@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/runtime.cloudlylegacydeploymentsettlement.offlineexport.ts

@@ -1,2470 +0,0 @@
-import * as plugins from './plugins.runtime.js';
-
-import {
-  canonicalizeStrictJson,
-  deepFreezeValue,
-} from './private/canonicaljson.js';
-import {
-  cloudlyLegacyDeploymentSettlementLimits,
-} from './runtime.cloudlylegacydeploymentsettlement.js';
-import type {
-  ICorestoreDatabaseAllocationReference,
-} from './runtime.corestore.js';
-import {
-  normalizeCorestoreDatabaseAllocationReference,
-} from './runtime.corestore.js';
-
-const maximumExactExportBytes = 96 * 1024 * 1024 + 1;
-
-export const cloudlyLegacyDeploymentSettlementOfflineExportLimits = Object.freeze({
-  maximumIdentifierLength:
-    cloudlyLegacyDeploymentSettlementLimits.maximumIdentifierLength,
-  maximumSourceDocuments:
-    cloudlyLegacyDeploymentSettlementLimits.maximumSourceDocuments,
-  maximumOperations: cloudlyLegacyDeploymentSettlementLimits.maximumOperations,
-  maximumExactExportBytes,
-  maximumJournalGrowthBytes: 64 * 1024,
-  maximumJournalCanonicalBytes: 32 * 1024,
-  maximumReceiptBytes: 16 * 1024,
-  maximumResultBytes: 16 * 1024,
-  maximumAuthorityBytes: 16 * 1024,
-  maximumPlanBytes: 768 * 1024,
-  maximumAuthenticatedArtifactBytes: 768 * 1024,
-  maximumAuthorityLifetimeMs:
-    cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityLifetimeMs,
-} as const);
-
-export const cloudlyLegacyDeploymentSettlementOfflineExportDomains = Object.freeze({
-  rehearsalAttestationHmac:
-    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/rehearsal-attestation-hmac-v1\0',
-  productionTransformAuthorizationHmac:
-    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/production-transform-authorization-hmac-v1\0',
-  attemptJournalHmac:
-    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/attempt-journal-hmac-v1\0',
-  completeOutputReceiptHmac:
-    'serve.zone/cloudly-legacy-deployment-settlement/offline-export/complete-output-receipt-hmac-v1\0',
-} as const);
-
-export const cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName =
-  'cloudly_legacy_deployment_settlement_export_attempt_v1' as const;
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode =
-  | 'INVALID_DATA'
-  | 'INVALID_SCHEMA'
-  | 'INVALID_VALUE'
-  | 'LIMIT_EXCEEDED'
-  | 'ORDERING_REQUIRED'
-  | 'CROSS_FIELD_MISMATCH';
-
-export class CloudlyLegacyDeploymentSettlementOfflineExportCodecError extends Error {
-  public readonly code: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode;
-  public readonly path: string;
-
-  public constructor(
-    codeArg: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode,
-    pathArg: string,
-  ) {
-    super(`${codeArg}:${pathArg}`);
-    this.name = 'CloudlyLegacyDeploymentSettlementOfflineExportCodecError';
-    this.code = codeArg;
-    this.path = pathArg;
-  }
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportClassification =
-  | 'image-recorded-not-current'
-  | 'image-recorded-current-failed'
-  | 'rolling-out-current-failed'
-  | 'rolling-out-superseded';
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1 {
-  'image-recorded-not-current': number;
-  'image-recorded-current-failed': number;
-  'rolling-out-current-failed': number;
-  'rolling-out-superseded': number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1 {
-  operations: number;
-  services: number;
-  images: number;
-  releases: number;
-  rolloutOperations: number;
-  routeClaims: number;
-  resourceClaims: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1 {
-  operationCount: number;
-  routeClaimsStabilized: number;
-  routeClaimsRemoved: number;
-  resourceClaimsRemoved: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1 {
-  operationId: string;
-  serviceId: string;
-  sourceRevision: number;
-  sourceState: 'image-recorded' | 'rolling-out';
-  classification: TCloudlyLegacyDeploymentSettlementOfflineExportClassification;
-  finalRevision: number;
-  sourceDocumentHmac: `hmac-sha256:${string}`;
-  finalDocumentHmac: `hmac-sha256:${string}`;
-  routeClaimsStabilized: number;
-  routeClaimsRemoved: number;
-  resourceClaimsRemoved: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1 {
-  format: 'smartdb.database.export.v1';
-  databaseName: string;
-  byteLength: number;
-  sha256: string;
-  lineFeedTerminator: 'single-lf';
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1 {
-  backupId: string;
-  sourceServiceId: string;
-  snapshotId: string;
-  backupReceiptSha256: string;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-plan';
-  operationId: string;
-  settlementId: string;
-  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  effectiveAt: number;
-  sourceStateHmac: `hmac-sha256:${string}`;
-  finalStateHmac: `hmac-sha256:${string}`;
-  sourceCensus: ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1;
-  entries: ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1[];
-  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
-  classificationCounts:
-    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
-}
-
-interface ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference';
-  operationId: string;
-  settlementId: string;
-  authorityId: string;
-  keyId: string;
-  keyVersion: 1;
-  authorityMetadataSha256: string;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
-  role: 'source-rehearsal';
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceBaseV1 {
-  role: 'production-transform';
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1 =
-  | ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
-  | ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-source-authority';
-  role: 'source-rehearsal';
-  operationId: string;
-  settlementId: string;
-  authorityId: string;
-  keyId: string;
-  keyVersion: 1;
-  issuedAt: number;
-  expiresAt: number;
-  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  approvedSourceBackup:
-    ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1;
-  planSha256: string;
-  rehearsalRequestSha256: string;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation';
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  plan: ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1;
-  planSha256: string;
-  rehearsalRequestSha256: string;
-  scratchAllocation: ICorestoreDatabaseAllocationReference;
-  outcome: 'transform-required' | 'no-op';
-  observedFinalStateHmac: `hmac-sha256:${string}`;
-  observedCounts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
-  observedClassificationCounts:
-    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
-  completedAt: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 {
-  payloadSha256: string;
-  mac: string;
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedRehearsalAttestationV1 =
-  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1, 'mac'>;
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority';
-  role: 'production-transform';
-  operationId: string;
-  settlementId: string;
-  authorityId: string;
-  keyId: string;
-  keyVersion: 1;
-  issuedAt: number;
-  expiresAt: number;
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  authenticatedRehearsalAttestationSha256: string;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization';
-  authority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  attemptId: string;
-  authenticatedRehearsalAttestationSha256: string;
-  planSha256: string;
-  requestSha256: string;
-  requestedAt: number;
-  authorizedAt: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 {
-  payloadSha256: string;
-  mac: string;
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedProductionTransformAuthorizationV1 =
-  Omit<
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1,
-    'mac'
-  >;
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 {
-  schemaVersion: 1;
-  kind: typeof cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName;
-  purpose: 'production-transform';
-  operationId: string;
-  settlementId: string;
-  attemptId: string;
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  productionTransformAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
-  authenticatedRehearsalAttestationSha256: string;
-  transformAuthorizationSha256: string;
-  planSha256: string;
-  requestSha256: string;
-  sourceFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  transformedCoreFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  sourceStateHmac: `hmac-sha256:${string}`;
-  finalStateHmac: `hmac-sha256:${string}`;
-  outcome: 'transformed' | 'no-op';
-  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
-  classificationCounts:
-    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
-  completedAt: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 {
-  _id: string;
-  mac: string;
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedAttemptJournalV1 =
-  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1, 'mac'>;
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt';
-  authority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  operationId: string;
-  settlementId: string;
-  attemptId: string;
-  journalSha256: string;
-  transformedCoreFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  completeOutputFile: ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1;
-  journalGrowthBytes: number;
-  completedAt: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
-extends ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 {
-  payloadSha256: string;
-  mac: string;
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedCompleteOutputReceiptV1 =
-  Omit<ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1, 'mac'>;
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1 {
-  schemaVersion: 1;
-  kind: 'cloudly-legacy-deployment-settlement-offline-export-transform-result';
-  status: 'completed';
-  operationId: string;
-  settlementId: string;
-  attemptId: string;
-  sourceAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1;
-  productionTransformAuthority:
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1;
-  planSha256: string;
-  requestSha256: string;
-  completeOutputReceiptSha256: string;
-  outcome: 'transformed' | 'no-op';
-  counts: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1;
-  classificationCounts:
-    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1;
-  completedAt: number;
-}
-
-export interface ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1 {
-  authority: TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1;
-  domain: typeof cloudlyLegacyDeploymentSettlementOfflineExportDomains[keyof
-    typeof cloudlyLegacyDeploymentSettlementOfflineExportDomains];
-  hmacInput: Uint8Array;
-  mac: string;
-}
-
-export type TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier = (
-  inputArg: ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1,
-) => boolean | Promise<boolean>;
-
-const classificationKeys = [
-  'image-recorded-not-current',
-  'image-recorded-current-failed',
-  'rolling-out-current-failed',
-  'rolling-out-superseded',
-] as const;
-const censusKeys = [
-  'operations',
-  'services',
-  'images',
-  'releases',
-  'rolloutOperations',
-  'routeClaims',
-  'resourceClaims',
-] as const;
-const mutationCountKeys = [
-  'operationCount',
-  'routeClaimsStabilized',
-  'routeClaimsRemoved',
-  'resourceClaimsRemoved',
-] as const;
-const planEntryKeys = [
-  'operationId',
-  'serviceId',
-  'sourceRevision',
-  'sourceState',
-  'classification',
-  'finalRevision',
-  'sourceDocumentHmac',
-  'finalDocumentHmac',
-  'routeClaimsStabilized',
-  'routeClaimsRemoved',
-  'resourceClaimsRemoved',
-] as const;
-const fileIdentityKeys = [
-  'format',
-  'databaseName',
-  'byteLength',
-  'sha256',
-  'lineFeedTerminator',
-] as const;
-const approvedSourceBackupKeys = [
-  'backupId',
-  'sourceServiceId',
-  'snapshotId',
-  'backupReceiptSha256',
-] as const;
-const authorityReferenceKeys = [
-  'schemaVersion',
-  'kind',
-  'role',
-  'operationId',
-  'settlementId',
-  'authorityId',
-  'keyId',
-  'keyVersion',
-  'authorityMetadataSha256',
-] as const;
-const sourceAuthorityKeys = [
-  'schemaVersion',
-  'kind',
-  'role',
-  'operationId',
-  'settlementId',
-  'authorityId',
-  'keyId',
-  'keyVersion',
-  'issuedAt',
-  'expiresAt',
-  'sourceFile',
-  'approvedSourceBackup',
-  'planSha256',
-  'rehearsalRequestSha256',
-] as const;
-const productionTransformAuthorityKeys = [
-  'schemaVersion',
-  'kind',
-  'role',
-  'operationId',
-  'settlementId',
-  'authorityId',
-  'keyId',
-  'keyVersion',
-  'issuedAt',
-  'expiresAt',
-  'sourceAuthority',
-  'authenticatedRehearsalAttestationSha256',
-] as const;
-const rehearsalPayloadKeys = [
-  'schemaVersion',
-  'kind',
-  'sourceAuthority',
-  'plan',
-  'planSha256',
-  'rehearsalRequestSha256',
-  'scratchAllocation',
-  'outcome',
-  'observedFinalStateHmac',
-  'observedCounts',
-  'observedClassificationCounts',
-  'completedAt',
-] as const;
-const rehearsalUnsignedKeys = [...rehearsalPayloadKeys, 'payloadSha256'] as const;
-const rehearsalKeys = [...rehearsalUnsignedKeys, 'mac'] as const;
-const authorizationPayloadKeys = [
-  'schemaVersion',
-  'kind',
-  'authority',
-  'sourceAuthority',
-  'attemptId',
-  'authenticatedRehearsalAttestationSha256',
-  'planSha256',
-  'requestSha256',
-  'requestedAt',
-  'authorizedAt',
-] as const;
-const authorizationUnsignedKeys = [...authorizationPayloadKeys, 'payloadSha256'] as const;
-const authorizationKeys = [...authorizationUnsignedKeys, 'mac'] as const;
-const journalSeedKeys = [
-  'schemaVersion',
-  'kind',
-  'purpose',
-  'operationId',
-  'settlementId',
-  'attemptId',
-  'sourceAuthority',
-  'productionTransformAuthority',
-  'authenticatedRehearsalAttestationSha256',
-  'transformAuthorizationSha256',
-  'planSha256',
-  'requestSha256',
-  'sourceFile',
-  'transformedCoreFile',
-  'sourceStateHmac',
-  'finalStateHmac',
-  'outcome',
-  'counts',
-  'classificationCounts',
-  'completedAt',
-] as const;
-const journalUnsignedKeys = ['_id', ...journalSeedKeys] as const;
-const journalKeys = [...journalUnsignedKeys, 'mac'] as const;
-const completeOutputReceiptPayloadKeys = [
-  'schemaVersion',
-  'kind',
-  'authority',
-  'sourceAuthority',
-  'operationId',
-  'settlementId',
-  'attemptId',
-  'journalSha256',
-  'transformedCoreFile',
-  'completeOutputFile',
-  'journalGrowthBytes',
-  'completedAt',
-] as const;
-const completeOutputReceiptUnsignedKeys = [
-  ...completeOutputReceiptPayloadKeys,
-  'payloadSha256',
-] as const;
-const completeOutputReceiptKeys = [...completeOutputReceiptUnsignedKeys, 'mac'] as const;
-
-const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._@-]{0,199}$/;
-const sha256Pattern = /^[a-f0-9]{64}$/;
-const stateHmacPattern = /^hmac-sha256:[a-f0-9]{64}$/;
-const macPattern = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
-
-const fail = (
-  codeArg: TCloudlyLegacyDeploymentSettlementOfflineExportCodecErrorCode,
-  pathArg: string,
-): never => {
-  throw new CloudlyLegacyDeploymentSettlementOfflineExportCodecError(codeArg, pathArg);
-};
-
-const normalizeScratchAllocation = (
-  valueArg: unknown,
-  pathArg: string,
-): ICorestoreDatabaseAllocationReference => {
-  try {
-    return normalizeCorestoreDatabaseAllocationReference(
-      valueArg,
-    ) as ICorestoreDatabaseAllocationReference;
-  } catch {
-    return fail('INVALID_VALUE', pathArg);
-  }
-};
-
-const readRecord = (valueArg: unknown, pathArg: string): Record<string, unknown> => {
-  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
-    return fail('INVALID_DATA', pathArg);
-  }
-  const prototype = Object.getPrototypeOf(valueArg);
-  if (prototype !== Object.prototype && prototype !== null) {
-    return fail('INVALID_DATA', pathArg);
-  }
-  const value = valueArg as Record<string, unknown>;
-  for (const key of Reflect.ownKeys(value)) {
-    if (typeof key !== 'string') return fail('INVALID_DATA', pathArg);
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
-      return fail('INVALID_DATA', pathArg);
-    }
-  }
-  return value;
-};
-
-const readArray = (
-  valueArg: unknown,
-  pathArg: string,
-  maximumLengthArg: number,
-): unknown[] => {
-  if (!Array.isArray(valueArg) || Object.getPrototypeOf(valueArg) !== Array.prototype
-    || valueArg.length > maximumLengthArg) {
-    return fail(
-      Array.isArray(valueArg) ? 'LIMIT_EXCEEDED' : 'INVALID_DATA',
-      pathArg,
-    );
-  }
-  for (let index = 0; index < valueArg.length; index++) {
-    if (!Object.hasOwn(valueArg, index)) return fail('INVALID_DATA', `${pathArg}[${index}]`);
-    const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
-    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
-      return fail('INVALID_DATA', `${pathArg}[${index}]`);
-    }
-  }
-  for (const key of Reflect.ownKeys(valueArg)) {
-    if (key === 'length') continue;
-    if (typeof key !== 'string'
-      || !/^(?:0|[1-9][0-9]*)$/.test(key)
-      || Number(key) >= valueArg.length) {
-      return fail('INVALID_DATA', pathArg);
-    }
-  }
-  return valueArg;
-};
-
-const assertExactKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: readonly string[],
-  pathArg: string,
-): void => {
-  const actual = Object.keys(valueArg).sort();
-  const expected = [...keysArg].sort();
-  if (actual.length !== expected.length
-    || actual.some((keyArg, indexArg) => keyArg !== expected[indexArg])) {
-    fail('INVALID_SCHEMA', pathArg);
-  }
-};
-
-const readIdentifier = (valueArg: unknown, pathArg: string): string => {
-  if (typeof valueArg !== 'string' || !identifierPattern.test(valueArg)) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg;
-};
-
-const readSha256 = (valueArg: unknown, pathArg: string): string => {
-  if (typeof valueArg !== 'string' || !sha256Pattern.test(valueArg)) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg;
-};
-
-const readStateHmac = (
-  valueArg: unknown,
-  pathArg: string,
-): `hmac-sha256:${string}` => {
-  if (typeof valueArg !== 'string' || !stateHmacPattern.test(valueArg)) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg as `hmac-sha256:${string}`;
-};
-
-const readMac = (valueArg: unknown, pathArg: string): string => {
-  if (typeof valueArg !== 'string' || !macPattern.test(valueArg)) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  const bytes = Buffer.from(valueArg, 'base64url');
-  if (bytes.byteLength !== 32 || bytes.toString('base64url') !== valueArg) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg;
-};
-
-const readInteger = (
-  valueArg: unknown,
-  pathArg: string,
-  minimumArg = 0,
-  maximumArg = Number.MAX_SAFE_INTEGER,
-): number => {
-  if (typeof valueArg !== 'number'
-    || !Number.isSafeInteger(valueArg)
-    || Object.is(valueArg, -0)
-    || valueArg < minimumArg
-    || valueArg > maximumArg) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg;
-};
-
-const readLiteral = <TLiteral extends string>(
-  valueArg: unknown,
-  literalsArg: readonly TLiteral[],
-  pathArg: string,
-): TLiteral => {
-  if (typeof valueArg !== 'string' || !literalsArg.includes(valueArg as TLiteral)) {
-    return fail('INVALID_VALUE', pathArg);
-  }
-  return valueArg as TLiteral;
-};
-
-const canonicalize = (valueArg: unknown, pathArg: string): string => canonicalizeStrictJson(
-  valueArg,
-  () => fail('INVALID_DATA', pathArg),
-  pathArg,
-);
-
-const finalize = <T>(
-  valueArg: T,
-  maximumBytesArg: number,
-  pathArg: string,
-): Readonly<T> => {
-  const canonical = canonicalize(valueArg, pathArg);
-  if (Buffer.byteLength(canonical, 'utf8') > maximumBytesArg) {
-    return fail('LIMIT_EXCEEDED', pathArg);
-  }
-  return deepFreezeValue(valueArg);
-};
-
-const encodeNormalized = (valueArg: unknown, pathArg: string): Uint8Array => (
-  Buffer.from(canonicalize(valueArg, pathArg), 'utf8')
-);
-
-const digestBytes = (valueArg: Uint8Array): string => plugins.crypto
-  .createHash('sha256')
-  .update(new Uint8Array(valueArg))
-  .digest('hex');
-
-const frame = (domainArg: string, payloadArg: Uint8Array): Uint8Array => {
-  const domain = Buffer.from(domainArg, 'utf8');
-  const output = new Uint8Array(domain.byteLength + payloadArg.byteLength);
-  output.set(domain, 0);
-  output.set(payloadArg, domain.byteLength);
-  return output;
-};
-
-const canonicalEqual = (leftArg: unknown, rightArg: unknown, pathArg: string): boolean => (
-  canonicalize(leftArg, `${pathArg}.left`) === canonicalize(rightArg, `${pathArg}.right`)
-);
-
-const normalizeFileIdentityInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, fileIdentityKeys, pathArg);
-  if (value.format !== 'smartdb.database.export.v1'
-    || value.lineFeedTerminator !== 'single-lf') {
-    fail('INVALID_VALUE', `${pathArg}.format`);
-  }
-  return {
-    format: 'smartdb.database.export.v1',
-    databaseName: readIdentifier(value.databaseName, `${pathArg}.databaseName`),
-    byteLength: readInteger(
-      value.byteLength,
-      `${pathArg}.byteLength`,
-      1,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumExactExportBytes,
-    ),
-    sha256: readSha256(value.sha256, `${pathArg}.sha256`),
-    lineFeedTerminator: 'single-lf',
-  };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
-  valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportFileIdentityV1> => finalize(
-  normalizeFileIdentityInternal(valueArg, 'offlineExportFileIdentity'),
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportFileIdentity',
-);
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity(valueArg),
-  'offlineExportFileIdentity',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportFileIdentity(valueArg),
-);
-
-const normalizeApprovedSourceBackupInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, approvedSourceBackupKeys, pathArg);
-  return {
-    backupId: readIdentifier(value.backupId, `${pathArg}.backupId`),
-    sourceServiceId: readIdentifier(value.sourceServiceId, `${pathArg}.sourceServiceId`),
-    snapshotId: readIdentifier(value.snapshotId, `${pathArg}.snapshotId`),
-    backupReceiptSha256: readSha256(
-      value.backupReceiptSha256,
-      `${pathArg}.backupReceiptSha256`,
-    ),
-  };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentity = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportApprovedSourceBackupIdentityV1
-> => finalize(
-  normalizeApprovedSourceBackupInternal(valueArg, 'approvedSourceBackup'),
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'approvedSourceBackup',
-);
-
-const normalizeClassificationCounts = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, classificationKeys, pathArg);
-  return {
-    'image-recorded-not-current': readInteger(
-      value['image-recorded-not-current'],
-      `${pathArg}.image-recorded-not-current`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-    ),
-    'image-recorded-current-failed': readInteger(
-      value['image-recorded-current-failed'],
-      `${pathArg}.image-recorded-current-failed`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-    ),
-    'rolling-out-current-failed': readInteger(
-      value['rolling-out-current-failed'],
-      `${pathArg}.rolling-out-current-failed`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-    ),
-    'rolling-out-superseded': readInteger(
-      value['rolling-out-superseded'],
-      `${pathArg}.rolling-out-superseded`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-    ),
-  };
-};
-
-const sumClassificationCounts = (
-  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1,
-): number => classificationKeys.reduce((sumArg, keyArg) => sumArg + valueArg[keyArg], 0);
-
-const normalizeSourceCensus = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, censusKeys, pathArg);
-  const output = Object.fromEntries(censusKeys.map((keyArg) => [
-    keyArg,
-    readInteger(
-      value[keyArg],
-      `${pathArg}.${keyArg}`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumSourceDocuments,
-    ),
-  ])) as unknown as ICloudlyLegacyDeploymentSettlementOfflineExportSourceCensusV1;
-  if (censusKeys.reduce((sumArg, keyArg) => sumArg + output[keyArg], 0)
-    > cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumSourceDocuments) {
-    fail('LIMIT_EXCEEDED', pathArg);
-  }
-  return output;
-};
-
-const normalizeMutationCounts = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, mutationCountKeys, pathArg);
-  const counts = {
-    operationCount: readInteger(
-      value.operationCount,
-      `${pathArg}.operationCount`,
-      0,
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-    ),
-    routeClaimsStabilized: readInteger(
-      value.routeClaimsStabilized,
-      `${pathArg}.routeClaimsStabilized`,
-    ),
-    routeClaimsRemoved: readInteger(
-      value.routeClaimsRemoved,
-      `${pathArg}.routeClaimsRemoved`,
-    ),
-    resourceClaimsRemoved: readInteger(
-      value.resourceClaimsRemoved,
-      `${pathArg}.resourceClaimsRemoved`,
-    ),
-  };
-  if (counts.operationCount === 0
-    && mutationCountKeys.some((keyArg) => counts[keyArg] !== 0)) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-  return counts;
-};
-
-const hasNoMutations = (
-  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1,
-): boolean => mutationCountKeys.every((keyArg) => valueArg[keyArg] === 0);
-
-const assertCountsMatchClassifications = (
-  countsArg: ICloudlyLegacyDeploymentSettlementOfflineExportMutationCountsV1,
-  classificationCountsArg:
-    ICloudlyLegacyDeploymentSettlementOfflineExportClassificationCountsV1,
-  pathArg: string,
-): void => {
-  if (countsArg.operationCount !== sumClassificationCounts(classificationCountsArg)) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-};
-
-const normalizePlanEntry = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportPlanEntryV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, planEntryKeys, pathArg);
-  const sourceRevision = readInteger(value.sourceRevision, `${pathArg}.sourceRevision`);
-  const finalRevision = readInteger(value.finalRevision, `${pathArg}.finalRevision`);
-  if (!Number.isSafeInteger(sourceRevision + 3) || finalRevision !== sourceRevision + 3) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.finalRevision`);
-  }
-  const sourceState = readLiteral(
-    value.sourceState,
-    ['image-recorded', 'rolling-out'],
-    `${pathArg}.sourceState`,
-  );
-  const classification = readLiteral(
-    value.classification,
-    classificationKeys,
-    `${pathArg}.classification`,
-  );
-  if ((classification.startsWith('image-recorded-') && sourceState !== 'image-recorded')
-    || (classification.startsWith('rolling-out-') && sourceState !== 'rolling-out')) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.classification`);
-  }
-  return {
-    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
-    serviceId: readIdentifier(value.serviceId, `${pathArg}.serviceId`),
-    sourceRevision,
-    sourceState,
-    classification,
-    finalRevision,
-    sourceDocumentHmac: readStateHmac(
-      value.sourceDocumentHmac,
-      `${pathArg}.sourceDocumentHmac`,
-    ),
-    finalDocumentHmac: readStateHmac(
-      value.finalDocumentHmac,
-      `${pathArg}.finalDocumentHmac`,
-    ),
-    routeClaimsStabilized: readInteger(
-      value.routeClaimsStabilized,
-      `${pathArg}.routeClaimsStabilized`,
-    ),
-    routeClaimsRemoved: readInteger(
-      value.routeClaimsRemoved,
-      `${pathArg}.routeClaimsRemoved`,
-    ),
-    resourceClaimsRemoved: readInteger(
-      value.resourceClaimsRemoved,
-      `${pathArg}.resourceClaimsRemoved`,
-    ),
-  };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
-  valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1> => {
-  const value = readRecord(valueArg, 'offlineExportPlan');
-  assertExactKeys(value, [
-    'schemaVersion',
-    'kind',
-    'operationId',
-    'settlementId',
-    'sourceFile',
-    'effectiveAt',
-    'sourceStateHmac',
-    'finalStateHmac',
-    'sourceCensus',
-    'entries',
-    'counts',
-    'classificationCounts',
-  ], 'offlineExportPlan');
-  if (value.schemaVersion !== 1
-    || value.kind !== 'cloudly-legacy-deployment-settlement-offline-export-plan') {
-    fail('INVALID_VALUE', 'offlineExportPlan.kind');
-  }
-  const entries = readArray(
-    value.entries,
-    'offlineExportPlan.entries',
-    cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumOperations,
-  ).map((entryArg, indexArg) => normalizePlanEntry(
-    entryArg,
-    `offlineExportPlan.entries[${indexArg}]`,
-  ));
-  for (let index = 1; index < entries.length; index++) {
-    if (entries[index - 1].operationId >= entries[index].operationId) {
-      fail('ORDERING_REQUIRED', `offlineExportPlan.entries[${index}].operationId`);
-    }
-  }
-  const counts = normalizeMutationCounts(value.counts, 'offlineExportPlan.counts');
-  const classificationCounts = normalizeClassificationCounts(
-    value.classificationCounts,
-    'offlineExportPlan.classificationCounts',
-  );
-  const sourceStateHmac = readStateHmac(
-    value.sourceStateHmac,
-    'offlineExportPlan.sourceStateHmac',
-  );
-  const finalStateHmac = readStateHmac(
-    value.finalStateHmac,
-    'offlineExportPlan.finalStateHmac',
-  );
-  const expectedCounts = {
-    operationCount: entries.length,
-    routeClaimsStabilized: entries.reduce(
-      (sumArg, entryArg) => sumArg + entryArg.routeClaimsStabilized,
-      0,
-    ),
-    routeClaimsRemoved: entries.reduce(
-      (sumArg, entryArg) => sumArg + entryArg.routeClaimsRemoved,
-      0,
-    ),
-    resourceClaimsRemoved: entries.reduce(
-      (sumArg, entryArg) => sumArg + entryArg.resourceClaimsRemoved,
-      0,
-    ),
-  };
-  const actualClassifications = Object.fromEntries(classificationKeys.map((keyArg) => [
-    keyArg,
-    entries.filter((entryArg) => entryArg.classification === keyArg).length,
-  ]));
-  if (!Object.values(expectedCounts).every((valueArg) => Number.isSafeInteger(valueArg))
-    || !canonicalEqual(counts, expectedCounts, 'offlineExportPlan.counts')
-    || classificationKeys.some((keyArg) => (
-      classificationCounts[keyArg] !== actualClassifications[keyArg]
-    ))
-    || (entries.length === 0) !== (sourceStateHmac === finalStateHmac)) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportPlan.counts');
-  }
-  assertCountsMatchClassifications(
-    counts,
-    classificationCounts,
-    'offlineExportPlan.classificationCounts',
-  );
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-plan',
-    operationId: readIdentifier(value.operationId, 'offlineExportPlan.operationId'),
-    settlementId: readIdentifier(value.settlementId, 'offlineExportPlan.settlementId'),
-    sourceFile: normalizeFileIdentityInternal(value.sourceFile, 'offlineExportPlan.sourceFile'),
-    effectiveAt: readInteger(value.effectiveAt, 'offlineExportPlan.effectiveAt', 1),
-    sourceStateHmac,
-    finalStateHmac,
-    sourceCensus: normalizeSourceCensus(
-      value.sourceCensus,
-      'offlineExportPlan.sourceCensus',
-    ),
-    entries,
-    counts,
-    classificationCounts,
-  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1,
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumPlanBytes,
-  'offlineExportPlan');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan(valueArg),
-  'offlineExportPlan',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportPlan = (
-  valueArg: unknown,
-): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementOfflineExportPlan(valueArg));
-
-const normalizeAuthorityReferenceInternal = <
-  TRole extends TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1['role'],
->(
-  valueArg: unknown,
-  pathArg: string,
-  roleArg: TRole,
-): Extract<
-  TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
-  { role: TRole }
-> => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, authorityReferenceKeys, pathArg);
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-authority-reference'
-    || value.role !== roleArg
-    || value.keyVersion !== 1) {
-    fail('INVALID_VALUE', `${pathArg}.role`);
-  }
-  return {
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
-    role: roleArg,
-    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
-    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
-    authorityId: readIdentifier(value.authorityId, `${pathArg}.authorityId`),
-    keyId: readIdentifier(value.keyId, `${pathArg}.keyId`),
-    keyVersion: 1,
-    authorityMetadataSha256: readSha256(
-      value.authorityMetadataSha256,
-      `${pathArg}.authorityMetadataSha256`,
-    ),
-  } as Extract<
-    TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
-    { role: TRole }
-  >;
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
-> => finalize(
-  normalizeAuthorityReferenceInternal(valueArg, 'offlineExportSourceAuthorityReference', 'source-rehearsal'),
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportSourceAuthorityReference',
-);
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
-> => finalize(
-  normalizeAuthorityReferenceInternal(
-    valueArg,
-    'offlineExportProductionTransformAuthorityReference',
-    'production-transform',
-  ),
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportProductionTransformAuthorityReference',
-);
-
-const normalizeAuthorityWindow = (
-  valueArg: Record<string, unknown>,
-  pathArg: string,
-): { issuedAt: number; expiresAt: number } => {
-  const issuedAt = readInteger(valueArg.issuedAt, `${pathArg}.issuedAt`, 1);
-  const expiresAt = readInteger(valueArg.expiresAt, `${pathArg}.expiresAt`, 1);
-  if (expiresAt <= issuedAt
-    || expiresAt - issuedAt
-      > cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityLifetimeMs) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.expiresAt`);
-  }
-  return { issuedAt, expiresAt };
-};
-
-const assertTimestampWithinAuthority = (
-  timestampArg: number,
-  authorityArg: { issuedAt: number; expiresAt: number },
-  pathArg: string,
-): void => {
-  if (timestampArg < authorityArg.issuedAt || timestampArg >= authorityArg.expiresAt) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
-  valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1> => {
-  const value = readRecord(valueArg, 'offlineExportSourceAuthority');
-  assertExactKeys(value, sourceAuthorityKeys, 'offlineExportSourceAuthority');
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-source-authority'
-    || value.role !== 'source-rehearsal'
-    || value.keyVersion !== 1) {
-    fail('INVALID_VALUE', 'offlineExportSourceAuthority.kind');
-  }
-  const window = normalizeAuthorityWindow(value, 'offlineExportSourceAuthority');
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-source-authority',
-    role: 'source-rehearsal',
-    operationId: readIdentifier(value.operationId, 'offlineExportSourceAuthority.operationId'),
-    settlementId: readIdentifier(value.settlementId, 'offlineExportSourceAuthority.settlementId'),
-    authorityId: readIdentifier(value.authorityId, 'offlineExportSourceAuthority.authorityId'),
-    keyId: readIdentifier(value.keyId, 'offlineExportSourceAuthority.keyId'),
-    keyVersion: 1,
-    ...window,
-    sourceFile: normalizeFileIdentityInternal(
-      value.sourceFile,
-      'offlineExportSourceAuthority.sourceFile',
-    ),
-    approvedSourceBackup: normalizeApprovedSourceBackupInternal(
-      value.approvedSourceBackup,
-      'offlineExportSourceAuthority.approvedSourceBackup',
-    ),
-    planSha256: readSha256(value.planSha256, 'offlineExportSourceAuthority.planSha256'),
-    rehearsalRequestSha256: readSha256(
-      value.rehearsalRequestSha256,
-      'offlineExportSourceAuthority.rehearsalRequestSha256',
-    ),
-  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityV1,
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportSourceAuthority');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(valueArg),
-  'offlineExportSourceAuthority',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(valueArg),
-);
-
-export const createCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference = (
-  authorityArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReferenceV1
-> => {
-  const authority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
-    authorityArg,
-  );
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
-    role: 'source-rehearsal',
-    operationId: authority.operationId,
-    settlementId: authority.settlementId,
-    authorityId: authority.authorityId,
-    keyId: authority.keyId,
-    keyVersion: 1,
-    authorityMetadataSha256:
-      digestCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(authority),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportSourceAuthorityReference');
-};
-
-const assertSourceReferenceMatchesAuthority = (
-  referenceArg: unknown,
-  authorityArg: unknown,
-  pathArg: string,
-): void => {
-  const reference = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference(
-    referenceArg,
-  );
-  const expected = createCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthorityReference(
-    authorityArg,
-  );
-  if (!canonicalEqual(reference, expected, pathArg)) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-};
-
-const normalizeRehearsalPayloadInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, rehearsalPayloadKeys, pathArg);
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation') {
-    fail('INVALID_VALUE', `${pathArg}.kind`);
-  }
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    `${pathArg}.sourceAuthority`,
-    'source-rehearsal',
-  );
-  const plan = normalizeCloudlyLegacyDeploymentSettlementOfflineExportPlan(value.plan);
-  const planSha256 = readSha256(value.planSha256, `${pathArg}.planSha256`);
-  const outcome = readLiteral(
-    value.outcome,
-    ['transform-required', 'no-op'],
-    `${pathArg}.outcome`,
-  );
-  const observedCounts = normalizeMutationCounts(
-    value.observedCounts,
-    `${pathArg}.observedCounts`,
-  );
-  const observedClassificationCounts = normalizeClassificationCounts(
-    value.observedClassificationCounts,
-    `${pathArg}.observedClassificationCounts`,
-  );
-  if (sourceAuthority.operationId !== plan.operationId
-    || sourceAuthority.settlementId !== plan.settlementId
-    || planSha256 !== digestCloudlyLegacyDeploymentSettlementOfflineExportPlan(plan)
-    || value.observedFinalStateHmac !== plan.finalStateHmac
-    || !canonicalEqual(observedCounts, plan.counts, `${pathArg}.observedCounts`)
-    || !canonicalEqual(
-      observedClassificationCounts,
-      plan.classificationCounts,
-      `${pathArg}.observedClassificationCounts`,
-    )
-    || (outcome === 'no-op') !== hasNoMutations(plan.counts)) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.plan`);
-  }
-  return {
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-rehearsal-attestation',
-    sourceAuthority,
-    plan: plan as ICloudlyLegacyDeploymentSettlementOfflineExportPlanV1,
-    planSha256,
-    rehearsalRequestSha256: readSha256(
-      value.rehearsalRequestSha256,
-      `${pathArg}.rehearsalRequestSha256`,
-    ),
-    scratchAllocation: normalizeScratchAllocation(
-      value.scratchAllocation,
-      `${pathArg}.scratchAllocation`,
-    ),
-    outcome,
-    observedFinalStateHmac: readStateHmac(
-      value.observedFinalStateHmac,
-      `${pathArg}.observedFinalStateHmac`,
-    ),
-    observedCounts,
-    observedClassificationCounts,
-    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
-  };
-};
-
-const rehearsalPayload = (
-  valueArg: ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayloadV1,
-): unknown => Object.fromEntries(rehearsalPayloadKeys.map((keyArg) => [
-  keyArg,
-  valueArg[keyArg],
-]));
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayload = (
-  valueArg: unknown,
-): string => digestBytes(encodeNormalized(
-  rehearsalPayload(normalizeRehearsalPayloadInternal(
-    valueArg,
-    'offlineExportRehearsalAttestationPayload',
-  )),
-  'offlineExportRehearsalAttestationPayload',
-));
-
-const normalizeUnsignedRehearsalInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedRehearsalAttestationV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, rehearsalUnsignedKeys, pathArg);
-  const payload = normalizeRehearsalPayloadInternal(
-    Object.fromEntries(rehearsalPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
-    `${pathArg}.payload`,
-  );
-  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
-  if (payloadSha256
-    !== digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationPayload(
-      payload,
-    )) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
-  }
-  return { ...payload, payloadSha256 };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
-> => {
-  const value = readRecord(valueArg, 'offlineExportRehearsalAttestation');
-  assertExactKeys(value, rehearsalKeys, 'offlineExportRehearsalAttestation');
-  return finalize({
-    ...normalizeUnsignedRehearsalInternal(
-      Object.fromEntries(rehearsalUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
-      'offlineExportRehearsalAttestation.unsigned',
-    ),
-    mac: readMac(value.mac, 'offlineExportRehearsalAttestation.mac'),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
-  'offlineExportRehearsalAttestation');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(valueArg),
-  'offlineExportRehearsalAttestation',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(valueArg),
-);
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationHmacInput = (
-  valueArg: unknown,
-): Uint8Array => frame(
-  cloudlyLegacyDeploymentSettlementOfflineExportDomains.rehearsalAttestationHmac,
-  encodeNormalized(
-    finalize(
-      normalizeUnsignedRehearsalInternal(
-        valueArg,
-        'offlineExportUnsignedRehearsalAttestation',
-      ),
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
-      'offlineExportUnsignedRehearsalAttestation',
-    ),
-    'offlineExportUnsignedRehearsalAttestation',
-  ),
-);
-
-const requireVerifiedHmac = async (
-  authorityArg: TCloudlyLegacyDeploymentSettlementOfflineExportAuthorityReferenceV1,
-  domainArg: ICloudlyLegacyDeploymentSettlementOfflineExportHmacVerificationInputV1['domain'],
-  hmacInputArg: Uint8Array,
-  macArg: string,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-  pathArg: string,
-): Promise<void> => {
-  let verified = false;
-  try {
-    verified = await verifierArg({
-      authority: authorityArg,
-      domain: domainArg,
-      hmacInput: new Uint8Array(hmacInputArg),
-      mac: macArg,
-    });
-  } catch {
-    verified = false;
-  }
-  if (!verified) fail('INVALID_VALUE', pathArg);
-};
-
-const withoutMac = <TValue extends { mac: string }>(
-  valueArg: TValue,
-): Omit<TValue, 'mac'> => {
-  const { mac: _mac, ...unsigned } = valueArg;
-  return unsigned;
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority = async (
-  attestationArg: unknown,
-  sourceAuthorityArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationV1
->> => {
-  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
-    sourceAuthorityArg,
-  );
-  const attestation =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(
-      attestationArg,
-    );
-  assertSourceReferenceMatchesAuthority(
-    attestation.sourceAuthority,
-    sourceAuthority,
-    'offlineExportRehearsalAttestation.sourceAuthority',
-  );
-  if (attestation.planSha256 !== sourceAuthority.planSha256
-    || attestation.rehearsalRequestSha256 !== sourceAuthority.rehearsalRequestSha256
-    || !canonicalEqual(
-      attestation.plan.sourceFile,
-      sourceAuthority.sourceFile,
-      'offlineExportRehearsalAttestation.plan.sourceFile',
-    )
-    || attestation.plan.operationId !== sourceAuthority.operationId
-    || attestation.plan.settlementId !== sourceAuthority.settlementId) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportRehearsalAttestation.sourceProof');
-  }
-  assertTimestampWithinAuthority(
-    attestation.plan.effectiveAt,
-    sourceAuthority,
-    'offlineExportRehearsalAttestation.plan.effectiveAt',
-  );
-  assertTimestampWithinAuthority(
-    attestation.completedAt,
-    sourceAuthority,
-    'offlineExportRehearsalAttestation.completedAt',
-  );
-  if (attestation.completedAt < attestation.plan.effectiveAt) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportRehearsalAttestation.completedAt');
-  }
-  await requireVerifiedHmac(
-    attestation.sourceAuthority,
-    cloudlyLegacyDeploymentSettlementOfflineExportDomains.rehearsalAttestationHmac,
-    encodeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationHmacInput(
-      withoutMac(attestation),
-    ),
-    attestation.mac,
-    verifierArg,
-    'offlineExportRehearsalAttestation.mac',
-  );
-  return attestation;
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1
-> => {
-  const value = readRecord(valueArg, 'offlineExportProductionTransformAuthority');
-  assertExactKeys(
-    value,
-    productionTransformAuthorityKeys,
-    'offlineExportProductionTransformAuthority',
-  );
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority'
-    || value.role !== 'production-transform'
-    || value.keyVersion !== 1) {
-    fail('INVALID_VALUE', 'offlineExportProductionTransformAuthority.kind');
-  }
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    'offlineExportProductionTransformAuthority.sourceAuthority',
-    'source-rehearsal',
-  );
-  const operationId = readIdentifier(
-    value.operationId,
-    'offlineExportProductionTransformAuthority.operationId',
-  );
-  const settlementId = readIdentifier(
-    value.settlementId,
-    'offlineExportProductionTransformAuthority.settlementId',
-  );
-  const authorityId = readIdentifier(
-    value.authorityId,
-    'offlineExportProductionTransformAuthority.authorityId',
-  );
-  const keyId = readIdentifier(
-    value.keyId,
-    'offlineExportProductionTransformAuthority.keyId',
-  );
-  if (operationId !== sourceAuthority.operationId
-    || settlementId !== sourceAuthority.settlementId
-    || authorityId === sourceAuthority.authorityId
-    || keyId === sourceAuthority.keyId) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthority.sourceAuthority');
-  }
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authority',
-    role: 'production-transform',
-    operationId,
-    settlementId,
-    authorityId,
-    keyId,
-    keyVersion: 1,
-    ...normalizeAuthorityWindow(value, 'offlineExportProductionTransformAuthority'),
-    sourceAuthority,
-    authenticatedRehearsalAttestationSha256: readSha256(
-      value.authenticatedRehearsalAttestationSha256,
-      'offlineExportProductionTransformAuthority.authenticatedRehearsalAttestationSha256',
-    ),
-  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1,
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportProductionTransformAuthority');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(valueArg),
-  'offlineExportProductionTransformAuthority',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(valueArg),
-);
-
-export const createCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference = (
-  authorityArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReferenceV1
-> => {
-  const authority =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
-      authorityArg,
-    );
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-authority-reference',
-    role: 'production-transform',
-    operationId: authority.operationId,
-    settlementId: authority.settlementId,
-    authorityId: authority.authorityId,
-    keyId: authority.keyId,
-    keyVersion: 1,
-    authorityMetadataSha256:
-      digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
-        authority,
-      ),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthorityBytes,
-  'offlineExportProductionTransformAuthorityReference');
-};
-
-const assertProductionReferenceMatchesAuthority = (
-  referenceArg: unknown,
-  authorityArg: unknown,
-  pathArg: string,
-): void => {
-  const reference =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference(
-      referenceArg,
-    );
-  const expected =
-    createCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityReference(
-      authorityArg,
-    );
-  if (!canonicalEqual(reference, expected, pathArg)) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityForRehearsal = async (
-  productionAuthorityArg: unknown,
-  sourceAuthorityArg: unknown,
-  rehearsalAttestationArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityV1
->> => {
-  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
-    sourceAuthorityArg,
-  );
-  const rehearsal =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority(
-      rehearsalAttestationArg,
-      sourceAuthority,
-      verifierArg,
-    );
-  const productionAuthority =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
-      productionAuthorityArg,
-    );
-  assertSourceReferenceMatchesAuthority(
-    productionAuthority.sourceAuthority,
-    sourceAuthority,
-    'offlineExportProductionTransformAuthority.sourceAuthority',
-  );
-  if (productionAuthority.authenticatedRehearsalAttestationSha256
-      !== digestCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(rehearsal)
-    || productionAuthority.issuedAt <= rehearsal.completedAt) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthority.rehearsal');
-  }
-  return productionAuthority;
-};
-
-const normalizeAuthorizationPayloadInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, authorizationPayloadKeys, pathArg);
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization') {
-    fail('INVALID_VALUE', `${pathArg}.kind`);
-  }
-  const authority = normalizeAuthorityReferenceInternal(
-    value.authority,
-    `${pathArg}.authority`,
-    'production-transform',
-  );
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    `${pathArg}.sourceAuthority`,
-    'source-rehearsal',
-  );
-  const requestedAt = readInteger(value.requestedAt, `${pathArg}.requestedAt`, 1);
-  const authorizedAt = readInteger(value.authorizedAt, `${pathArg}.authorizedAt`, requestedAt);
-  if (authority.operationId !== sourceAuthority.operationId
-    || authority.settlementId !== sourceAuthority.settlementId
-    || authority.authorityId === sourceAuthority.authorityId
-    || authority.keyId === sourceAuthority.keyId
-    || canonicalEqual(authority, sourceAuthority, `${pathArg}.authorities`)) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.authority`);
-  }
-  return {
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-production-transform-authorization',
-    authority,
-    sourceAuthority,
-    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
-    authenticatedRehearsalAttestationSha256: readSha256(
-      value.authenticatedRehearsalAttestationSha256,
-      `${pathArg}.authenticatedRehearsalAttestationSha256`,
-    ),
-    planSha256: readSha256(value.planSha256, `${pathArg}.planSha256`),
-    requestSha256: readSha256(value.requestSha256, `${pathArg}.requestSha256`),
-    requestedAt,
-    authorizedAt,
-  };
-};
-
-const authorizationPayload = (
-  valueArg:
-    ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayloadV1,
-): unknown => Object.fromEntries(authorizationPayloadKeys.map((keyArg) => [
-  keyArg,
-  valueArg[keyArg],
-]));
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayload = (
-  valueArg: unknown,
-): string => digestBytes(encodeNormalized(
-  authorizationPayload(normalizeAuthorizationPayloadInternal(
-    valueArg,
-    'offlineExportProductionTransformAuthorizationPayload',
-  )),
-  'offlineExportProductionTransformAuthorizationPayload',
-));
-
-const normalizeUnsignedAuthorizationInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedProductionTransformAuthorizationV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, authorizationUnsignedKeys, pathArg);
-  const payload = normalizeAuthorizationPayloadInternal(
-    Object.fromEntries(authorizationPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
-    `${pathArg}.payload`,
-  );
-  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
-  if (payloadSha256
-    !== digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationPayload(
-      payload,
-    )) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
-  }
-  return { ...payload, payloadSha256 };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
-> => {
-  const value = readRecord(valueArg, 'offlineExportProductionTransformAuthorization');
-  assertExactKeys(value, authorizationKeys, 'offlineExportProductionTransformAuthorization');
-  return finalize({
-    ...normalizeUnsignedAuthorizationInternal(
-      Object.fromEntries(authorizationUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
-      'offlineExportProductionTransformAuthorization.unsigned',
-    ),
-    mac: readMac(value.mac, 'offlineExportProductionTransformAuthorization.mac'),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
-  'offlineExportProductionTransformAuthorization');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
-    valueArg,
-  ),
-  'offlineExportProductionTransformAuthorization',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(valueArg),
-);
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationHmacInput = (
-  valueArg: unknown,
-): Uint8Array => frame(
-  cloudlyLegacyDeploymentSettlementOfflineExportDomains
-    .productionTransformAuthorizationHmac,
-  encodeNormalized(
-    finalize(
-      normalizeUnsignedAuthorizationInternal(
-        valueArg,
-        'offlineExportUnsignedProductionTransformAuthorization',
-      ),
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumAuthenticatedArtifactBytes,
-      'offlineExportUnsignedProductionTransformAuthorization',
-    ),
-    'offlineExportUnsignedProductionTransformAuthorization',
-  ),
-);
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationForAuthorities = async (
-  authorizationArg: unknown,
-  productionAuthorityArg: unknown,
-  sourceAuthorityArg: unknown,
-  rehearsalAttestationArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationV1
->> => {
-  const sourceAuthority = normalizeCloudlyLegacyDeploymentSettlementOfflineExportSourceAuthority(
-    sourceAuthorityArg,
-  );
-  const rehearsal =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestationForAuthority(
-      rehearsalAttestationArg,
-      sourceAuthority,
-      verifierArg,
-    );
-  const productionAuthority =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorityForRehearsal(
-      productionAuthorityArg,
-      sourceAuthority,
-      rehearsal,
-      verifierArg,
-    );
-  const authorization =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
-      authorizationArg,
-    );
-  assertProductionReferenceMatchesAuthority(
-    authorization.authority,
-    productionAuthority,
-    'offlineExportProductionTransformAuthorization.authority',
-  );
-  assertSourceReferenceMatchesAuthority(
-    authorization.sourceAuthority,
-    sourceAuthority,
-    'offlineExportProductionTransformAuthorization.sourceAuthority',
-  );
-  if (authorization.authenticatedRehearsalAttestationSha256
-      !== productionAuthority.authenticatedRehearsalAttestationSha256
-    || authorization.planSha256 !== rehearsal.planSha256
-    || authorization.requestedAt < productionAuthority.issuedAt) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportProductionTransformAuthorization.sourceProof');
-  }
-  assertTimestampWithinAuthority(
-    authorization.requestedAt,
-    productionAuthority,
-    'offlineExportProductionTransformAuthorization.requestedAt',
-  );
-  assertTimestampWithinAuthority(
-    authorization.authorizedAt,
-    productionAuthority,
-    'offlineExportProductionTransformAuthorization.authorizedAt',
-  );
-  await requireVerifiedHmac(
-    authorization.authority,
-    cloudlyLegacyDeploymentSettlementOfflineExportDomains
-      .productionTransformAuthorizationHmac,
-    encodeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationHmacInput(
-      withoutMac(authorization),
-    ),
-    authorization.mac,
-    verifierArg,
-    'offlineExportProductionTransformAuthorization.mac',
-  );
-  return authorization;
-};
-
-const normalizeJournalSeedInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalSeedV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, journalSeedKeys, pathArg);
-  if (value.schemaVersion !== 1
-    || value.kind !== cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName
-    || value.purpose !== 'production-transform') {
-    fail('INVALID_VALUE', `${pathArg}.kind`);
-  }
-  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
-  const settlementId = readIdentifier(value.settlementId, `${pathArg}.settlementId`);
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    `${pathArg}.sourceAuthority`,
-    'source-rehearsal',
-  );
-  const productionTransformAuthority = normalizeAuthorityReferenceInternal(
-    value.productionTransformAuthority,
-    `${pathArg}.productionTransformAuthority`,
-    'production-transform',
-  );
-  const sourceFile = normalizeFileIdentityInternal(value.sourceFile, `${pathArg}.sourceFile`);
-  const transformedCoreFile = normalizeFileIdentityInternal(
-    value.transformedCoreFile,
-    `${pathArg}.transformedCoreFile`,
-  );
-  const sourceStateHmac = readStateHmac(
-    value.sourceStateHmac,
-    `${pathArg}.sourceStateHmac`,
-  );
-  const finalStateHmac = readStateHmac(
-    value.finalStateHmac,
-    `${pathArg}.finalStateHmac`,
-  );
-  const outcome = readLiteral(
-    value.outcome,
-    ['transformed', 'no-op'],
-    `${pathArg}.outcome`,
-  );
-  const counts = normalizeMutationCounts(value.counts, `${pathArg}.counts`);
-  const classificationCounts = normalizeClassificationCounts(
-    value.classificationCounts,
-    `${pathArg}.classificationCounts`,
-  );
-  assertCountsMatchClassifications(counts, classificationCounts, `${pathArg}.counts`);
-  if (operationId !== sourceAuthority.operationId
-    || operationId !== productionTransformAuthority.operationId
-    || settlementId !== sourceAuthority.settlementId
-    || settlementId !== productionTransformAuthority.settlementId
-    || sourceAuthority.authorityId === productionTransformAuthority.authorityId
-    || sourceAuthority.keyId === productionTransformAuthority.keyId
-    || sourceFile.databaseName !== transformedCoreFile.databaseName
-    || (outcome === 'no-op') !== hasNoMutations(counts)
-    || (outcome === 'no-op') !== (sourceStateHmac === finalStateHmac)
-    || (outcome === 'no-op') !== canonicalEqual(
-      sourceFile,
-      transformedCoreFile,
-      `${pathArg}.fileIdentity`,
-    )) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.sourceProof`);
-  }
-  return {
-    schemaVersion: 1,
-    kind: cloudlyLegacyDeploymentSettlementOfflineExportJournalCollectionName,
-    purpose: 'production-transform',
-    operationId,
-    settlementId,
-    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
-    sourceAuthority,
-    productionTransformAuthority,
-    authenticatedRehearsalAttestationSha256: readSha256(
-      value.authenticatedRehearsalAttestationSha256,
-      `${pathArg}.authenticatedRehearsalAttestationSha256`,
-    ),
-    transformAuthorizationSha256: readSha256(
-      value.transformAuthorizationSha256,
-      `${pathArg}.transformAuthorizationSha256`,
-    ),
-    planSha256: readSha256(value.planSha256, `${pathArg}.planSha256`),
-    requestSha256: readSha256(value.requestSha256, `${pathArg}.requestSha256`),
-    sourceFile,
-    transformedCoreFile,
-    sourceStateHmac,
-    finalStateHmac,
-    outcome,
-    counts,
-    classificationCounts,
-    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
-  };
-};
-
-export const createCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalId = (
-  seedArg: unknown,
-): string => {
-  const seed = normalizeJournalSeedInternal(seedArg, 'offlineExportAttemptJournal.seed');
-  return `offline-export-attempt-${digestBytes(encodeNormalized(
-    seed,
-    'offlineExportAttemptJournal.seed',
-  )).slice(0, 40)}`;
-};
-
-const normalizeUnsignedJournalInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedAttemptJournalV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, journalUnsignedKeys, pathArg);
-  const seed = normalizeJournalSeedInternal(
-    Object.fromEntries(journalSeedKeys.map((keyArg) => [keyArg, value[keyArg]])),
-    `${pathArg}.seed`,
-  );
-  const id = readIdentifier(value._id, `${pathArg}._id`);
-  if (id !== createCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalId(seed)) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}._id`);
-  }
-  return { _id: id, ...seed };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
-  valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1> => {
-  const value = readRecord(valueArg, 'offlineExportAttemptJournal');
-  assertExactKeys(value, journalKeys, 'offlineExportAttemptJournal');
-  return finalize({
-    ...normalizeUnsignedJournalInternal(
-      Object.fromEntries(journalUnsignedKeys.map((keyArg) => [keyArg, value[keyArg]])),
-      'offlineExportAttemptJournal.unsigned',
-    ),
-    mac: readMac(value.mac, 'offlineExportAttemptJournal.mac'),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalCanonicalBytes,
-  'offlineExportAttemptJournal');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(valueArg),
-  'offlineExportAttemptJournal',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(valueArg),
-);
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalHmacInput = (
-  valueArg: unknown,
-): Uint8Array => frame(
-  cloudlyLegacyDeploymentSettlementOfflineExportDomains.attemptJournalHmac,
-  encodeNormalized(
-    finalize(
-      normalizeUnsignedJournalInternal(valueArg, 'offlineExportUnsignedAttemptJournal'),
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalCanonicalBytes,
-      'offlineExportUnsignedAttemptJournal',
-    ),
-    'offlineExportUnsignedAttemptJournal',
-  ),
-);
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalForAuthorities = async (
-  journalArg: unknown,
-  authorizationArg: unknown,
-  productionAuthorityArg: unknown,
-  sourceAuthorityArg: unknown,
-  rehearsalAttestationArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1>> => {
-  const authorization =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorizationForAuthorities(
-      authorizationArg,
-      productionAuthorityArg,
-      sourceAuthorityArg,
-      rehearsalAttestationArg,
-      verifierArg,
-    );
-  const productionAuthority =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
-      productionAuthorityArg,
-    );
-  const rehearsal =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportRehearsalAttestation(
-      rehearsalAttestationArg,
-    );
-  const journal = normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(
-    journalArg,
-  );
-  if (!canonicalEqual(
-      journal.sourceAuthority,
-      authorization.sourceAuthority,
-      'offlineExportAttemptJournal.sourceAuthority',
-    )
-    || !canonicalEqual(
-      journal.productionTransformAuthority,
-      authorization.authority,
-      'offlineExportAttemptJournal.productionTransformAuthority',
-    )
-    || journal.attemptId !== authorization.attemptId
-    || journal.authenticatedRehearsalAttestationSha256
-      !== authorization.authenticatedRehearsalAttestationSha256
-    || journal.transformAuthorizationSha256
-      !== digestCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthorization(
-        authorization,
-      )
-    || journal.planSha256 !== authorization.planSha256
-    || journal.requestSha256 !== authorization.requestSha256
-    || !canonicalEqual(
-      journal.sourceFile,
-      rehearsal.plan.sourceFile,
-      'offlineExportAttemptJournal.sourceFile',
-    )
-    || journal.sourceStateHmac !== rehearsal.plan.sourceStateHmac
-    || journal.finalStateHmac !== rehearsal.plan.finalStateHmac
-    || !canonicalEqual(journal.counts, rehearsal.plan.counts, 'offlineExportAttemptJournal.counts')
-    || !canonicalEqual(
-      journal.classificationCounts,
-      rehearsal.plan.classificationCounts,
-      'offlineExportAttemptJournal.classificationCounts',
-    )
-    || journal.completedAt < authorization.authorizedAt) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportAttemptJournal.sourceProof');
-  }
-  assertTimestampWithinAuthority(
-    journal.completedAt,
-    productionAuthority,
-    'offlineExportAttemptJournal.completedAt',
-  );
-  await requireVerifiedHmac(
-    journal.productionTransformAuthority,
-    cloudlyLegacyDeploymentSettlementOfflineExportDomains.attemptJournalHmac,
-    encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalHmacInput(
-      withoutMac(journal),
-    ),
-    journal.mac,
-    verifierArg,
-    'offlineExportAttemptJournal.mac',
-  );
-  return journal;
-};
-
-const normalizeCompleteOutputReceiptPayloadInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, completeOutputReceiptPayloadKeys, pathArg);
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt') {
-    fail('INVALID_VALUE', `${pathArg}.kind`);
-  }
-  const authority = normalizeAuthorityReferenceInternal(
-    value.authority,
-    `${pathArg}.authority`,
-    'production-transform',
-  );
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    `${pathArg}.sourceAuthority`,
-    'source-rehearsal',
-  );
-  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
-  const settlementId = readIdentifier(value.settlementId, `${pathArg}.settlementId`);
-  const transformedCoreFile = normalizeFileIdentityInternal(
-    value.transformedCoreFile,
-    `${pathArg}.transformedCoreFile`,
-  );
-  const completeOutputFile = normalizeFileIdentityInternal(
-    value.completeOutputFile,
-    `${pathArg}.completeOutputFile`,
-  );
-  const journalGrowthBytes = readInteger(
-    value.journalGrowthBytes,
-    `${pathArg}.journalGrowthBytes`,
-    1,
-    cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumJournalGrowthBytes,
-  );
-  if (operationId !== authority.operationId
-    || operationId !== sourceAuthority.operationId
-    || settlementId !== authority.settlementId
-    || settlementId !== sourceAuthority.settlementId
-    || authority.authorityId === sourceAuthority.authorityId
-    || authority.keyId === sourceAuthority.keyId
-    || transformedCoreFile.databaseName !== completeOutputFile.databaseName
-    || completeOutputFile.byteLength - transformedCoreFile.byteLength !== journalGrowthBytes) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.completeOutputFile`);
-  }
-  return {
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-complete-output-receipt',
-    authority,
-    sourceAuthority,
-    operationId,
-    settlementId,
-    attemptId: readIdentifier(value.attemptId, `${pathArg}.attemptId`),
-    journalSha256: readSha256(value.journalSha256, `${pathArg}.journalSha256`),
-    transformedCoreFile,
-    completeOutputFile,
-    journalGrowthBytes,
-    completedAt: readInteger(value.completedAt, `${pathArg}.completedAt`, 1),
-  };
-};
-
-const completeOutputReceiptPayload = (
-  valueArg:
-    ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayloadV1,
-): unknown => Object.fromEntries(completeOutputReceiptPayloadKeys.map((keyArg) => [
-  keyArg,
-  valueArg[keyArg],
-]));
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayload = (
-  valueArg: unknown,
-): string => digestBytes(encodeNormalized(
-  completeOutputReceiptPayload(normalizeCompleteOutputReceiptPayloadInternal(
-    valueArg,
-    'offlineExportCompleteOutputReceiptPayload',
-  )),
-  'offlineExportCompleteOutputReceiptPayload',
-));
-
-const normalizeUnsignedCompleteOutputReceiptInternal = (
-  valueArg: unknown,
-  pathArg: string,
-): TCloudlyLegacyDeploymentSettlementOfflineExportUnsignedCompleteOutputReceiptV1 => {
-  const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, completeOutputReceiptUnsignedKeys, pathArg);
-  const payload = normalizeCompleteOutputReceiptPayloadInternal(
-    Object.fromEntries(completeOutputReceiptPayloadKeys.map((keyArg) => [keyArg, value[keyArg]])),
-    `${pathArg}.payload`,
-  );
-  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
-  if (payloadSha256
-    !== digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptPayload(
-      payload,
-    )) {
-    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
-  }
-  return { ...payload, payloadSha256 };
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
-  valueArg: unknown,
-): Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
-> => {
-  const value = readRecord(valueArg, 'offlineExportCompleteOutputReceipt');
-  assertExactKeys(value, completeOutputReceiptKeys, 'offlineExportCompleteOutputReceipt');
-  return finalize({
-    ...normalizeUnsignedCompleteOutputReceiptInternal(
-      Object.fromEntries(completeOutputReceiptUnsignedKeys.map((keyArg) => [
-        keyArg,
-        value[keyArg],
-      ])),
-      'offlineExportCompleteOutputReceipt.unsigned',
-    ),
-    mac: readMac(value.mac, 'offlineExportCompleteOutputReceipt.mac'),
-  }, cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumReceiptBytes,
-  'offlineExportCompleteOutputReceipt');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(valueArg),
-  'offlineExportCompleteOutputReceipt',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(valueArg),
-);
-
-const assertCompleteOutputReceiptMatchesJournal = (
-  receiptArg: Readonly<
-    ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
-  >,
-  journalArg: Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalV1>,
-  pathArg: string,
-): void => {
-  if (!canonicalEqual(receiptArg.authority, journalArg.productionTransformAuthority, pathArg)
-    || !canonicalEqual(receiptArg.sourceAuthority, journalArg.sourceAuthority, pathArg)
-    || receiptArg.operationId !== journalArg.operationId
-    || receiptArg.settlementId !== journalArg.settlementId
-    || receiptArg.attemptId !== journalArg.attemptId
-    || receiptArg.journalSha256
-      !== digestCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg)
-    || !canonicalEqual(receiptArg.transformedCoreFile, journalArg.transformedCoreFile, pathArg)
-    || receiptArg.journalGrowthBytes
-      < encodeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg).byteLength
-    || receiptArg.completedAt < journalArg.completedAt) {
-    fail('CROSS_FIELD_MISMATCH', pathArg);
-  }
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptHmacInput = (
-  valueArg: unknown,
-): Uint8Array => frame(
-  cloudlyLegacyDeploymentSettlementOfflineExportDomains.completeOutputReceiptHmac,
-  encodeNormalized(
-    finalize(
-      normalizeUnsignedCompleteOutputReceiptInternal(
-        valueArg,
-        'offlineExportUnsignedCompleteOutputReceipt',
-      ),
-      cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumReceiptBytes,
-      'offlineExportUnsignedCompleteOutputReceipt',
-    ),
-    'offlineExportUnsignedCompleteOutputReceipt',
-  ),
-);
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptForAuthorities = async (
-  receiptArg: unknown,
-  journalArg: unknown,
-  authorizationArg: unknown,
-  productionAuthorityArg: unknown,
-  sourceAuthorityArg: unknown,
-  rehearsalAttestationArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptV1
->> => {
-  const journal =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournalForAuthorities(
-      journalArg,
-      authorizationArg,
-      productionAuthorityArg,
-      sourceAuthorityArg,
-      rehearsalAttestationArg,
-      verifierArg,
-    );
-  const productionAuthority =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportProductionTransformAuthority(
-      productionAuthorityArg,
-    );
-  const receipt =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receiptArg);
-  assertCompleteOutputReceiptMatchesJournal(
-    receipt,
-    journal,
-    'offlineExportCompleteOutputReceipt.sourceProof',
-  );
-  assertTimestampWithinAuthority(
-    receipt.completedAt,
-    productionAuthority,
-    'offlineExportCompleteOutputReceipt.completedAt',
-  );
-  await requireVerifiedHmac(
-    receipt.authority,
-    cloudlyLegacyDeploymentSettlementOfflineExportDomains.completeOutputReceiptHmac,
-    encodeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptHmacInput(
-      withoutMac(receipt),
-    ),
-    receipt.mac,
-    verifierArg,
-    'offlineExportCompleteOutputReceipt.mac',
-  );
-  return receipt;
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
-  valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1> => {
-  const value = readRecord(valueArg, 'offlineExportTransformResult');
-  assertExactKeys(value, [
-    'schemaVersion',
-    'kind',
-    'status',
-    'operationId',
-    'settlementId',
-    'attemptId',
-    'sourceAuthority',
-    'productionTransformAuthority',
-    'planSha256',
-    'requestSha256',
-    'completeOutputReceiptSha256',
-    'outcome',
-    'counts',
-    'classificationCounts',
-    'completedAt',
-  ], 'offlineExportTransformResult');
-  if (value.schemaVersion !== 1
-    || value.kind
-      !== 'cloudly-legacy-deployment-settlement-offline-export-transform-result'
-    || value.status !== 'completed') {
-    fail('INVALID_VALUE', 'offlineExportTransformResult.kind');
-  }
-  const sourceAuthority = normalizeAuthorityReferenceInternal(
-    value.sourceAuthority,
-    'offlineExportTransformResult.sourceAuthority',
-    'source-rehearsal',
-  );
-  const productionTransformAuthority = normalizeAuthorityReferenceInternal(
-    value.productionTransformAuthority,
-    'offlineExportTransformResult.productionTransformAuthority',
-    'production-transform',
-  );
-  const operationId = readIdentifier(value.operationId, 'offlineExportTransformResult.operationId');
-  const settlementId = readIdentifier(
-    value.settlementId,
-    'offlineExportTransformResult.settlementId',
-  );
-  const counts = normalizeMutationCounts(value.counts, 'offlineExportTransformResult.counts');
-  const classificationCounts = normalizeClassificationCounts(
-    value.classificationCounts,
-    'offlineExportTransformResult.classificationCounts',
-  );
-  const outcome = readLiteral(
-    value.outcome,
-    ['transformed', 'no-op'],
-    'offlineExportTransformResult.outcome',
-  );
-  assertCountsMatchClassifications(counts, classificationCounts, 'offlineExportTransformResult.counts');
-  if (operationId !== sourceAuthority.operationId
-    || operationId !== productionTransformAuthority.operationId
-    || settlementId !== sourceAuthority.settlementId
-    || settlementId !== productionTransformAuthority.settlementId
-    || sourceAuthority.authorityId === productionTransformAuthority.authorityId
-    || sourceAuthority.keyId === productionTransformAuthority.keyId
-    || (outcome === 'no-op') !== hasNoMutations(counts)) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportTransformResult.authority');
-  }
-  return finalize({
-    schemaVersion: 1,
-    kind: 'cloudly-legacy-deployment-settlement-offline-export-transform-result',
-    status: 'completed',
-    operationId,
-    settlementId,
-    attemptId: readIdentifier(value.attemptId, 'offlineExportTransformResult.attemptId'),
-    sourceAuthority,
-    productionTransformAuthority,
-    planSha256: readSha256(value.planSha256, 'offlineExportTransformResult.planSha256'),
-    requestSha256: readSha256(
-      value.requestSha256,
-      'offlineExportTransformResult.requestSha256',
-    ),
-    completeOutputReceiptSha256: readSha256(
-      value.completeOutputReceiptSha256,
-      'offlineExportTransformResult.completeOutputReceiptSha256',
-    ),
-    outcome,
-    counts,
-    classificationCounts,
-    completedAt: readInteger(value.completedAt, 'offlineExportTransformResult.completedAt', 1),
-  } satisfies ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1,
-  cloudlyLegacyDeploymentSettlementOfflineExportLimits.maximumResultBytes,
-  'offlineExportTransformResult');
-};
-
-export const encodeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
-  valueArg: unknown,
-): Uint8Array => encodeNormalized(
-  normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(valueArg),
-  'offlineExportTransformResult',
-);
-
-export const digestCloudlyLegacyDeploymentSettlementOfflineExportTransformResult = (
-  valueArg: unknown,
-): string => digestBytes(
-  encodeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(valueArg),
-);
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForCompleteOutputReceipt = (
-  resultArg: unknown,
-  receiptArg: unknown,
-  journalArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1> => {
-  const result = normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResult(resultArg);
-  const receipt =
-    normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receiptArg);
-  const journal = normalizeCloudlyLegacyDeploymentSettlementOfflineExportAttemptJournal(journalArg);
-  assertCompleteOutputReceiptMatchesJournal(
-    receipt,
-    journal,
-    'offlineExportTransformResult.completeOutputReceipt',
-  );
-  if (result.completeOutputReceiptSha256
-      !== digestCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceipt(receipt)
-    || !canonicalEqual(
-      result.sourceAuthority,
-      receipt.sourceAuthority,
-      'offlineExportTransformResult.sourceAuthority',
-    )
-    || !canonicalEqual(
-      result.productionTransformAuthority,
-      receipt.authority,
-      'offlineExportTransformResult.productionTransformAuthority',
-    )
-    || result.operationId !== receipt.operationId
-    || result.settlementId !== receipt.settlementId
-    || result.attemptId !== receipt.attemptId
-    || result.planSha256 !== journal.planSha256
-    || result.requestSha256 !== journal.requestSha256
-    || result.outcome !== journal.outcome
-    || !canonicalEqual(result.counts, journal.counts, 'offlineExportTransformResult.counts')
-    || !canonicalEqual(
-      result.classificationCounts,
-      journal.classificationCounts,
-      'offlineExportTransformResult.classificationCounts',
-    )
-    || result.completedAt !== receipt.completedAt) {
-    fail('CROSS_FIELD_MISMATCH', 'offlineExportTransformResult.completeOutputReceipt');
-  }
-  return result;
-};
-
-export const normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForAuthorities = async (
-  resultArg: unknown,
-  receiptArg: unknown,
-  journalArg: unknown,
-  authorizationArg: unknown,
-  productionAuthorityArg: unknown,
-  sourceAuthorityArg: unknown,
-  rehearsalAttestationArg: unknown,
-  verifierArg: TCloudlyLegacyDeploymentSettlementOfflineExportHmacVerifier,
-): Promise<Readonly<
-  ICloudlyLegacyDeploymentSettlementOfflineExportTransformResultV1
->> => {
-  const receipt =
-    await normalizeCloudlyLegacyDeploymentSettlementOfflineExportCompleteOutputReceiptForAuthorities(
-      receiptArg,
-      journalArg,
-      authorizationArg,
-      productionAuthorityArg,
-      sourceAuthorityArg,
-      rehearsalAttestationArg,
-      verifierArg,
-    );
-  return normalizeCloudlyLegacyDeploymentSettlementOfflineExportTransformResultForCompleteOutputReceipt(
-    resultArg,
-    receipt,
-    journalArg,
-  );
-};
-
-export {
-  cloudlyLegacyDeploymentSettlementOfflineExportGoldenVectors,
-} from './runtime.cloudlylegacydeploymentsettlement.offlineexport.golden.js';