@splitin/verification-engine 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,2056 @@
+import { assertAdapterConformsToManifest, isTerminalStatus, ProviderError, toSafeProviderFailure, ProviderOperationPendingError, isCountryCode, metadataContainsForbiddenIdentifier } from '@splitin/verification-adapter-sdk';
+
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/hash.ts
+var hash_exports = {};
+__export(hash_exports, {
+  bytesToHex: () => bytesToHex,
+  cohortBucket: () => cohortBucket,
+  hmacSha256Hex: () => hmacSha256Hex,
+  newId: () => newId,
+  randomToken: () => randomToken,
+  sha256Hex: () => sha256Hex
+});
+function bytesToHex(value) {
+  return Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(payload) {
+  const bytes = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+async function hmacSha256Hex(secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const bytes = typeof payload === "string" ? new TextEncoder().encode(payload) : payload;
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, bytes)));
+}
+function randomToken(cryptoImpl = globalThis.crypto) {
+  const bytes = new Uint8Array(32);
+  cryptoImpl.getRandomValues(bytes);
+  return bytesToHex(bytes);
+}
+function newId(prefix, cryptoImpl = globalThis.crypto) {
+  return `${prefix}_${cryptoImpl.randomUUID().replace(/-/g, "")}`;
+}
+async function cohortBucket(tenantKey, subjectHash) {
+  const hex = await sha256Hex(`${tenantKey}:${subjectHash}`);
+  return Number.parseInt(hex.slice(0, 8), 16) % 100;
+}
+var init_hash = __esm({
+  "src/hash.ts"() {
+  }
+});
+
+// src/errors.ts
+var EngineError = class extends Error {
+  constructor(code, message, retryable = false, retryAfterSeconds) {
+    super(message);
+    this.code = code;
+    this.retryable = retryable;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "EngineError";
+  }
+  code;
+  retryable;
+  retryAfterSeconds;
+};
+var AuthorizationError = class extends EngineError {
+  constructor(message = "The actor is not authorized for this verification operation.") {
+    super("AUTHORIZATION_DENIED", message, false);
+    this.name = "AuthorizationError";
+  }
+};
+var ClientRouteInjectionError = class extends EngineError {
+  constructor(message = "Verification routing is server-owned and cannot be selected by the client.") {
+    super("CLIENT_ROUTE_INJECTION", message, false);
+    this.name = "ClientRouteInjectionError";
+  }
+};
+var WebhookSecurityIncidentError = class extends EngineError {
+  constructor(message = "A webhook event key collided with a different body digest.") {
+    super("WEBHOOK_SECURITY_INCIDENT", message, false);
+    this.name = "WebhookSecurityIncidentError";
+  }
+};
+
+// src/canonical.ts
+function canonicalize(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const record = value;
+    return Object.fromEntries(
+      Object.keys(record).sort().map((key) => [key, sortValue(record[key])])
+    );
+  }
+  return value;
+}
+async function digestCanonical(value) {
+  const { sha256Hex: sha256Hex2 } = await Promise.resolve().then(() => (init_hash(), hash_exports));
+  return sha256Hex2(canonicalize(value));
+}
+
+// src/index.ts
+init_hash();
+function createProviderRegistry(input) {
+  if (!input.adapters.length) {
+    throw new EngineError("INVALID_COMMAND", "A verification provider registry requires at least one compiled-in adapter.");
+  }
+  const adapters = /* @__PURE__ */ new Map();
+  for (const adapter of input.adapters) {
+    assertAdapterConformsToManifest(adapter);
+    const key = registryKey(adapter.provider, adapter.environment);
+    if (adapters.has(key)) {
+      throw new EngineError("INVALID_COMMAND", `Duplicate compiled-in adapter for ${key}.`);
+    }
+    adapters.set(key, adapter);
+  }
+  return {
+    get(provider, environment) {
+      if (environment) {
+        const exact = adapters.get(registryKey(provider, environment));
+        if (exact) return exact;
+      }
+      const match = [...adapters.values()].find((adapter) => adapter.provider === provider && (!environment || adapter.environment === environment));
+      if (!match) {
+        throw new EngineError("NO_ELIGIBLE_ROUTE", `No compiled-in adapter is registered for provider "${provider}".`);
+      }
+      return match;
+    },
+    list: () => [...adapters.values()],
+    has: (provider) => [...adapters.values()].some((adapter) => adapter.provider === provider)
+  };
+}
+function registryKey(provider, environment) {
+  return `${provider}:${environment}`;
+}
+
+// src/memory-store.ts
+init_hash();
+var AsyncMutex = class {
+  chain = Promise.resolve();
+  run(fn) {
+    const run = this.chain.then(fn, fn);
+    this.chain = run.then(() => void 0, () => void 0);
+    return run;
+  }
+};
+function clone(value) {
+  return structuredClone(value);
+}
+function createMemoryStore(options = {}) {
+  const hashSecret = options.hashSecret ?? "test-verification-hash-secret";
+  const nowFn = options.now ?? (() => /* @__PURE__ */ new Date());
+  const seedTenantKey = options.seedTenantKey ?? "default";
+  const mutex = new AsyncMutex();
+  const keyLocks = /* @__PURE__ */ new Map();
+  const tenants = /* @__PURE__ */ new Map();
+  const configs = /* @__PURE__ */ new Map();
+  const providers = /* @__PURE__ */ new Map();
+  const routes = /* @__PURE__ */ new Map();
+  const routeChanges = /* @__PURE__ */ new Map();
+  const policies = /* @__PURE__ */ new Map();
+  const requirements = /* @__PURE__ */ new Map();
+  const attempts = /* @__PURE__ */ new Map();
+  const lineage = /* @__PURE__ */ new Map();
+  const decisions = /* @__PURE__ */ new Map();
+  const idempotency = /* @__PURE__ */ new Map();
+  const webhooks = /* @__PURE__ */ new Map();
+  const health = /* @__PURE__ */ new Map();
+  const circuits = /* @__PURE__ */ new Map();
+  const appeals = /* @__PURE__ */ new Map();
+  const reviews = /* @__PURE__ */ new Map();
+  const proposals = /* @__PURE__ */ new Map();
+  const continuations = /* @__PURE__ */ new Map();
+  const audit = /* @__PURE__ */ new Map();
+  const jobs = /* @__PURE__ */ new Map();
+  const iso = () => nowFn().toISOString();
+  const k = (...parts) => parts.join("::");
+  const lockFor = (key) => {
+    let lock = keyLocks.get(key);
+    if (!lock) {
+      lock = new AsyncMutex();
+      keyLocks.set(key, lock);
+    }
+    return lock;
+  };
+  const seedTenant = {
+    tenantKey: seedTenantKey,
+    displayName: "Default tenant",
+    continuationDestinations: ["verification.resume", "application.home"],
+    createdAt: iso()
+  };
+  tenants.set(seedTenantKey, seedTenant);
+  const sandboxPolicy = {
+    tenantKey: seedTenantKey,
+    id: "pol_sandbox_example",
+    version: "sandbox-example-1",
+    environment: "sandbox",
+    lifecycle: "active",
+    reason: "Seeded sandbox example policy",
+    expiresAt: null,
+    proposedByActorId: "system:seed",
+    approvedByActorId: "system:seed-approver",
+    approvedAt: iso(),
+    activatedAt: iso(),
+    createdAt: iso(),
+    decisionRetentionDays: null,
+    providerRedactionDelayDays: null,
+    appealHoldDays: null,
+    legalHold: false
+  };
+  policies.set(k(seedTenantKey, sandboxPolicy.id), sandboxPolicy);
+  const store = {
+    now: nowFn,
+    async hashSubject(tenantKey, subjectReference) {
+      return hmacSha256Hex(hashSecret, `subject:${tenantKey}:${subjectReference}`);
+    },
+    async hashResource(tenantKey, resourceType, resourceReference) {
+      return hmacSha256Hex(hashSecret, `resource:${tenantKey}:${resourceType}:${resourceReference}`);
+    },
+    transact(fn) {
+      return mutex.run(() => fn(store));
+    },
+    async getTenant(tenantKey) {
+      return tenants.get(tenantKey) ? clone(tenants.get(tenantKey)) : null;
+    },
+    async ensureTenant(tenantKey, displayName = tenantKey) {
+      const existing = tenants.get(tenantKey);
+      if (existing) return clone(existing);
+      const created = {
+        tenantKey,
+        displayName,
+        continuationDestinations: ["verification.resume"],
+        createdAt: iso()
+      };
+      tenants.set(tenantKey, created);
+      return clone(created);
+    },
+    async getConfigurationRevision(tenantKey, id) {
+      const row = configs.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listConfigurationRevisions(tenantKey) {
+      return [...configs.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveConfigurationRevision(revision) {
+      configs.set(k(revision.tenantKey, revision.id), clone(revision));
+    },
+    async upsertProviderDefinition(definition) {
+      providers.set(k(definition.tenantKey, definition.provider, definition.environment), clone(definition));
+    },
+    async getProviderDefinition(tenantKey, provider, environment) {
+      const row = providers.get(k(tenantKey, provider, environment));
+      return row ? clone(row) : null;
+    },
+    async listProviderDefinitions(tenantKey) {
+      return [...providers.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async getRoute(tenantKey, routeId) {
+      const row = routes.get(k(tenantKey, routeId));
+      return row ? clone(row) : null;
+    },
+    async listRoutes(tenantKey) {
+      return [...routes.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async listActiveRoutes(tenantKey, environment) {
+      return [...routes.values()].filter((row) => row.tenantKey === tenantKey && row.environment === environment && row.lifecycle === "active").map(clone);
+    },
+    async saveRoute(route) {
+      routes.set(k(route.tenantKey, route.id), clone(route));
+    },
+    async saveRouteChangeRequest(request) {
+      routeChanges.set(k(request.tenantKey, request.id), clone(request));
+    },
+    async getRouteChangeRequest(tenantKey, id) {
+      const row = routeChanges.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listRouteChangeRequests(tenantKey) {
+      return [...routeChanges.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async getActivePolicy(tenantKey, environment) {
+      const match = [...policies.values()].find(
+        (row) => row.tenantKey === tenantKey && row.environment === environment && row.lifecycle === "active"
+      );
+      return match ? clone(match) : null;
+    },
+    async getPolicyVersion(tenantKey, id) {
+      const row = policies.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listPolicyVersions(tenantKey) {
+      return [...policies.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async savePolicyVersion(policy) {
+      if (policy.lifecycle === "active") {
+        for (const [key, row] of policies) {
+          if (row.tenantKey === policy.tenantKey && row.environment === policy.environment && row.lifecycle === "active" && row.id !== policy.id) {
+            policies.set(key, { ...row, lifecycle: "retired" });
+          }
+        }
+      }
+      policies.set(k(policy.tenantKey, policy.id), clone(policy));
+    },
+    async listProtectedActionRequirements(tenantKey, action, policyVersionId) {
+      return [...requirements.values()].filter((row) => row.tenantKey === tenantKey && row.action === action && row.policyVersionId === policyVersionId).map(clone);
+    },
+    async saveProtectedActionRequirement(requirement) {
+      requirements.set(k(requirement.tenantKey, requirement.id), clone(requirement));
+    },
+    async getContinuationDestinations(tenantKey) {
+      const tenant = tenants.get(tenantKey);
+      return tenant ? [...tenant.continuationDestinations] : ["verification.resume"];
+    },
+    async getAttempt(tenantKey, attemptId) {
+      const row = attempts.get(k(tenantKey, attemptId));
+      return row ? clone(row) : null;
+    },
+    async getAttemptByIdempotencyKey(tenantKey, key) {
+      const match = [...attempts.values()].find((row) => row.tenantKey === tenantKey && row.idempotencyKey === key);
+      return match ? clone(match) : null;
+    },
+    async findAttemptByProviderResource(tenantKey, provider, providerResourceId) {
+      const match = [...attempts.values()].find(
+        (row) => row.tenantKey === tenantKey && row.provider === provider && row.providerResourceId === providerResourceId
+      );
+      return match ? clone(match) : null;
+    },
+    async listAttempts(tenantKey) {
+      return [...attempts.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async listLiveAttempts(tenantKey, subjectHash, packageCode) {
+      const live = /* @__PURE__ */ new Set(["created", "pending_user_input", "paused", "processing", "manual_review_required"]);
+      return [...attempts.values()].filter((row) => row.tenantKey === tenantKey && row.subjectHash === subjectHash && row.packageCode === packageCode && live.has(row.canonicalStatus)).map(clone);
+    },
+    async insertAttempt(attempt) {
+      const key = k(attempt.tenantKey, attempt.id);
+      if (attempts.has(key)) throw new Error("Attempt already exists.");
+      k(attempt.tenantKey, "idem", attempt.idempotencyKey);
+      if ([...attempts.values()].some((row) => row.tenantKey === attempt.tenantKey && row.idempotencyKey === attempt.idempotencyKey)) {
+        throw new Error("Idempotency key already used.");
+      }
+      attempts.set(key, clone(attempt));
+      return clone(attempt);
+    },
+    async updateAttempt(attempt) {
+      attempts.set(k(attempt.tenantKey, attempt.id), clone(attempt));
+    },
+    async insertLineage(row) {
+      lineage.set(k(row.tenantKey, row.id), clone(row));
+    },
+    async listLineage(tenantKey, attemptId) {
+      return [...lineage.values()].filter((row) => row.tenantKey === tenantKey && row.attemptId === attemptId).map(clone);
+    },
+    async getValidDecision(tenantKey, subjectHash, packageCode, at) {
+      const matches = [...decisions.values()].filter((row) => row.tenantKey === tenantKey && row.subjectHash === subjectHash && row.packageCode === packageCode && row.status === "verified" && !row.revokedAt && (!row.expiresAt || row.expiresAt > at.toISOString())).sort((left, right) => right.effectiveAt.localeCompare(left.effectiveAt));
+      return matches[0] ? clone(matches[0]) : null;
+    },
+    async insertDecision(decision) {
+      decisions.set(k(decision.tenantKey, decision.id), clone(decision));
+    },
+    async listDecisions(tenantKey, subjectHash) {
+      return [...decisions.values()].filter((row) => row.tenantKey === tenantKey && (!subjectHash || row.subjectHash === subjectHash)).map(clone);
+    },
+    async revokeDecision(tenantKey, decisionId, at) {
+      const row = decisions.get(k(tenantKey, decisionId));
+      if (row) decisions.set(k(tenantKey, decisionId), { ...row, status: "revoked", revokedAt: at });
+    },
+    async claimIdempotency(claim) {
+      return lockFor(k(claim.tenantKey, claim.claimKey)).run(async () => {
+        const existing = idempotency.get(k(claim.tenantKey, claim.claimKey));
+        if (existing) return { disposition: "existing", claim: clone(existing) };
+        idempotency.set(k(claim.tenantKey, claim.claimKey), clone(claim));
+        return { disposition: "claimed", claim: clone(claim) };
+      });
+    },
+    async completeIdempotency(tenantKey, key, resultRef) {
+      const row = idempotency.get(k(tenantKey, key));
+      if (row) {
+        idempotency.set(k(tenantKey, key), {
+          ...row,
+          state: "completed",
+          resultRef,
+          completedAt: iso()
+        });
+      }
+    },
+    async failIdempotency(tenantKey, key, errorCode) {
+      const row = idempotency.get(k(tenantKey, key));
+      if (row) {
+        idempotency.set(k(tenantKey, key), {
+          ...row,
+          state: "failed",
+          errorCode,
+          completedAt: iso()
+        });
+      }
+    },
+    async getIdempotencyClaim(tenantKey, key) {
+      const row = idempotency.get(k(tenantKey, key));
+      return row ? clone(row) : null;
+    },
+    async claimWebhookEvent(input) {
+      const key = k(input.tenantKey, input.provider, input.providerEventKey);
+      const existing = webhooks.get(key);
+      if (existing) {
+        if (existing.bodySha256 !== input.bodySha256) {
+          const dead = { ...existing, state: "dead_letter" };
+          webhooks.set(key, dead);
+          return { disposition: "mismatch", event: clone(dead) };
+        }
+        return { disposition: "duplicate", event: clone(existing) };
+      }
+      const event = {
+        tenantKey: input.tenantKey,
+        id: newId("wh"),
+        provider: input.provider,
+        providerEventKey: input.providerEventKey,
+        providerResourceId: input.providerResourceId,
+        eventType: input.eventType,
+        occurredAt: input.occurredAt,
+        bodySha256: input.bodySha256,
+        safeMetadata: input.safeMetadata,
+        state: "accepted",
+        receivedAt: iso()
+      };
+      webhooks.set(key, event);
+      return { disposition: "claimed", event: clone(event) };
+    },
+    async getWebhookEvent(tenantKey, provider, eventKey) {
+      const row = webhooks.get(k(tenantKey, provider, eventKey));
+      return row ? clone(row) : null;
+    },
+    async getWebhookEventById(tenantKey, eventId) {
+      const row = [...webhooks.values()].find((event) => event.tenantKey === tenantKey && event.id === eventId);
+      return row ? clone(row) : null;
+    },
+    async settleWebhookEvent(tenantKey, eventId, outcome) {
+      for (const [key, row] of webhooks) {
+        if (row.tenantKey === tenantKey && row.id === eventId) {
+          webhooks.set(key, { ...row, state: outcome });
+        }
+      }
+    },
+    async recordHealth(observation) {
+      health.set(k(observation.tenantKey, observation.id), clone(observation));
+    },
+    async listHealth(tenantKey, provider) {
+      return [...health.values()].filter((row) => row.tenantKey === tenantKey && (!provider || row.provider === provider)).map(clone);
+    },
+    async getCircuit(tenantKey, provider, environment) {
+      const key = k(tenantKey, provider, environment);
+      const existing = circuits.get(key);
+      if (existing) return clone(existing);
+      const created = {
+        tenantKey,
+        provider,
+        environment,
+        state: "closed",
+        reasonCode: null,
+        openUntil: null,
+        consecutiveFailures: 0,
+        drainedByActorId: null,
+        updatedAt: iso()
+      };
+      circuits.set(key, created);
+      return clone(created);
+    },
+    async saveCircuit(circuit) {
+      circuits.set(k(circuit.tenantKey, circuit.provider, circuit.environment), clone(circuit));
+    },
+    async listCircuits(tenantKey) {
+      return [...circuits.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveAppeal(appeal) {
+      appeals.set(k(appeal.tenantKey, appeal.id), clone(appeal));
+    },
+    async getAppeal(tenantKey, id) {
+      const row = appeals.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listAppeals(tenantKey) {
+      return [...appeals.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveReviewCase(reviewCase) {
+      reviews.set(k(reviewCase.tenantKey, reviewCase.id), clone(reviewCase));
+    },
+    async getReviewCase(tenantKey, id) {
+      const row = reviews.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listReviewCases(tenantKey) {
+      return [...reviews.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveManualDecisionProposal(proposal) {
+      proposals.set(k(proposal.tenantKey, proposal.id), clone(proposal));
+    },
+    async getManualDecisionProposal(tenantKey, id) {
+      const row = proposals.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listManualDecisionProposals(tenantKey) {
+      return [...proposals.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveContinuation(continuation) {
+      continuations.set(k(continuation.tenantKey, continuation.key), clone(continuation));
+    },
+    async getContinuation(tenantKey, key) {
+      const row = continuations.get(k(tenantKey, key));
+      return row ? clone(row) : null;
+    },
+    async appendAudit(event) {
+      audit.set(k(event.tenantKey, event.id), clone(event));
+    },
+    async listAudit(tenantKey) {
+      return [...audit.values()].filter((row) => row.tenantKey === tenantKey).map(clone);
+    },
+    async saveJob(job) {
+      jobs.set(k(job.tenantKey, job.id), clone(job));
+    },
+    async getJob(tenantKey, id) {
+      const row = jobs.get(k(tenantKey, id));
+      return row ? clone(row) : null;
+    },
+    async listJobs(tenantKey, kind) {
+      return [...jobs.values()].filter((row) => row.tenantKey === tenantKey && (!kind || row.kind === kind)).map(clone);
+    },
+    async claimJobs(input) {
+      const claimed = [];
+      const pending = ["scheduled", "retryable", "processing"];
+      for (const [key, job] of jobs) {
+        if (claimed.length >= input.limit) break;
+        if (job.tenantKey !== input.tenantKey || !input.kinds.includes(job.kind)) continue;
+        if (!pending.includes(job.state) && job.state !== "processing") continue;
+        if (job.state === "processing" && job.leaseExpiresAt && job.leaseExpiresAt > input.now.toISOString()) continue;
+        if (job.nextAttemptAt > input.now.toISOString()) continue;
+        const next = {
+          ...job,
+          state: job.kind === "redact" ? "processing" : "processing",
+          leaseId: newId("lease"),
+          leaseExpiresAt: new Date(input.now.getTime() + input.leaseSeconds * 1e3).toISOString(),
+          attemptCount: job.attemptCount + 1
+        };
+        jobs.set(key, next);
+        claimed.push(clone(next));
+      }
+      return claimed;
+    },
+    async updateJob(job) {
+      jobs.set(k(job.tenantKey, job.id), clone(job));
+    },
+    async updateRedactionStatus(tenantKey, jobId, status) {
+      const row = jobs.get(k(tenantKey, jobId));
+      if (row) jobs.set(k(tenantKey, jobId), { ...row, state: status });
+    }
+  };
+  return store;
+}
+
+// src/queue.ts
+function backoffSeconds(attemptCount, retryAfterSeconds, random = Math.random) {
+  if (retryAfterSeconds && retryAfterSeconds > 0) return retryAfterSeconds;
+  const base = Math.min(2 ** Math.max(0, attemptCount), 300);
+  const jitter = random() * base * 0.25;
+  return Math.max(1, Math.round(base + jitter));
+}
+
+// src/memory-queue.ts
+function createMemoryQueue(store, options = {}) {
+  const random = options.random ?? Math.random;
+  return {
+    async enqueue(job) {
+      await store.saveJob(job);
+    },
+    async claim(input) {
+      return store.claimJobs(input);
+    },
+    async complete(tenantKey, jobId, leaseId) {
+      const job = await store.getJob(tenantKey, jobId);
+      if (!job || job.leaseId !== leaseId) {
+        throw new EngineError("OPERATION_PENDING", "The queue lease is no longer valid.");
+      }
+      await store.updateJob({
+        ...job,
+        state: job.kind === "redact" ? "redacted" : "completed",
+        leaseId: null,
+        leaseExpiresAt: null
+      });
+    },
+    async retry(tenantKey, jobId, leaseId, retry) {
+      const job = await store.getJob(tenantKey, jobId);
+      if (!job || job.leaseId !== leaseId) {
+        throw new EngineError("OPERATION_PENDING", "The queue lease is no longer valid.");
+      }
+      const delay = backoffSeconds(job.attemptCount, retry.retryAfterSeconds, random);
+      await store.updateJob({
+        ...job,
+        state: retry.deadLetter ? "dead_letter" : "retryable",
+        leaseId: null,
+        leaseExpiresAt: null,
+        lastErrorCode: retry.errorCode,
+        nextAttemptAt: new Date(store.now().getTime() + delay * 1e3).toISOString()
+      });
+    }
+  };
+}
+
+// src/types.ts
+var FORBIDDEN_CLIENT_ROUTE_KEYS = [
+  "provider",
+  "templateId",
+  "template_id",
+  "workflowId",
+  "workflow_id",
+  "apiOrigin",
+  "api_origin",
+  "configurationRevision",
+  "configuration_revision",
+  "adapterVersion",
+  "manifestDigest",
+  "policyVersion",
+  "routeId"
+];
+var LIVE_ATTEMPT_STATUSES = [
+  "created",
+  "pending_user_input",
+  "paused",
+  "processing",
+  "manual_review_required"
+];
+var GOVERNANCE_TRANSITIONS = [
+  "approve",
+  "deny",
+  "request_more_information",
+  "revoke",
+  "expire"
+];
+var APPLICATION_REASON_CODES = [
+  "underage",
+  "unsupported_capability",
+  "biometric_alternative_requested",
+  "manual_review_required",
+  "document_unreadable",
+  "more_information_requested"
+];
+function isApplicationReasonCode(value) {
+  return APPLICATION_REASON_CODES.includes(value);
+}
+
+// src/guards.ts
+function assertNoClientRouting(command) {
+  const record = command;
+  for (const key of FORBIDDEN_CLIENT_ROUTE_KEYS) {
+    if (record[key] !== void 0 && record[key] !== null) {
+      throw new ClientRouteInjectionError();
+    }
+  }
+}
+function assertStartCommand(command) {
+  if (!command.packageCode || !command.subjectReference || !command.idempotencyKey) {
+    throw new EngineError("INVALID_COMMAND", "A verification start command is missing required fields.");
+  }
+  if (!isCountryCode(command.countryCode)) {
+    throw new EngineError("INVALID_COMMAND", "A verification start command must include an ISO country code.");
+  }
+  if (metadataContainsForbiddenIdentifier(command.metadata)) {
+    throw new EngineError("INVALID_COMMAND", "Attempt metadata must not contain government identifiers.");
+  }
+}
+function twoActorApproved(proposedBy, approvedBy) {
+  return Boolean(proposedBy && approvedBy && proposedBy !== approvedBy);
+}
+
+// src/platform.ts
+init_hash();
+
+// src/rate-budget.ts
+function createRateBudget(limitPerSecond) {
+  const stamps = /* @__PURE__ */ new Map();
+  const limit = Math.max(1, Math.floor(limitPerSecond));
+  return {
+    consume(provider, at = /* @__PURE__ */ new Date()) {
+      const now = at.getTime();
+      const recent = (stamps.get(provider) ?? []).filter((stamp) => now - stamp < 1e3);
+      if (recent.length >= limit) {
+        const oldest = recent[0] ?? now;
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((oldest + 1e3 - now) / 1e3)) };
+      }
+      recent.push(now);
+      stamps.set(provider, recent);
+      return { allowed: true };
+    }
+  };
+}
+
+// src/routing.ts
+init_hash();
+async function selectRoute(input) {
+  const now = (input.runtime.now ?? (() => /* @__PURE__ */ new Date()))();
+  const policy = await input.store.getActivePolicy(input.tenantKey, input.environment);
+  if (input.environment === "production") {
+    if (!input.runtime.productionEnabled) {
+      throw new EngineError("PRODUCTION_NOT_ACTIVATED", "Production verification requires the runtime production key.");
+    }
+    if (!policy || policy.lifecycle !== "active" || !twoActorApproved(policy.proposedByActorId, policy.approvedByActorId)) {
+      throw new EngineError(
+        "PRODUCTION_NOT_ACTIVATED",
+        "Production verification requires an active database policy approved by a different actor."
+      );
+    }
+    if (policy.expiresAt && policy.expiresAt <= now.toISOString()) {
+      throw new EngineError("PRODUCTION_NOT_ACTIVATED", "The production verification policy has expired.");
+    }
+    if (policy.decisionRetentionDays == null || policy.providerRedactionDelayDays == null || policy.appealHoldDays == null) {
+      throw new EngineError(
+        "PRODUCTION_NOT_ACTIVATED",
+        "Production verification requires explicit decision retention, provider redaction timing, appeal holds, and legal-hold values."
+      );
+    }
+  } else if (!policy || policy.lifecycle !== "active") {
+    throw new EngineError("NO_ELIGIBLE_ROUTE", "No active sandbox verification policy is available.");
+  }
+  const cohort = await cohortBucket(input.tenantKey, input.subjectHash);
+  const routes = (await input.store.listActiveRoutes(input.tenantKey, input.environment)).filter((route) => route.packageCode === input.packageCode).filter((route) => route.countryCode === null || route.countryCode === input.countryCode).filter((route) => cohort >= route.cohortMin && cohort <= route.cohortMax).filter((route) => !route.windowStart || route.windowStart <= now.toISOString()).filter((route) => !route.windowEnd || route.windowEnd >= now.toISOString()).filter((route) => !route.allowlistRequired || route.allowlistedSubjectHashes.includes(input.subjectHash)).sort((left, right) => left.priority - right.priority || left.id.localeCompare(right.id));
+  let usedFailover = false;
+  const eligible = [];
+  for (const route of routes) {
+    const circuit = await input.store.getCircuit(input.tenantKey, route.provider, route.environment);
+    if (circuitIsBlocking(circuit, now)) {
+      usedFailover = true;
+      continue;
+    }
+    const adapter2 = input.adapters.find((candidate) => candidate.provider === route.provider && candidate.environment === route.environment);
+    if (!adapter2) continue;
+    if (!adapter2.manifest.supportedPackages.includes(input.packageCode)) continue;
+    if (!adapter2.manifest.supportedCountries.includes(input.countryCode)) continue;
+    if (!adapter2.manifest.environments.includes(input.environment)) continue;
+    if (input.requiredCapability && !adapter2.manifest.capabilities[input.requiredCapability]) continue;
+    const routeCapability = route.requiredCapability;
+    if (routeCapability && routeCapability in adapter2.manifest.capabilities && !adapter2.manifest.capabilities[routeCapability]) {
+      continue;
+    }
+    const observations = await input.store.listHealth(input.tenantKey, adapter2.provider);
+    const recent = observations.filter((row) => row.environment === input.environment).sort((left, right) => right.observedAt.localeCompare(left.observedAt)).slice(0, 5);
+    if (recent.length >= 3 && recent.every((row) => row.outcome !== "success")) {
+      usedFailover = true;
+      continue;
+    }
+    eligible.push(route);
+  }
+  const selected = eligible[0];
+  if (!selected) {
+    throw new EngineError("NO_ELIGIBLE_ROUTE", "No eligible verification provider route is available.", true, 30);
+  }
+  const adapter = input.adapters.find((candidate) => candidate.provider === selected.provider && candidate.environment === selected.environment);
+  if (!adapter) {
+    throw new EngineError("NO_ELIGIBLE_ROUTE", "The selected route has no compiled-in adapter.");
+  }
+  return {
+    route: selected,
+    adapter,
+    reason: usedFailover ? "new_attempt_failover" : "primary_route",
+    usedFailover
+  };
+}
+function circuitIsBlocking(circuit, now) {
+  if (circuit.state === "closed") return false;
+  if (circuit.state === "open") {
+    if (circuit.openUntil && circuit.openUntil <= now.toISOString()) return false;
+    return true;
+  }
+  return circuit.state === "half_open" && Boolean(circuit.drainedByActorId);
+}
+
+// src/seed.ts
+init_hash();
+async function seedSandboxExamples(store, registry, runtime, tenantKey = "default") {
+  const now = (runtime.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  await store.ensureTenant(tenantKey);
+  let sandboxPolicy = await store.getActivePolicy(tenantKey, "sandbox");
+  if (!sandboxPolicy) {
+    sandboxPolicy = {
+      tenantKey,
+      id: "pol_sandbox_example",
+      version: "sandbox-example-1",
+      environment: "sandbox",
+      lifecycle: "active",
+      reason: "Seeded sandbox example policy",
+      expiresAt: null,
+      proposedByActorId: "system:seed",
+      approvedByActorId: "system:seed-approver",
+      approvedAt: now,
+      activatedAt: now,
+      createdAt: now,
+      decisionRetentionDays: null,
+      providerRedactionDelayDays: null,
+      appealHoldDays: null,
+      legalHold: false
+    };
+    await store.savePolicyVersion(sandboxPolicy);
+  }
+  let sandboxPriority = 100;
+  for (const adapter of registry.list()) {
+    const manifestDigest = await digestCanonical(adapter.manifest);
+    await store.upsertProviderDefinition({
+      tenantKey,
+      provider: adapter.provider,
+      environment: adapter.environment,
+      adapterVersion: adapter.manifest.adapterVersion,
+      manifestDigest,
+      compiledInRegistry: true,
+      productionEligible: false,
+      createdAt: now,
+      updatedAt: now
+    });
+    const configId = `cfg_sandbox_${adapter.provider}`;
+    if (!await store.getConfigurationRevision(tenantKey, configId)) {
+      await store.saveConfigurationRevision({
+        tenantKey,
+        id: configId,
+        provider: adapter.provider,
+        environment: adapter.environment,
+        revision: 1,
+        configurationDigest: await digestCanonical({ provider: adapter.provider, environment: adapter.environment }),
+        lifecycle: "approved",
+        proposedByActorId: "system:seed",
+        approvedByActorId: "system:seed-approver",
+        approvedAt: now,
+        createdAt: now
+      });
+    }
+    if (adapter.environment !== "sandbox") continue;
+    for (const packageCode of adapter.manifest.supportedPackages) {
+      const routeId = `rte_sandbox_${adapter.provider}_${packageCode}`.replace(/[^a-z0-9_]/g, "_");
+      if (await store.getRoute(tenantKey, routeId)) continue;
+      const route = {
+        tenantKey,
+        id: routeId,
+        provider: adapter.provider,
+        environment: "sandbox",
+        packageCode,
+        countryCode: adapter.manifest.supportedCountries[0] ?? "US",
+        requiredCapability: null,
+        priority: sandboxPriority++,
+        cohortMin: 0,
+        cohortMax: 99,
+        windowStart: null,
+        windowEnd: null,
+        allowlistRequired: false,
+        allowlistedSubjectHashes: [],
+        configurationRevisionId: configId,
+        policyVersionId: sandboxPolicy.id,
+        lifecycle: "active",
+        proposedByActorId: "system:seed",
+        approvedByActorId: "system:seed-approver",
+        approvedAt: now,
+        activatedAt: now,
+        createdAt: now,
+        updatedAt: now
+      };
+      await store.saveRoute(route);
+    }
+  }
+  const productionPolicy = (await store.listPolicyVersions(tenantKey)).find((row) => row.environment === "production");
+  if (!productionPolicy) {
+    await store.savePolicyVersion({
+      tenantKey,
+      id: newId("pol"),
+      version: "production-unactivated",
+      environment: "production",
+      lifecycle: "draft",
+      reason: "Seeded production policy is never auto-activated",
+      expiresAt: null,
+      proposedByActorId: "system:seed",
+      approvedByActorId: null,
+      approvedAt: null,
+      activatedAt: null,
+      createdAt: now,
+      decisionRetentionDays: null,
+      providerRedactionDelayDays: null,
+      appealHoldDays: null,
+      legalHold: false
+    });
+  }
+}
+
+// src/store.ts
+var TERMINAL_STATUS_RANK = {
+  created: 10,
+  pending_user_input: 20,
+  paused: 20,
+  processing: 30,
+  manual_review_required: 40,
+  provider_unavailable: 25,
+  verified: 100,
+  declined: 100,
+  failed: 100,
+  expired: 100,
+  canceled: 100,
+  redacted: 200
+};
+
+// src/status.ts
+function canTransitionStatus(current, next) {
+  if (current === next) return true;
+  if (next === "redacted") return true;
+  if (isTerminalStatus(current)) return false;
+  if (current === "provider_unavailable" && !isTerminalStatus(next)) return true;
+  return TERMINAL_STATUS_RANK[next] >= TERMINAL_STATUS_RANK[current];
+}
+function applyMonotonicStatus(current, next) {
+  return canTransitionStatus(current, next) ? next : current;
+}
+function createVerificationPlatform(input) {
+  const runtime = input.runtime ?? {};
+  const store = input.store;
+  const queue = input.queue;
+  const policyStore = input.policyStore ?? store;
+  const registry = input.registry;
+  const now = () => (runtime.now ?? store.now ?? (() => /* @__PURE__ */ new Date()))();
+  const cryptoImpl = runtime.crypto ?? globalThis.crypto;
+  const createLocks = /* @__PURE__ */ new Map();
+  const rateBudget = createRateBudget(runtime.rateBudgetPerProvider ?? 25);
+  let boot = null;
+  const ready = () => {
+    if (!boot) boot = bootstrap();
+    return boot;
+  };
+  async function bootstrap() {
+    if (runtime.seedSandboxExamples !== false) {
+      await seedSandboxExamples(store, registry, runtime);
+    } else {
+      const iso = now().toISOString();
+      for (const adapter of registry.list()) {
+        await store.upsertProviderDefinition({
+          tenantKey: "default",
+          provider: adapter.provider,
+          environment: adapter.environment,
+          adapterVersion: adapter.manifest.adapterVersion,
+          manifestDigest: await digestCanonical(adapter.manifest),
+          compiledInRegistry: true,
+          productionEligible: false,
+          createdAt: iso,
+          updatedAt: iso
+        });
+      }
+    }
+  }
+  async function authorize(actor, operation, resource) {
+    const allowed = await input.authorize(actor, operation, resource);
+    if (!allowed) throw new AuthorizationError();
+  }
+  async function audit(actor, operation, resourceType, resourceId, reasonCode, safeMetadata = {}) {
+    await store.appendAudit({
+      tenantKey: actor.tenantKey,
+      id: newId("aud", cryptoImpl),
+      actorId: actor.actorId,
+      actorType: actor.actorType,
+      operation,
+      resourceType,
+      resourceId,
+      reasonCode,
+      safeMetadata,
+      occurredAt: now().toISOString()
+    });
+  }
+  function adapterFor(provider, environment) {
+    return registry.get(provider, environment);
+  }
+  async function recordHealth(adapter, actorTenant, observation) {
+    await store.recordHealth({
+      tenantKey: actorTenant,
+      id: newId("hlth", cryptoImpl),
+      provider: adapter.provider,
+      environment: adapter.environment,
+      operation: observation.operation,
+      outcome: observation.outcome,
+      safeCode: observation.safeCode,
+      observedAt: observation.observedAt,
+      latencyMs: observation.latencyMs ?? null
+    });
+    const circuit = await store.getCircuit(actorTenant, adapter.provider, adapter.environment);
+    if (observation.outcome === "success") {
+      await store.saveCircuit({
+        ...circuit,
+        consecutiveFailures: 0,
+        state: circuit.drainedByActorId ? circuit.state : "closed",
+        reasonCode: circuit.drainedByActorId ? circuit.reasonCode : null,
+        openUntil: circuit.drainedByActorId ? circuit.openUntil : null,
+        updatedAt: now().toISOString()
+      });
+      return;
+    }
+    if (observation.outcome === "retryable_failure" || observation.outcome === "terminal_failure") {
+      const failures = circuit.consecutiveFailures + 1;
+      const open = failures >= 5;
+      await store.saveCircuit({
+        ...circuit,
+        consecutiveFailures: failures,
+        state: open ? "open" : circuit.state,
+        reasonCode: observation.safeCode,
+        openUntil: open ? new Date(now().getTime() + 3e5).toISOString() : circuit.openUntil,
+        updatedAt: now().toISOString()
+      });
+    }
+  }
+  async function toView(attempt, launch = null) {
+    return {
+      attemptId: attempt.id,
+      packageCode: attempt.packageCode,
+      status: attempt.canonicalStatus,
+      provider: attempt.provider,
+      environment: attempt.environment,
+      adapterVersion: attempt.adapterVersion,
+      manifestDigest: attempt.manifestDigest,
+      configurationRevision: attempt.configurationRevision,
+      policyVersion: attempt.policyVersion,
+      canResume: !isTerminalStatus(attempt.canonicalStatus),
+      canRetry: ["declined", "failed", "expired", "canceled", "provider_unavailable"].includes(attempt.canonicalStatus),
+      expiresAt: attempt.expiresAt,
+      safeErrorCode: attempt.canonicalStatus === "provider_unavailable" ? "provider_unavailable" : null,
+      retryAfter: null,
+      supportPath: null,
+      launch
+    };
+  }
+  async function persistDecision(attempt) {
+    if (attempt.canonicalStatus !== "verified") return;
+    const existing = await store.getValidDecision(attempt.tenantKey, attempt.subjectHash, attempt.packageCode, now());
+    if (existing) return;
+    const ttl = (runtime.defaultDecisionTtlSeconds ?? 365 * 24 * 3600) * 1e3;
+    await store.insertDecision({
+      tenantKey: attempt.tenantKey,
+      id: newId("dec", cryptoImpl),
+      subjectHash: attempt.subjectHash,
+      packageCode: attempt.packageCode,
+      attemptId: attempt.id,
+      status: "verified",
+      source: "provider",
+      policyVersion: attempt.policyVersion,
+      reasonCodes: attempt.normalizedReasonCodes,
+      effectiveAt: now().toISOString(),
+      expiresAt: new Date(now().getTime() + ttl).toISOString(),
+      revokedAt: null,
+      proposerActorId: null,
+      approverActorId: null,
+      createdAt: now().toISOString()
+    });
+  }
+  async function bindProviderResult(attempt, result) {
+    const next = {
+      ...attempt,
+      providerResourceId: result.providerResourceId,
+      providerStatus: result.providerStatus,
+      canonicalStatus: applyMonotonicStatus(attempt.canonicalStatus, result.canonicalStatus),
+      statusVersion: attempt.statusVersion + 1,
+      createClaimId: null,
+      createClaimExpiresAt: null,
+      updatedAt: now().toISOString()
+    };
+    await store.updateAttempt(next);
+    await store.insertLineage({
+      tenantKey: attempt.tenantKey,
+      id: newId("lin", cryptoImpl),
+      attemptId: attempt.id,
+      resourceType: "primary",
+      providerResourceId: result.providerResourceId,
+      relationshipCode: "primary",
+      providerStatus: result.providerStatus,
+      occurredAt: now().toISOString()
+    });
+    for (const linked of result.linkedResources ?? []) {
+      await store.insertLineage({
+        tenantKey: attempt.tenantKey,
+        id: newId("lin", cryptoImpl),
+        attemptId: attempt.id,
+        resourceType: linked.resourceType,
+        providerResourceId: linked.resourceId,
+        relationshipCode: linked.relationshipCode,
+        providerStatus: linked.providerStatus,
+        occurredAt: linked.occurredAt
+      });
+    }
+    await persistDecision(next);
+    return next;
+  }
+  function launchCommand(attempt, command) {
+    return {
+      attemptId: attempt.id,
+      subjectReference: command.subjectReference,
+      organizationReference: command.organization?.legalName ?? null,
+      packageCode: attempt.packageCode,
+      countryCode: attempt.countryCode,
+      idempotencyKey: attempt.idempotencyKey,
+      configurationRevision: attempt.configurationRevision,
+      legalFirstName: command.legalFirstName,
+      legalLastName: command.legalLastName,
+      email: command.email,
+      organization: command.organization,
+      relationship: command.relationship,
+      associatedPerson: command.associatedPerson,
+      evidenceReferences: command.evidenceReferences,
+      requestOrigin: command.requestOrigin,
+      metadata: command.metadata
+    };
+  }
+  async function createProviderResource(actor, attempt, command, adapter) {
+    const budget = rateBudget.consume(adapter.provider, now());
+    if (!budget.allowed) {
+      throw new EngineError(
+        "PROVIDER_UNAVAILABLE",
+        "The provider rate budget is exhausted.",
+        true,
+        budget.retryAfterSeconds
+      );
+    }
+    const started = now();
+    try {
+      const created = await adapter.createAttempt(launchCommand(attempt, command));
+      await recordHealth(adapter, actor.tenantKey, {
+        operation: "create",
+        outcome: "success",
+        safeCode: "ok",
+        observedAt: now().toISOString(),
+        latencyMs: now().getTime() - started.getTime()
+      });
+      return created;
+    } catch (error) {
+      const safe = toSafeProviderFailure(error);
+      await recordHealth(adapter, actor.tenantKey, {
+        operation: "create",
+        outcome: safe.retryable ? "retryable_failure" : "terminal_failure",
+        safeCode: safe.safeCode,
+        observedAt: now().toISOString(),
+        latencyMs: now().getTime() - started.getTime()
+      });
+      throw error;
+    }
+  }
+  async function startLocked(actor, command) {
+    assertNoClientRouting(command);
+    assertStartCommand(command);
+    await authorize(actor, "start", { type: "package", id: command.packageCode });
+    const subjectHash = await store.hashSubject(actor.tenantKey, command.subjectReference);
+    const reused = await store.getValidDecision(actor.tenantKey, subjectHash, command.packageCode, now());
+    if (reused?.attemptId) {
+      const prior = await store.getAttempt(actor.tenantKey, reused.attemptId);
+      if (prior) {
+        await audit(actor, "start", "decision", reused.id, "reused_verified_decision", { attemptId: prior.id });
+        return toView(prior);
+      }
+    }
+    const resourceHash = command.resourceReference && command.resourceType ? await store.hashResource(actor.tenantKey, command.resourceType, command.resourceReference) : null;
+    const existing = await store.getAttemptByIdempotencyKey(actor.tenantKey, command.idempotencyKey);
+    if (existing?.providerResourceId) {
+      return toView(existing);
+    }
+    if (existing && existing.createClaimExpiresAt && existing.createClaimExpiresAt > now().toISOString()) {
+      throw new ProviderOperationPendingError();
+    }
+    const productionPolicy = await store.getActivePolicy(actor.tenantKey, "production");
+    const environment = runtime.productionEnabled && productionPolicy?.lifecycle === "active" && twoActorApproved(productionPolicy.proposedByActorId, productionPolicy.approvedByActorId) ? "production" : "sandbox";
+    const selected = await selectRoute({
+      store,
+      adapters: registry.list(),
+      tenantKey: actor.tenantKey,
+      packageCode: command.packageCode,
+      countryCode: command.countryCode,
+      subjectHash,
+      environment: environment === "production" ? "production" : "sandbox",
+      runtime
+    });
+    const adapter = selected.adapter;
+    const manifestDigest = await digestCanonical(adapter.manifest);
+    const iso = now().toISOString();
+    const attemptId = newId("att", cryptoImpl);
+    const claimKey = `start:${command.idempotencyKey}`;
+    const prepared = await store.transact(async (tx) => {
+      const claim = await tx.claimIdempotency({
+        tenantKey: actor.tenantKey,
+        claimKey,
+        operation: "start",
+        attemptId,
+        state: "claimed",
+        resultRef: null,
+        errorCode: null,
+        createdAt: iso,
+        completedAt: null
+      });
+      if (claim.disposition === "existing" && claim.claim.resultRef) {
+        const prior = await tx.getAttempt(actor.tenantKey, claim.claim.resultRef);
+        if (prior) return { kind: "existing", attempt: prior };
+      }
+      if (claim.disposition === "existing" && claim.claim.state === "claimed") {
+        throw new ProviderOperationPendingError();
+      }
+      const attempt = {
+        tenantKey: actor.tenantKey,
+        id: attemptId,
+        subjectHash,
+        packageCode: command.packageCode,
+        countryCode: command.countryCode,
+        provider: adapter.provider,
+        environment: adapter.environment,
+        adapterVersion: adapter.manifest.adapterVersion,
+        manifestDigest,
+        configurationRevision: selected.route.configurationRevisionId,
+        policyVersion: selected.route.policyVersionId,
+        providerResourceId: null,
+        providerStatus: null,
+        canonicalStatus: "created",
+        statusVersion: 0,
+        idempotencyKey: command.idempotencyKey,
+        parentAttemptId: null,
+        purposeAction: command.action ?? null,
+        purposeResourceHash: resourceHash,
+        routeId: selected.route.id,
+        selectionReason: selected.reason,
+        normalizedReasonCodes: [],
+        expiresAt: null,
+        createClaimId: newId("claim", cryptoImpl),
+        createClaimExpiresAt: new Date(now().getTime() + 3e4).toISOString(),
+        createdAt: iso,
+        updatedAt: iso
+      };
+      await tx.insertAttempt(attempt);
+      return { kind: "created", attempt };
+    });
+    if (prepared.kind === "existing") return toView(prepared.attempt);
+    try {
+      const created = await createProviderResource(actor, prepared.attempt, command, adapter);
+      const bound = await store.transact(async (tx) => {
+        const latest = await tx.getAttempt(actor.tenantKey, prepared.attempt.id);
+        if (!latest) throw new EngineError("ATTEMPT_NOT_FOUND", "The verification attempt was lost after provider create.");
+        const next = await bindProviderResult(latest, created);
+        await tx.completeIdempotency(actor.tenantKey, claimKey, next.id);
+        return next;
+      });
+      await audit(actor, "start", "attempt", bound.id, selected.reason, { provider: adapter.provider });
+      return toView(bound, stripPersistedLaunch(created.launch));
+    } catch (error) {
+      await store.failIdempotency(actor.tenantKey, claimKey, toSafeProviderFailure(error).safeCode);
+      await store.updateAttempt({
+        ...prepared.attempt,
+        canonicalStatus: "provider_unavailable",
+        createClaimId: null,
+        createClaimExpiresAt: null,
+        updatedAt: now().toISOString()
+      });
+      throw error;
+    }
+  }
+  async function start(actor, command) {
+    await ready();
+    const lockKey = `${actor.tenantKey}:${command.idempotencyKey}`;
+    const pending = createLocks.get(lockKey);
+    const run = (pending ?? Promise.resolve()).then(() => startLocked(actor, command), () => startLocked(actor, command));
+    createLocks.set(lockKey, run.then(() => void 0, () => void 0));
+    return run;
+  }
+  async function loadAttempt(actor, attemptId) {
+    const attempt = await store.getAttempt(actor.tenantKey, attemptId);
+    if (!attempt) throw new EngineError("ATTEMPT_NOT_FOUND", "The verification attempt was not found.");
+    return attempt;
+  }
+  async function resume(actor, command) {
+    await ready();
+    assertNoClientRouting(command);
+    await authorize(actor, "resume", { type: "attempt", id: command.attemptId });
+    const attempt = await loadAttempt(actor, command.attemptId);
+    if (isTerminalStatus(attempt.canonicalStatus)) {
+      throw new EngineError("ATTEMPT_TERMINAL", "A terminal verification attempt cannot be resumed.");
+    }
+    if (!attempt.providerResourceId) {
+      throw new EngineError("ATTEMPT_PINNED", "The pinned verification attempt is not yet bound to a provider resource.");
+    }
+    const adapter = adapterFor(attempt.provider, attempt.environment);
+    const launch = await adapter.resumeAttempt({
+      attemptId: attempt.id,
+      providerResourceId: attempt.providerResourceId,
+      configurationRevision: attempt.configurationRevision,
+      requestOrigin: command.requestOrigin
+    });
+    await audit(actor, "resume", "attempt", attempt.id, "resumed_pinned", { provider: attempt.provider });
+    return toView(attempt, stripPersistedLaunch(launch));
+  }
+  async function status(actor, attemptId) {
+    await ready();
+    await authorize(actor, "status", { type: "attempt", id: attemptId });
+    return toView(await loadAttempt(actor, attemptId), null);
+  }
+  async function retry(actor, command) {
+    await ready();
+    assertNoClientRouting(command);
+    await authorize(actor, "retry", { type: "attempt", id: command.parentAttemptId });
+    const parent = await loadAttempt(actor, command.parentAttemptId);
+    const subjectHash = await store.hashSubject(actor.tenantKey, command.subjectReference);
+    const selected = await selectRoute({
+      store,
+      adapters: registry.list(),
+      tenantKey: actor.tenantKey,
+      packageCode: command.packageCode,
+      countryCode: command.countryCode,
+      subjectHash,
+      environment: parent.environment,
+      runtime,
+      requiredCapability: "canRetry"
+    });
+    const child = await startLocked(actor, command);
+    const latest = await store.getAttempt(actor.tenantKey, child.attemptId);
+    if (latest) {
+      await store.updateAttempt({
+        ...latest,
+        parentAttemptId: parent.id,
+        selectionReason: selected.reason,
+        updatedAt: now().toISOString()
+      });
+    }
+    return child;
+  }
+  async function pause(actor, attemptId) {
+    await ready();
+    await authorize(actor, "pause", { type: "attempt", id: attemptId });
+    const attempt = await loadAttempt(actor, attemptId);
+    if (isTerminalStatus(attempt.canonicalStatus)) {
+      throw new EngineError("ATTEMPT_TERMINAL", "A terminal verification attempt cannot be paused.");
+    }
+    const next = { ...attempt, canonicalStatus: applyMonotonicStatus(attempt.canonicalStatus, "paused"), updatedAt: now().toISOString() };
+    await store.updateAttempt(next);
+    await audit(actor, "pause", "attempt", attemptId, "paused");
+    return toView(next);
+  }
+  async function cancel(actor, attemptId) {
+    await ready();
+    await authorize(actor, "cancel", { type: "attempt", id: attemptId });
+    const attempt = await loadAttempt(actor, attemptId);
+    if (isTerminalStatus(attempt.canonicalStatus) && attempt.canonicalStatus !== "canceled") {
+      throw new EngineError("ATTEMPT_TERMINAL", "A terminal verification attempt cannot be canceled.");
+    }
+    if (attempt.providerResourceId) {
+      const adapter = adapterFor(attempt.provider, attempt.environment);
+      if (adapter.manifest.capabilities.canCancel) {
+        await adapter.cancelAttempt({
+          attemptId: attempt.id,
+          providerResourceId: attempt.providerResourceId,
+          configurationRevision: attempt.configurationRevision
+        });
+      }
+    }
+    const next = {
+      ...attempt,
+      canonicalStatus: applyMonotonicStatus(attempt.canonicalStatus, "canceled"),
+      updatedAt: now().toISOString()
+    };
+    await store.updateAttempt(next);
+    await audit(actor, "cancel", "attempt", attemptId, "canceled");
+    return toView(next);
+  }
+  async function redact(actor, command) {
+    await ready();
+    await authorize(actor, "redact", { type: "subject" });
+    const subjectHash = await store.hashSubject(actor.tenantKey, command.subjectReference);
+    const job = {
+      tenantKey: actor.tenantKey,
+      id: newId("red", cryptoImpl),
+      kind: "redact",
+      attemptId: command.attemptId ?? null,
+      eventId: null,
+      subjectHash,
+      providerResourceId: null,
+      state: "scheduled",
+      leaseId: null,
+      leaseExpiresAt: null,
+      attemptCount: 0,
+      nextAttemptAt: now().toISOString(),
+      lastErrorCode: null,
+      createdAt: now().toISOString()
+    };
+    await queue.enqueue(job);
+    const targets = command.attemptId ? [await loadAttempt(actor, command.attemptId)] : (await store.listAttempts(actor.tenantKey)).filter((row) => row.subjectHash === subjectHash);
+    if (!targets.length) {
+      await store.updateRedactionStatus(actor.tenantKey, job.id, "not_applicable");
+      return { jobId: job.id, status: "not_applicable" };
+    }
+    let status2 = "scheduled";
+    for (const attempt of targets) {
+      const adapter = adapterFor(attempt.provider, attempt.environment);
+      const result = await adapter.redactSubject({
+        subjectReference: command.subjectReference,
+        providerResourceId: attempt.providerResourceId,
+        requestReference: command.requestReference ?? job.id
+      });
+      status2 = result.disposition ?? (result.completed ? "redacted" : result.retryable ? "retryable" : "dead_letter");
+      await store.updateRedactionStatus(actor.tenantKey, job.id, toRedactionStatus(status2));
+      if (result.completed) {
+        await store.updateAttempt({
+          ...attempt,
+          canonicalStatus: "redacted",
+          updatedAt: now().toISOString()
+        });
+      }
+      await audit(actor, "redact", "attempt", attempt.id, status2);
+    }
+    return { jobId: job.id, status: status2 };
+  }
+  async function ingestWebhook(command) {
+    await ready();
+    const systemActor = {
+      tenantKey: command.tenantKey,
+      actorId: "system:webhook",
+      actorType: "system",
+      roles: ["webhook"],
+      authorizedSubjectScope: ["*"]
+    };
+    await authorize(systemActor, "ingest_webhook", { type: "provider", id: command.provider });
+    const adapter = registry.get(command.provider);
+    let verified;
+    try {
+      verified = await adapter.verifyWebhook(command.request);
+    } catch (error) {
+      if (error instanceof ProviderError && error.code === "SIGNATURE_INVALID") {
+        throw new EngineError("WEBHOOK_UNAUTHENTICATED", "The webhook signature is invalid.");
+      }
+      throw error;
+    }
+    const normalized = await adapter.normalizeWebhook(verified);
+    const claim = await store.claimWebhookEvent({
+      tenantKey: command.tenantKey,
+      provider: command.provider,
+      providerEventKey: normalized.providerEventKey,
+      providerResourceId: normalized.providerResourceId,
+      eventType: normalized.eventType,
+      occurredAt: normalized.occurredAt,
+      bodySha256: verified.bodySha256,
+      safeMetadata: {
+        ...normalized.safeMetadata,
+        ...normalized.canonicalStatus ? { canonicalStatus: normalized.canonicalStatus } : {}
+      }
+    });
+    if (claim.disposition === "mismatch") {
+      throw new WebhookSecurityIncidentError();
+    }
+    if (claim.disposition === "claimed") {
+      await queue.enqueue({
+        tenantKey: command.tenantKey,
+        id: newId("job", cryptoImpl),
+        kind: "webhook",
+        attemptId: null,
+        eventId: claim.event.id,
+        subjectHash: null,
+        providerResourceId: normalized.providerResourceId,
+        state: "scheduled",
+        leaseId: null,
+        leaseExpiresAt: null,
+        attemptCount: 0,
+        nextAttemptAt: now().toISOString(),
+        lastErrorCode: null,
+        createdAt: now().toISOString()
+      });
+    }
+    await audit(systemActor, "ingest_webhook", "webhook_event", claim.event.id, claim.disposition, {
+      provider: command.provider
+    });
+    return { accepted: true, duplicate: claim.disposition === "duplicate", eventId: claim.event.id };
+  }
+  async function processWebhookJob(tenantKey, job) {
+    await ready();
+    if (!job.eventId) return;
+    const event = await store.getWebhookEventById(tenantKey, job.eventId);
+    const resourceId = event?.providerResourceId ?? job.providerResourceId;
+    let matched = resourceId ? await store.findAttemptByProviderResource(tenantKey, event?.provider ?? "test_fake", resourceId) : null;
+    if (!matched && resourceId) {
+      for (const adapter of registry.list()) {
+        matched = await store.findAttemptByProviderResource(tenantKey, adapter.provider, resourceId);
+        if (matched) break;
+      }
+    }
+    if (!matched || !event) {
+      if (job.leaseId) {
+        await queue.retry(tenantKey, job.id, job.leaseId, {
+          errorCode: "ATTEMPT_NOT_BOUND",
+          retryAfterSeconds: backoffSeconds(job.attemptCount, void 0, runtime.random)
+        });
+      }
+      return;
+    }
+    const canonicalFromEvent = event.safeMetadata.canonicalStatus;
+    const canonical = typeof canonicalFromEvent === "string" ? canonicalFromEvent : matched.canonicalStatus;
+    const updated = {
+      ...matched,
+      canonicalStatus: applyMonotonicStatus(matched.canonicalStatus, canonical),
+      providerStatus: typeof event.safeMetadata.providerStatus === "string" ? event.safeMetadata.providerStatus : matched.providerStatus,
+      statusVersion: matched.statusVersion + 1,
+      updatedAt: now().toISOString()
+    };
+    await store.updateAttempt(updated);
+    await persistDecision(updated);
+    await store.settleWebhookEvent(tenantKey, event.id, "completed");
+    if (job.leaseId) await queue.complete(tenantKey, job.id, job.leaseId);
+  }
+  async function reconcile(actor, attemptId) {
+    await ready();
+    await authorize(actor, "reconcile", { type: "attempt", id: attemptId });
+    const targets = attemptId ? [await loadAttempt(actor, attemptId)] : (await store.listAttempts(actor.tenantKey)).filter((row) => !isTerminalStatus(row.canonicalStatus) && row.providerResourceId);
+    let reconciled = 0;
+    for (const attempt of targets) {
+      if (!attempt.providerResourceId) continue;
+      const adapter = adapterFor(attempt.provider, attempt.environment);
+      const snapshot = await adapter.retrieveAttempt({
+        attemptId: attempt.id,
+        providerResourceId: attempt.providerResourceId,
+        configurationRevision: attempt.configurationRevision
+      });
+      const next = {
+        ...attempt,
+        canonicalStatus: applyMonotonicStatus(attempt.canonicalStatus, snapshot.canonicalStatus),
+        providerStatus: snapshot.providerStatus,
+        normalizedReasonCodes: snapshot.normalizedReasonCodes,
+        statusVersion: attempt.statusVersion + 1,
+        updatedAt: now().toISOString()
+      };
+      await store.updateAttempt(next);
+      await persistDecision(next);
+      reconciled += 1;
+    }
+    await audit(actor, "reconcile", "attempt", attemptId ?? null, "reconciled", { count: reconciled });
+    return { reconciled };
+  }
+  async function scheduleReconciliation(actor) {
+    await ready();
+    await authorize(actor, "reconcile", { type: "tenant" });
+    const live = (await store.listAttempts(actor.tenantKey)).filter((row) => ["processing", "manual_review_required"].includes(row.canonicalStatus) && row.providerResourceId);
+    let enqueued = 0;
+    for (const attempt of live) {
+      await queue.enqueue({
+        tenantKey: actor.tenantKey,
+        id: newId("job", cryptoImpl),
+        kind: "reconcile",
+        attemptId: attempt.id,
+        eventId: null,
+        subjectHash: attempt.subjectHash,
+        providerResourceId: attempt.providerResourceId,
+        state: "scheduled",
+        leaseId: null,
+        leaseExpiresAt: null,
+        attemptCount: 0,
+        nextAttemptAt: now().toISOString(),
+        lastErrorCode: null,
+        createdAt: now().toISOString()
+      });
+      enqueued += 1;
+    }
+    await audit(actor, "reconcile.schedule", "tenant", actor.tenantKey, "scheduled", { count: enqueued });
+    return { enqueued };
+  }
+  async function claimWorkerJobs(actor, input2 = {}) {
+    await ready();
+    await authorize(actor, "reconcile", { type: "tenant" });
+    const limit = Math.min(input2.limit ?? runtime.workerConcurrency ?? 8, 32);
+    return queue.claim({
+      tenantKey: actor.tenantKey,
+      kinds: input2.kinds ?? ["webhook", "reconcile", "redact"],
+      workerId: input2.workerId ?? actor.actorId,
+      leaseSeconds: runtime.webhookLeaseSeconds ?? 30,
+      limit,
+      now: now()
+    });
+  }
+  async function processWorkerJob(actor, jobOrRef) {
+    await ready();
+    const job = "kind" in jobOrRef ? jobOrRef : await store.getJob(actor.tenantKey, jobOrRef.id);
+    if (!job) throw new EngineError("ATTEMPT_NOT_FOUND", "The worker job was not found.");
+    await authorize(actor, "process_webhook", { type: "job", id: job.id });
+    try {
+      if (job.kind === "webhook") await processWebhookJob(actor.tenantKey, job);
+      else if (job.kind === "reconcile") await reconcile(actor, job.attemptId ?? void 0);
+      else if (job.kind === "redact" && job.attemptId) {
+        const attempt = await store.getAttempt(actor.tenantKey, job.attemptId);
+        if (attempt) {
+          const adapter = adapterFor(attempt.provider, attempt.environment);
+          const result = await adapter.redactSubject({
+            subjectReference: attempt.subjectHash,
+            providerResourceId: attempt.providerResourceId,
+            requestReference: job.id
+          });
+          const status2 = result.disposition ?? (result.completed ? "redacted" : "retryable");
+          await store.updateRedactionStatus(actor.tenantKey, job.id, toRedactionStatus(status2));
+          if (result.completed) {
+            await store.updateAttempt({ ...attempt, canonicalStatus: "redacted", updatedAt: now().toISOString() });
+          }
+        }
+      }
+      if (job.leaseId && job.kind !== "webhook") await queue.complete(actor.tenantKey, job.id, job.leaseId);
+      return { processed: true, disposition: "completed" };
+    } catch (error) {
+      const safe = toSafeProviderFailure(error);
+      if (job.leaseId) {
+        const dead = job.attemptCount >= (runtime.maxWorkerAttempts ?? 8);
+        await queue.retry(actor.tenantKey, job.id, job.leaseId, {
+          errorCode: safe.safeCode,
+          retryAfterSeconds: backoffSeconds(job.attemptCount, safe.retryAfterSeconds, runtime.random),
+          deadLetter: dead
+        });
+        return { processed: true, disposition: dead ? "dead_letter" : "retryable" };
+      }
+      throw error;
+    }
+  }
+  async function submitAppeal(actor, command) {
+    await ready();
+    await authorize(actor, "appeal", { type: "attempt", id: command.attemptId });
+    const attempt = await loadAttempt(actor, command.attemptId);
+    const appeal = {
+      tenantKey: actor.tenantKey,
+      id: newId("apl", cryptoImpl),
+      attemptId: attempt.id,
+      subjectHash: attempt.subjectHash,
+      status: "open",
+      reason: command.reason,
+      policyVersion: attempt.policyVersion,
+      proposedByActorId: actor.actorId,
+      decidedByActorId: null,
+      expiresAt: command.expiresAt ?? null,
+      createdAt: now().toISOString(),
+      updatedAt: now().toISOString()
+    };
+    await store.saveAppeal(appeal);
+    if (isApplicationReasonCode(command.reason) && !attempt.normalizedReasonCodes.includes(command.reason)) {
+      await store.updateAttempt({
+        ...attempt,
+        normalizedReasonCodes: [...attempt.normalizedReasonCodes, command.reason],
+        updatedAt: now().toISOString()
+      });
+    }
+    await audit(actor, "appeal.submit", "appeal", appeal.id, "open");
+    return { appealId: appeal.id };
+  }
+  function applyGovernanceStatus(current, transition) {
+    const map = {
+      approve: "approved",
+      deny: "denied",
+      request_more_information: "more_information_requested",
+      revoke: "revoked",
+      expire: "expired"
+    };
+    return map[transition] ?? current;
+  }
+  async function transitionAppeal(actor, command) {
+    await ready();
+    await authorize(actor, "appeal", { type: "appeal", id: command.appealId });
+    const appeal = await store.getAppeal(actor.tenantKey, command.appealId);
+    if (!appeal) throw new EngineError("ATTEMPT_NOT_FOUND", "The appeal was not found.");
+    if (command.transition === "approve" || command.transition === "deny" || command.transition === "revoke") {
+      if (appeal.proposedByActorId === actor.actorId) {
+        throw new EngineError("GOVERNANCE_TWO_ACTOR", "The proposing actor cannot approve or deny their own appeal.");
+      }
+    }
+    const status2 = applyGovernanceStatus(appeal.status, command.transition);
+    await store.saveAppeal({
+      ...appeal,
+      status: status2,
+      reason: command.reason,
+      decidedByActorId: actor.actorId,
+      updatedAt: now().toISOString()
+    });
+    await audit(actor, "appeal.transition", "appeal", appeal.id, status2);
+    return { status: status2 };
+  }
+  async function proposeReview(actor, command) {
+    await ready();
+    await authorize(actor, "review", { type: "attempt", id: command.attemptId });
+    const attempt = await loadAttempt(actor, command.attemptId);
+    const reviewCase = {
+      tenantKey: actor.tenantKey,
+      id: newId("rev", cryptoImpl),
+      attemptId: attempt.id,
+      subjectHash: attempt.subjectHash,
+      status: "in_review",
+      reason: command.reason,
+      policyVersion: attempt.policyVersion,
+      assignedActorId: actor.actorId,
+      createdAt: now().toISOString(),
+      updatedAt: now().toISOString()
+    };
+    await store.saveReviewCase(reviewCase);
+    if (isApplicationReasonCode(command.reason) && !attempt.normalizedReasonCodes.includes(command.reason)) {
+      await store.updateAttempt({
+        ...attempt,
+        normalizedReasonCodes: [...attempt.normalizedReasonCodes, command.reason],
+        updatedAt: now().toISOString()
+      });
+    }
+    const proposal = {
+      tenantKey: actor.tenantKey,
+      id: newId("prp", cryptoImpl),
+      reviewCaseId: reviewCase.id,
+      attemptId: attempt.id,
+      proposedStatus: command.proposedStatus,
+      reason: command.reason,
+      policyVersion: attempt.policyVersion,
+      expiresAt: command.expiresAt ?? null,
+      proposedByActorId: actor.actorId,
+      approvedByActorId: null,
+      status: "proposed",
+      createdAt: now().toISOString()
+    };
+    await store.saveManualDecisionProposal(proposal);
+    await audit(actor, "review.propose", "manual_decision_proposal", proposal.id, "proposed");
+    return { proposalId: proposal.id, reviewCaseId: reviewCase.id };
+  }
+  async function decideReview(actor, command) {
+    await ready();
+    await authorize(actor, "review", { type: "proposal", id: command.proposalId });
+    const proposal = await store.getManualDecisionProposal(actor.tenantKey, command.proposalId);
+    if (!proposal) throw new EngineError("ATTEMPT_NOT_FOUND", "The manual decision proposal was not found.");
+    if (proposal.proposedByActorId === actor.actorId) {
+      throw new EngineError("GOVERNANCE_TWO_ACTOR", "The proposer cannot approve their own manual decision.");
+    }
+    if (command.transition === "deny") {
+      await store.saveManualDecisionProposal({ ...proposal, status: "rejected", approvedByActorId: actor.actorId });
+      await audit(actor, "review.decide", "manual_decision_proposal", proposal.id, "rejected");
+      return { status: "rejected" };
+    }
+    const attempt = await loadAttempt(actor, proposal.attemptId);
+    await store.saveManualDecisionProposal({ ...proposal, status: "approved", approvedByActorId: actor.actorId });
+    if (proposal.proposedStatus === "verified") {
+      await store.insertDecision({
+        tenantKey: actor.tenantKey,
+        id: newId("dec", cryptoImpl),
+        subjectHash: attempt.subjectHash,
+        packageCode: attempt.packageCode,
+        attemptId: attempt.id,
+        status: "verified",
+        source: "manual",
+        policyVersion: proposal.policyVersion,
+        reasonCodes: [command.reason],
+        effectiveAt: now().toISOString(),
+        expiresAt: proposal.expiresAt,
+        revokedAt: null,
+        proposerActorId: proposal.proposedByActorId,
+        approverActorId: actor.actorId,
+        createdAt: now().toISOString()
+      });
+    }
+    if (proposal.proposedStatus === "declined" || proposal.proposedStatus === "revoked") {
+      const nextStatus = proposal.proposedStatus === "declined" ? "declined" : attempt.canonicalStatus;
+      await store.updateAttempt({
+        ...attempt,
+        canonicalStatus: applyMonotonicStatus(attempt.canonicalStatus, nextStatus),
+        updatedAt: now().toISOString()
+      });
+    }
+    await audit(actor, "review.decide", "manual_decision_proposal", proposal.id, "approved");
+    return { status: "approved" };
+  }
+  async function transitionCase(actor, command) {
+    await ready();
+    await authorize(actor, "review", { type: "review_case", id: command.reviewCaseId });
+    const reviewCase = await store.getReviewCase(actor.tenantKey, command.reviewCaseId);
+    if (!reviewCase) throw new EngineError("ATTEMPT_NOT_FOUND", "The review case was not found.");
+    const status2 = applyGovernanceStatus(reviewCase.status, command.transition);
+    await store.saveReviewCase({
+      ...reviewCase,
+      status: status2,
+      reason: command.reason,
+      updatedAt: now().toISOString()
+    });
+    await audit(actor, "review.case", "review_case", reviewCase.id, status2);
+    return { status: status2 };
+  }
+  async function evaluateProtectedAction(actor, command) {
+    await ready();
+    await authorize(actor, "evaluate_protected_action", { type: "action", id: command.action });
+    const subjectHash = await store.hashSubject(actor.tenantKey, command.subjectReference);
+    const resourceHash = await store.hashResource(actor.tenantKey, command.resourceType, command.resourceReference);
+    const environment = runtime.productionEnabled ? "production" : "sandbox";
+    const policy = await policyStore.getActivePolicy(actor.tenantKey, environment === "production" ? "production" : "sandbox") ?? await policyStore.getActivePolicy(actor.tenantKey, "sandbox");
+    if (!policy) {
+      throw new EngineError("NO_ELIGIBLE_ROUTE", "No active verification policy is available for protected actions.");
+    }
+    let requirements = await policyStore.listProtectedActionRequirements(actor.tenantKey, command.action, policy.id);
+    if (!requirements.length) {
+      requirements = [{
+        tenantKey: actor.tenantKey,
+        id: "implicit_human_idv",
+        action: command.action,
+        packageCode: "human_idv",
+        policyVersionId: policy.id,
+        createdAt: now().toISOString()
+      }];
+    }
+    const missing = [];
+    for (const requirement of requirements) {
+      const decision = await store.getValidDecision(actor.tenantKey, subjectHash, requirement.packageCode, now());
+      if (!decision) missing.push(requirement.packageCode);
+    }
+    if (!missing.length) return { allowed: true };
+    const destinations = await policyStore.getContinuationDestinations(actor.tenantKey);
+    const destinationKey = command.destinationKey ?? "verification.resume";
+    if (!destinations.includes(destinationKey)) {
+      throw new EngineError("DESTINATION_NOT_ALLOWLISTED", "The continuation destination is not allowlisted.");
+    }
+    const token = randomToken(cryptoImpl);
+    const key = newId("cont", cryptoImpl);
+    const expiresAt = new Date(now().getTime() + (runtime.continuationTtlSeconds ?? 900) * 1e3).toISOString();
+    await store.saveContinuation({
+      tenantKey: actor.tenantKey,
+      key,
+      tokenHash: await sha256Hex(token),
+      action: command.action,
+      resourceHash,
+      subjectHash,
+      destinationKey,
+      expiresAt,
+      consumedAt: null
+    });
+    const denial = {
+      code: "VERIFICATION_REQUIRED",
+      action: command.action,
+      resourceHash,
+      requiredPackages: missing,
+      continuation: { key, token, expiresAt },
+      retryAfter: null,
+      supportPath: null
+    };
+    return denial;
+  }
+  const admin = {
+    async health(actor) {
+      await ready();
+      await authorize(actor, "admin.health", { type: "tenant" });
+      return {
+        observations: await store.listHealth(actor.tenantKey),
+        circuits: await store.listCircuits(actor.tenantKey)
+      };
+    },
+    async routes(actor) {
+      await ready();
+      await authorize(actor, "admin.routes", { type: "tenant" });
+      return store.listRoutes(actor.tenantKey);
+    },
+    async circuits(actor) {
+      await ready();
+      await authorize(actor, "admin.circuits", { type: "tenant" });
+      return store.listCircuits(actor.tenantKey);
+    },
+    async attempts(actor) {
+      await ready();
+      await authorize(actor, "admin.attempts", { type: "tenant" });
+      return store.listAttempts(actor.tenantKey);
+    },
+    async audit(actor) {
+      await ready();
+      await authorize(actor, "admin.audit", { type: "tenant" });
+      return store.listAudit(actor.tenantKey);
+    },
+    async proposeRoute(actor, input2) {
+      await ready();
+      await authorize(actor, "admin.propose_route", { type: "route" });
+      const request = {
+        tenantKey: actor.tenantKey,
+        id: newId("rcr", cryptoImpl),
+        routeId: input2.route.id,
+        proposedPayload: {
+          provider: input2.route.provider,
+          packageCode: String(input2.route.packageCode),
+          environment: input2.route.environment,
+          priority: input2.route.priority
+        },
+        status: "proposed",
+        reason: input2.reason,
+        policyVersion: input2.route.policyVersionId,
+        proposedByActorId: actor.actorId,
+        approvedByActorId: null,
+        approvedAt: null,
+        expiresAt: null,
+        createdAt: now().toISOString()
+      };
+      await store.saveRouteChangeRequest(request);
+      await store.saveRoute({
+        ...input2.route,
+        tenantKey: actor.tenantKey,
+        lifecycle: "draft",
+        proposedByActorId: actor.actorId,
+        approvedByActorId: null,
+        approvedAt: null,
+        activatedAt: null,
+        createdAt: now().toISOString(),
+        updatedAt: now().toISOString()
+      });
+      await audit(actor, "admin.propose_route", "route", input2.route.id, "proposed");
+      return { requestId: request.id };
+    },
+    async approveRoute(actor, requestId, reason) {
+      await ready();
+      await authorize(actor, "admin.approve_route", { type: "route_change_request", id: requestId });
+      const request = await store.getRouteChangeRequest(actor.tenantKey, requestId);
+      if (!request) throw new EngineError("ATTEMPT_NOT_FOUND", "The route change request was not found.");
+      if (request.proposedByActorId === actor.actorId) {
+        throw new EngineError("GOVERNANCE_TWO_ACTOR", "The proposer cannot approve their own route change.");
+      }
+      const route = request.routeId ? await store.getRoute(actor.tenantKey, request.routeId) : null;
+      if (!route) throw new EngineError("NO_ELIGIBLE_ROUTE", "The proposed route was not found.");
+      if (route.environment === "production" && !runtime.productionEnabled) {
+        throw new EngineError("PRODUCTION_NOT_ACTIVATED", "Production routes cannot be activated without the runtime key.");
+      }
+      await store.saveRouteChangeRequest({
+        ...request,
+        status: "approved",
+        reason,
+        approvedByActorId: actor.actorId,
+        approvedAt: now().toISOString()
+      });
+      await store.saveRoute({
+        ...route,
+        lifecycle: "active",
+        approvedByActorId: actor.actorId,
+        approvedAt: now().toISOString(),
+        activatedAt: now().toISOString(),
+        updatedAt: now().toISOString()
+      });
+      await audit(actor, "admin.approve_route", "route", route.id, "approved");
+      return { routeId: route.id };
+    },
+    async proposePolicy(actor, input2) {
+      await ready();
+      await authorize(actor, "admin.propose_policy", { type: "policy" });
+      const policy = {
+        tenantKey: actor.tenantKey,
+        id: newId("pol", cryptoImpl),
+        version: input2.version,
+        environment: input2.environment,
+        lifecycle: "draft",
+        reason: input2.reason,
+        expiresAt: input2.expiresAt ?? null,
+        proposedByActorId: actor.actorId,
+        approvedByActorId: null,
+        approvedAt: null,
+        activatedAt: null,
+        createdAt: now().toISOString(),
+        decisionRetentionDays: input2.decisionRetentionDays ?? null,
+        providerRedactionDelayDays: input2.providerRedactionDelayDays ?? null,
+        appealHoldDays: input2.appealHoldDays ?? null,
+        legalHold: input2.legalHold ?? false
+      };
+      await store.savePolicyVersion(policy);
+      await audit(actor, "admin.propose_policy", "policy", policy.id, "draft");
+      return { policyId: policy.id };
+    },
+    async approvePolicy(actor, policyId, reason) {
+      await ready();
+      await authorize(actor, "admin.approve_policy", { type: "policy", id: policyId });
+      const policy = await store.getPolicyVersion(actor.tenantKey, policyId);
+      if (!policy) throw new EngineError("ATTEMPT_NOT_FOUND", "The policy was not found.");
+      if (policy.proposedByActorId === actor.actorId) {
+        throw new EngineError("GOVERNANCE_TWO_ACTOR", "The proposer cannot approve their own policy.");
+      }
+      await store.savePolicyVersion({
+        ...policy,
+        lifecycle: "approved",
+        reason,
+        approvedByActorId: actor.actorId,
+        approvedAt: now().toISOString()
+      });
+      await audit(actor, "admin.approve_policy", "policy", policy.id, "approved");
+      return { policyId: policy.id };
+    },
+    async activatePolicy(actor, policyId) {
+      await ready();
+      await authorize(actor, "admin.activate_policy", { type: "policy", id: policyId });
+      const policy = await store.getPolicyVersion(actor.tenantKey, policyId);
+      if (!policy) throw new EngineError("ATTEMPT_NOT_FOUND", "The policy was not found.");
+      if (!twoActorApproved(policy.proposedByActorId, policy.approvedByActorId)) {
+        throw new EngineError("GOVERNANCE_TWO_ACTOR", "An active policy requires distinct proposer and approver.");
+      }
+      if (policy.environment === "production" && !runtime.productionEnabled) {
+        throw new EngineError("PRODUCTION_NOT_ACTIVATED", "Production policy activation requires the runtime production key.");
+      }
+      if (policy.environment === "production" && (policy.decisionRetentionDays == null || policy.providerRedactionDelayDays == null || policy.appealHoldDays == null)) {
+        throw new EngineError(
+          "PRODUCTION_NOT_ACTIVATED",
+          "Production policy activation requires explicit retention, redaction, appeal-hold, and legal-hold values."
+        );
+      }
+      await store.savePolicyVersion({
+        ...policy,
+        lifecycle: "active",
+        activatedAt: now().toISOString()
+      });
+      await audit(actor, "admin.activate_policy", "policy", policy.id, "active");
+      return { policyId: policy.id };
+    },
+    async emergencyDrain(actor, provider, environment, reason) {
+      await ready();
+      await authorize(actor, "admin.emergency_drain", { type: "provider", id: provider });
+      const circuit = await store.getCircuit(actor.tenantKey, provider, environment);
+      await store.saveCircuit({
+        ...circuit,
+        state: "open",
+        reasonCode: reason,
+        openUntil: new Date(now().getTime() + 24 * 36e5).toISOString(),
+        drainedByActorId: actor.actorId,
+        updatedAt: now().toISOString()
+      });
+      await audit(actor, "admin.emergency_drain", "circuit", provider, reason);
+      return { state: "open" };
+    }
+  };
+  return {
+    start,
+    resume,
+    status,
+    retry,
+    pause,
+    cancel,
+    redact,
+    ingestWebhook,
+    processWebhookJob,
+    reconcile,
+    appeal: { submit: submitAppeal, transition: transitionAppeal },
+    review: { propose: proposeReview, decide: decideReview, transitionCase },
+    admin,
+    evaluateProtectedAction,
+    workers: {
+      claim: claimWorkerJobs,
+      process: processWorkerJob,
+      scheduleReconciliation
+    }
+  };
+}
+function stripPersistedLaunch(launch) {
+  return launch;
+}
+var REDACTION_STATUSES = [
+  "scheduled",
+  "processing",
+  "retryable",
+  "redacted",
+  "not_applicable",
+  "dead_letter"
+];
+function toRedactionStatus(value) {
+  if (value === "failed") return "dead_letter";
+  if (value && REDACTION_STATUSES.includes(value)) return value;
+  return "retryable";
+}
+
+export { APPLICATION_REASON_CODES, AuthorizationError, ClientRouteInjectionError, EngineError, FORBIDDEN_CLIENT_ROUTE_KEYS, GOVERNANCE_TRANSITIONS, LIVE_ATTEMPT_STATUSES, WebhookSecurityIncidentError, applyMonotonicStatus, assertNoClientRouting, backoffSeconds, canTransitionStatus, canonicalize, cohortBucket, createMemoryQueue, createMemoryStore, createProviderRegistry, createRateBudget, createVerificationPlatform, digestCanonical, hmacSha256Hex, isApplicationReasonCode, seedSandboxExamples, selectRoute, sha256Hex };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map