionAuthority =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
+      productionAuthorityArg,
+    );
+  const receipt =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receiptArg);
+  assertCompleteOutputReceiptMatchesJournal(
+    receipt,
+    journal,
+    'offlineExportCompleteOutputReceipt.sourceProof',
+  );
+  assertTimestampWithinAuthority(
+    receipt.completedAt,
+    productionAuthority,
+    'offlineExportCompleteOutputReceipt.completedAt',
+  );
+  await requireVerifiedHmac(
+    receipt.authority,
+    cloudlyLegacyDeploymentSettlementOfflineExportDomains.completeOutputReceiptHmac,
+    encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptHmacInput(
+      withoutMac(receipt),
+    ),
+    receipt.mac,
+    verifierArg,
+    'offlineExportCompleteOutputReceipt.mac',
+  );
+  return receipt;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1> => {
+  const value = readRecord(valueArg, 'offlineExportTransformResult');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'status',
+    'operationId',
+    'settlementId',
+    'attemptId',
+    'sourceAuthority',
+    'productionTransformAuthority',
+    'planSha256',
+    'requestSha256',
+    'completeOutputReceiptSha256',
+    'outcome',
+    'counts',
+    'classificationCounts',
+    'completedAt',
+  ], 'offlineExportTransformResult');
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-offline-export-transform-result'
+    || value.status !== 'completed') {
+    fail('INVALID_VALUE', 'offlineExportTransformResult.kind');
+  }
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    'offlineExportTransformResult.sourceAuthority',
+    'source-rehearsal',
+  );
+  const productionTransformAuthority = normalizeAuthorityReferenceInternal(
+    value.productionTransformAuthority,
+    'offlineExportTransformResult.productionTransformAuthority',
+    'production-transform',
+  );
+  const operationId = readIdentifier(value.operationId, 'offlineExportTransformResult.operationId');
+  const settlementId = readIdentifier(
+    value.settlementId,
+    'offlineExportTransformResult.settlementId',
+  );
+  const counts = normalizeMutationCounts(value.counts, 'offlineExportTransformResult.counts');
+  const classificationCounts = normalizeClassificationCounts(
+    value.classificationCounts,
+    'offlineExportTransformResult.classificationCounts',
+  );
+  const outcome = readLiteral(
+    value.outcome,
+    ['transformed', 'no-op'],
+    'offlineExportTransformResult.outcome',
+  );
+  assertCountsMatchClassifications(counts, classificationCounts, 'offlineExportTransformResult.counts');
+  if (operationId !== sourceAuthority.operationId
+    || operationId !== productionTransformAuthority.operationId
+    || settlementId !== sourceAuthority.settlementId
+    || settlementId !== productionTransformAuthority.settlementId
+    || sourceAuthority.authorityId === productionTransformAuthority.authorityId
+    || sourceAuthority.keyId === productionTransformAuthority.keyId
+    || (outcome === 'no-op') !== hasNoMutations(counts)) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportTransformResult.authority');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-offline-export-transform-result',
+    status: 'completed',
+    operationId,
+    settlementId,
+    attemptId: readIdentifier(value.attemptId, 'offlineExportTransformResult.attemptId'),
+    sourceAuthority,
+    productionTransformAuthority,
+    planSha256: readSha256(value.planSha256, 'offlineExportTransformResult.planSha256'),
+    requestSha256: readSha256(
+      value.requestSha256,
+      'offlineExportTransformResult.requestSha256',
+    ),
+    completeOutputReceiptSha256: readSha256(
+      value.completeOutputReceiptSha256,
+      'offlineExportTransformResult.completeOutputReceiptSha256',
+    ),
+    outcome,
+    counts,
+    classificationCounts,
+    completedAt: readInteger(value.completedAt, 'offlineExportTransformResult.completedAt', 1),
+  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1,
+  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumResultBytes,
+  'offlineExportTransformResult');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(valueArg),
+  'offlineExportTransformResult',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(valueArg),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForCompleteOutputReceipt = (
+  resultArg: unknown,
+  receiptArg: unknown,
+  journalArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1> => {
+  const result = normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(resultArg);
+  const receipt =
+    normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receiptArg);
+  const journal = normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg);
+  assertCompleteOutputReceiptMatchesJournal(
+    receipt,
+    journal,
+    'offlineExportTransformResult.completeOutputReceipt',
+  );
+  if (result.completeOutputReceiptSha256
+      !== digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receipt)
+    || !canonicalEqual(
+      result.sourceAuthority,
+      receipt.sourceAuthority,
+      'offlineExportTransformResult.sourceAuthority',
+    )
+    || !canonicalEqual(
+      result.productionTransformAuthority,
+      receipt.authority,
+      'offlineExportTransformResult.productionTransformAuthority',
+    )
+    || result.operationId !== receipt.operationId
+    || result.settlementId !== receipt.settlementId
+    || result.attemptId !== receipt.attemptId
+    || result.planSha256 !== journal.planSha256
+    || result.requestSha256 !== journal.requestSha256
+    || result.outcome !== journal.outcome
+    || !canonicalEqual(result.counts, journal.counts, 'offlineExportTransformResult.counts')
+    || !canonicalEqual(
+      result.classificationCounts,
+      journal.classificationCounts,
+      'offlineExportTransformResult.classificationCounts',
+    )
+    || result.completedAt !== receipt.completedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'offlineExportTransformResult.completeOutputReceipt');
+  }
+  return result;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForAuthorities = async (
+  resultArg: unknown,
+  receiptArg: unknown,
+  journalArg: unknown,
+  authorizationArg: unknown,
+  productionAuthorityArg: unknown,
+  sourceAuthorityArg: unknown,
+  rehearsalAttestationArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
+): Promise<Readonly<
+  ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1
+>> => {
+  const receipt =
+    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptForAuthorities(
+      receiptArg,
+      journalArg,
+      authorizationArg,
+      productionAuthorityArg,
+      sourceAuthorityArg,
+      rehearsalAttestationArg,
+      verifierArg,
+    );
+  return normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForCompleteOutputReceipt(
+    resultArg,
+    receipt,
+    journalArg,
+  );
+};
+
+export {
+  cloudlyLegacyDeploymentSettlementOfflineExportGoldenVectors,
+} from './runtime.cloudlylegacydeploymentsettlement.offlineexport.golden.js';