harnery 0.35.0 → 0.36.0

package/dist/core/events/v3/support-storage/maintenance.js

@@ -0,0 +1,352 @@
+import { createHash } from "node:crypto";
+import { constants, createReadStream } from "node:fs";
+import { chmod, lstat, mkdir, open, readdir, readFile, realpath } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { canonicalJsonV3 } from "../canonical.js";
+import { digestEventV3LogicalAuthority } from "./logical-authority.js";
+import { assertEventV3SupportPackAuthority, logicalEntriesDigestV3 } from "./pack-contract.js";
+import { verifyEventV3SupportPack } from "./pack-reader.js";
+import { writeEventV3SupportPack } from "./pack-writer.js";
+/** Freeze a content-free exact source set. No pack is written and no source is changed. */
+export async function planEventV3SupportTransaction(input) {
+    if (input.entries.length === 0)
+        throw new Error("event_v3_support_transaction_empty");
+    if (input.entries.some((entry) => entry.disposition !== "pack-eligible")) {
+        throw new Error("event_v3_support_transaction_contains_ineligible_source");
+    }
+    const verificationMode = input.authority_state === "archived" ? "archive-logical-authority" : "active-frozen-files";
+    if (verificationMode === "archive-logical-authority" && !input.source_authority_digest) {
+        throw new Error("event_v3_support_transaction_archive_digest_required");
+    }
+    if (verificationMode === "active-frozen-files" && input.source_authority_digest) {
+        throw new Error("event_v3_support_transaction_active_digest_forbidden");
+    }
+    const authorityRoot = await safeAuthorityRoot(input.authority_root);
+    const sources = input.entries
+        .map((entry) => ({
+        relative_path: entry.relative_path,
+        bytes: entry.bytes,
+        digest: entry.digest,
+        family: entry.family,
+        ...(entry.observed.recorded_at ? { recorded_at: entry.observed.recorded_at } : {}),
+    }))
+        .sort((left, right) => left.relative_path.localeCompare(right.relative_path));
+    const transactionId = `vst_${createHash("sha256")
+        .update(canonicalJsonV3({
+        authority_root: authorityRoot,
+        root_id: input.root_id,
+        genesis_id: input.genesis_id,
+        verification_mode: verificationMode,
+        source_authority_digest: input.source_authority_digest ?? null,
+        sources,
+        catalog_version: input.catalog_version,
+        policy_version: input.policy_version,
+    }))
+        .digest("hex")
+        .slice(0, 32)}`;
+    const transaction = {
+        format: "harnery-event-v3-support-maintenance",
+        format_version: 1,
+        transaction_id: transactionId,
+        sequence: 1,
+        state: "planned",
+        created_at: input.now,
+        updated_at: input.now,
+        catalog_version: input.catalog_version,
+        policy_version: input.policy_version,
+        authority: {
+            root: authorityRoot,
+            root_id: input.root_id,
+            genesis_id: input.genesis_id,
+            state: input.authority_state,
+            verification_mode: verificationMode,
+            ...(input.source_authority_digest
+                ? { source_authority_digest: input.source_authority_digest }
+                : {}),
+        },
+        sources,
+    };
+    const directory = transactionDirectory(input.transaction_root, transactionId);
+    try {
+        await mkdir(directory, { recursive: false, mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const existing = await readEventV3SupportTransaction(input.transaction_root, transactionId);
+        if (canonicalTransactionIdentity(existing) !== canonicalTransactionIdentity(transaction)) {
+            throw new Error("event_v3_support_transaction_id_conflict");
+        }
+        return existing;
+    }
+    await chmod(directory, 0o700);
+    await publishState(directory, transaction);
+    return transaction;
+}
+export async function writeEventV3SupportTransactionShadow(input) {
+    const transaction = await readEventV3SupportTransaction(input.transaction_root, exactTransactionId(input.transaction_id));
+    if (transaction.state !== "planned")
+        throw new Error("event_v3_support_shadow_state_invalid");
+    await assertFrozenSources(transaction);
+    const directory = transactionDirectory(input.transaction_root, transaction.transaction_id);
+    const shadowDirectory = join(directory, "shadow");
+    const written = await writeEventV3SupportPack({
+        authority_root: transaction.authority.root,
+        output_directory: shadowDirectory,
+        root_id: transaction.authority.root_id,
+        genesis_id: transaction.authority.genesis_id,
+        verification_mode: transaction.authority.verification_mode,
+        ...(transaction.authority.source_authority_digest
+            ? { source_authority_digest: transaction.authority.source_authority_digest }
+            : {}),
+        sources: transaction.sources.map((source) => ({
+            relative_path: source.relative_path,
+            family: source.family,
+            ...(source.recorded_at ? { recorded_at: source.recorded_at } : {}),
+            ...(source.diagnostic_category ? { diagnostic_category: source.diagnostic_category } : {}),
+            ...(source.diagnostic_reason ? { diagnostic_reason: source.diagnostic_reason } : {}),
+            expected_bytes: source.bytes,
+            expected_digest: source.digest,
+        })),
+        minimum_harnery_version: input.minimum_harnery_version,
+        created_at: transaction.created_at,
+    });
+    return transition(transaction, input.transaction_root, "shadow-written", input.now, {
+        shadow: {
+            manifest_path: relative(directory, written.manifest_path).replaceAll("\\", "/"),
+            payload_path: relative(directory, written.payload_path).replaceAll("\\", "/"),
+            pack_id: written.manifest.pack_id,
+        },
+    });
+}
+export async function verifyEventV3SupportTransactionShadow(input) {
+    const transaction = await readEventV3SupportTransaction(input.transaction_root, exactTransactionId(input.transaction_id));
+    if (transaction.state !== "shadow-written") {
+        throw new Error("event_v3_support_shadow_verify_state_invalid");
+    }
+    if (transaction.authority.genesis_id !== input.expected_current_genesis_id) {
+        throw new Error("event_v3_support_transaction_genesis_mismatch");
+    }
+    if (!transaction.shadow)
+        throw new Error("event_v3_support_shadow_missing");
+    await assertFrozenSources(transaction);
+    const directory = transactionDirectory(input.transaction_root, transaction.transaction_id);
+    const manifestPath = containedTransactionPath(directory, transaction.shadow.manifest_path);
+    const validated = await verifyEventV3SupportPack(manifestPath);
+    assertEventV3SupportPackAuthority(validated.manifest, {
+        root_id: transaction.authority.root_id,
+        genesis_id: transaction.authority.genesis_id,
+        verification_mode: transaction.authority.verification_mode,
+    });
+    const plannedSourceDigest = logicalEntriesDigestV3(transaction.sources.map(({ relative_path, bytes, digest }) => ({
+        path: relative_path,
+        bytes,
+        digest,
+    })));
+    if (validated.entries !== transaction.sources.length ||
+        validated.manifest.entries.logical_entries_digest !== plannedSourceDigest ||
+        validated.manifest.authority.source_files_digest !== plannedSourceDigest) {
+        throw new Error("event_v3_support_shadow_authority_mismatch");
+    }
+    if (validated.manifest.authority.source_authority_digest !==
+        transaction.authority.source_authority_digest) {
+        throw new Error("event_v3_support_shadow_source_authority_mismatch");
+    }
+    if (transaction.authority.verification_mode === "archive-logical-authority") {
+        const currentDigest = await digestEventV3LogicalAuthority(transaction.authority.root);
+        if (currentDigest !== transaction.authority.source_authority_digest) {
+            throw new Error("event_v3_support_shadow_archive_digest_mismatch");
+        }
+    }
+    return transition(transaction, input.transaction_root, "shadow-verified", input.now);
+}
+/** Record exact authorization only. Publication and source removal remain disabled. */
+export async function authorizeEventV3SupportReplacement(input) {
+    const transactionId = exactTransactionId(input.transaction_id);
+    if (!input.yes)
+        throw new Error("event_v3_support_replacement_yes_required");
+    if (exactTransactionId(input.exact_transaction_id) !== transactionId) {
+        throw new Error("event_v3_support_replacement_exact_transaction_mismatch");
+    }
+    const transaction = await readEventV3SupportTransaction(input.transaction_root, transactionId);
+    if (transaction.state !== "shadow-verified") {
+        throw new Error("event_v3_support_replacement_not_shadow_verified");
+    }
+    return transition(transaction, input.transaction_root, "replacement-ready", input.now, {
+        authorization: { exact_transaction_id: transactionId, authorized_at: input.now },
+    });
+}
+/** Produce the canary replacement plan without publishing a pack or deleting a source. */
+export async function planEventV3SupportReplacement(input) {
+    const transaction = await readEventV3SupportTransaction(input.transaction_root, exactTransactionId(input.transaction_id));
+    if (transaction.state !== "replacement-ready" || !transaction.shadow) {
+        throw new Error("event_v3_support_replacement_not_ready");
+    }
+    const finalRoot = join(transaction.authority.root, "support-packs");
+    return {
+        transaction_id: transaction.transaction_id,
+        enabled: false,
+        final_manifest_path: join(finalRoot, `${transaction.shadow.pack_id}.manifest.json`),
+        final_payload_path: join(finalRoot, `${transaction.shadow.pack_id}.ndjson.gz`),
+        frozen_source_paths: transaction.sources.map(({ relative_path }) => relative_path),
+        reason: "event_v3_support_replacement_activation_disabled",
+    };
+}
+export function activateEventV3SupportReplacement() {
+    throw new Error("event_v3_support_replacement_activation_disabled");
+}
+export async function recoverEventV3SupportTransaction(input) {
+    const transaction = await readEventV3SupportTransaction(input.transaction_root, exactTransactionId(input.transaction_id));
+    if (transaction.authority.genesis_id !== input.expected_current_genesis_id) {
+        throw new Error("event_v3_support_transaction_genesis_mismatch");
+    }
+    await assertFrozenSources(transaction);
+    if (transaction.state === "planned")
+        return { action: "write-shadow" };
+    if (transaction.state === "shadow-written") {
+        if (!transaction.shadow)
+            throw new Error("event_v3_support_shadow_missing");
+        const directory = transactionDirectory(input.transaction_root, transaction.transaction_id);
+        await verifyEventV3SupportPack(containedTransactionPath(directory, transaction.shadow.manifest_path));
+        return { action: "verify-shadow" };
+    }
+    if (transaction.state === "shadow-verified")
+        return { action: "await-authorization" };
+    return { action: "activation-disabled" };
+}
+export async function readEventV3SupportTransaction(transactionRoot, transactionId) {
+    const id = exactTransactionId(transactionId);
+    const directory = transactionDirectory(transactionRoot, id);
+    const directoryStat = await lstat(directory);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) {
+        throw new Error("event_v3_support_transaction_directory_invalid");
+    }
+    const names = (await readdir(directory))
+        .filter((name) => /^state-\d{6}\.json$/.test(name))
+        .sort();
+    if (names.length === 0)
+        throw new Error("event_v3_support_transaction_state_missing");
+    let prior;
+    for (const [index, name] of names.entries()) {
+        const current = validateTransaction(JSON.parse(await readFile(join(directory, name), "utf8")));
+        if (current.transaction_id !== id || current.sequence !== index + 1) {
+            throw new Error("event_v3_support_transaction_sequence_invalid");
+        }
+        if (prior && !validTransition(prior.state, current.state)) {
+            throw new Error("event_v3_support_transaction_transition_invalid");
+        }
+        prior = current;
+    }
+    return prior;
+}
+async function assertFrozenSources(transaction) {
+    const authorityReal = await realpath(transaction.authority.root);
+    for (const source of transaction.sources) {
+        const path = resolve(transaction.authority.root, ...source.relative_path.split("/"));
+        const sourceReal = await realpath(path);
+        if (relative(authorityReal, sourceReal).startsWith("..")) {
+            throw new Error("event_v3_support_frozen_source_escape");
+        }
+        const stat = await lstat(path);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error("event_v3_support_frozen_source_not_regular");
+        }
+        const digest = await hashFile(path);
+        if (stat.size !== source.bytes || digest !== source.digest) {
+            throw new Error(`event_v3_support_frozen_source_mismatch:${source.relative_path}`);
+        }
+    }
+}
+async function transition(transaction, transactionRoot, state, now, extension = {}) {
+    if (!validTransition(transaction.state, state)) {
+        throw new Error("event_v3_support_transaction_transition_invalid");
+    }
+    const next = validateTransaction({
+        ...transaction,
+        ...extension,
+        sequence: transaction.sequence + 1,
+        state,
+        updated_at: now,
+    });
+    await publishState(transactionDirectory(transactionRoot, transaction.transaction_id), next);
+    return next;
+}
+function validTransition(from, to) {
+    const order = [
+        "planned",
+        "shadow-written",
+        "shadow-verified",
+        "replacement-ready",
+        "replacement-active",
+        "committed",
+    ];
+    return order.indexOf(to) === order.indexOf(from) + 1;
+}
+async function publishState(directory, transaction) {
+    const path = join(directory, `state-${String(transaction.sequence).padStart(6, "0")}.json`);
+    const handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+    try {
+        await handle.writeFile(`${canonicalJsonV3(transaction)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+function transactionDirectory(root, id) {
+    return join(resolve(root), exactTransactionId(id));
+}
+function exactTransactionId(value) {
+    if (!/^vst_[0-9a-f]{32}$/.test(value))
+        throw new Error("event_v3_support_transaction_id_invalid");
+    return value;
+}
+function containedTransactionPath(directory, relativePath) {
+    if (relativePath.includes("\\") || relativePath.split("/").includes("..")) {
+        throw new Error("event_v3_support_transaction_path_invalid");
+    }
+    const path = resolve(directory, ...relativePath.split("/"));
+    if (relative(directory, path).startsWith("..")) {
+        throw new Error("event_v3_support_transaction_path_escape");
+    }
+    return path;
+}
+async function safeAuthorityRoot(root) {
+    const path = resolve(root);
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error("event_v3_support_transaction_authority_invalid");
+    }
+    return realpath(path);
+}
+function validateTransaction(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("event_v3_support_transaction_invalid");
+    }
+    const transaction = value;
+    if (transaction.format !== "harnery-event-v3-support-maintenance" ||
+        transaction.format_version !== 1 ||
+        !/^vst_[0-9a-f]{32}$/.test(transaction.transaction_id) ||
+        !Number.isSafeInteger(transaction.sequence) ||
+        transaction.sequence < 1 ||
+        !Array.isArray(transaction.sources) ||
+        transaction.sources.length === 0) {
+        throw new Error("event_v3_support_transaction_invalid");
+    }
+    return transaction;
+}
+function canonicalTransactionIdentity(transaction) {
+    return canonicalJsonV3({
+        transaction_id: transaction.transaction_id,
+        catalog_version: transaction.catalog_version,
+        policy_version: transaction.policy_version,
+        authority: transaction.authority,
+        sources: transaction.sources,
+    });
+}
+async function hashFile(path) {
+    const hash = createHash("sha256");
+    for await (const current of createReadStream(path))
+        hash.update(current);
+    return `sha256:${hash.digest("hex")}`;
+}

package/dist/core/events/v3/support-storage/pack-contract.d.ts

@@ -0,0 +1,59 @@
+export declare const EVENT_V3_SUPPORT_PACK_FORMAT: "harnery-event-v3-support-pack";
+export declare const EVENT_V3_SUPPORT_PACK_VERSION: 1;
+export declare const EVENT_V3_SUPPORT_FAMILIES: readonly ["diagnostic", "session-tee", "authority-ready", "authority-committed", "authority-residue"];
+export type EventV3SupportFamily = (typeof EVENT_V3_SUPPORT_FAMILIES)[number];
+export type EventV3SupportVerificationMode = "archive-logical-authority" | "active-frozen-files";
+export interface EventV3SupportPackRecord {
+    path: string;
+    bytes: number;
+    digest: `sha256:${string}`;
+    content_base64: string;
+}
+export interface EventV3SupportPackManifest {
+    format: typeof EVENT_V3_SUPPORT_PACK_FORMAT;
+    format_version: typeof EVENT_V3_SUPPORT_PACK_VERSION;
+    pack_id: `vsp_${string}`;
+    authority: {
+        root_id: string;
+        genesis_id: string;
+        verification_mode: EventV3SupportVerificationMode;
+        source_authority_digest?: `sha256:${string}`;
+        source_files_digest: `sha256:${string}`;
+    };
+    scope: {
+        families: EventV3SupportFamily[];
+        minimum_recorded_at: string | null;
+        maximum_recorded_at: string | null;
+    };
+    entries: {
+        count: number;
+        uncompressed_bytes: number;
+        logical_entries_digest: `sha256:${string}`;
+        by_family: Record<EventV3SupportFamily, number>;
+        by_diagnostic_category: Record<string, number>;
+        by_diagnostic_reason: Record<string, number>;
+    };
+    payload: {
+        algorithm: "gzip";
+        path: string;
+        bytes: number;
+        digest: `sha256:${string}`;
+    };
+    minimum_harnery_version: string;
+    created_at: string;
+}
+export interface EventV3LogicalAuthorityEntry {
+    path: string;
+    bytes: number;
+    digest: `sha256:${string}`;
+}
+export declare function normalizeEventV3SupportPath(value: string): string;
+export declare function logicalEntriesDigestV3(entries: readonly EventV3LogicalAuthorityEntry[]): `sha256:${string}`;
+export declare function validateEventV3SupportPackRecord(value: unknown): EventV3SupportPackRecord;
+export declare function validateEventV3SupportPackManifest(value: unknown): EventV3SupportPackManifest;
+export declare function assertEventV3SupportPackAuthority(manifest: EventV3SupportPackManifest, expected: {
+    root_id: string;
+    genesis_id: string;
+    verification_mode?: EventV3SupportVerificationMode;
+}): void;
+//# sourceMappingURL=pack-contract.d.ts.map

package/dist/core/events/v3/support-storage/pack-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-contract.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/support-storage/pack-contract.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,4BAA4B,EAAG,+BAAwC,CAAC;AACrF,eAAO,MAAM,6BAA6B,EAAG,CAAU,CAAC;AAExD,eAAO,MAAM,yBAAyB,uGAM5B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC9E,MAAM,MAAM,8BAA8B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAEjG,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IAC5C,cAAc,EAAE,OAAO,6BAA6B,CAAC;IACrD,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,8BAA8B,CAAC;QAClD,uBAAuB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;QAC7C,mBAAmB,EAAE,UAAU,MAAM,EAAE,CAAC;KACzC,CAAC;IACF,KAAK,EAAE;QACL,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,sBAAsB,EAAE,UAAU,MAAM,EAAE,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAChD,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;CAC5B;AAMD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBjE;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,4BAA4B,EAAE,GAC/C,UAAU,MAAM,EAAE,CAGpB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAWzF;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAyH7F;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,EAAE;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;CACpD,GACA,IAAI,CAaN"}

package/dist/core/events/v3/support-storage/pack-contract.js

@@ -0,0 +1,249 @@
+import { createHash } from "node:crypto";
+import { posix } from "node:path";
+import { canonicalJsonV3 } from "../canonical.js";
+export const EVENT_V3_SUPPORT_PACK_FORMAT = "harnery-event-v3-support-pack";
+export const EVENT_V3_SUPPORT_PACK_VERSION = 1;
+export const EVENT_V3_SUPPORT_FAMILIES = [
+    "diagnostic",
+    "session-tee",
+    "authority-ready",
+    "authority-committed",
+    "authority-residue",
+];
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const PACK_ID = /^vsp_[0-9a-f]{32}$/;
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+export function normalizeEventV3SupportPath(value) {
+    if (value.length === 0 ||
+        value.includes("\\") ||
+        value.includes("\0") ||
+        value.startsWith("/") ||
+        /^[A-Za-z]:/.test(value)) {
+        throw new Error("event_v3_support_path_is_unsafe");
+    }
+    const normalized = posix.normalize(value);
+    if (normalized !== value || value === "." || value.split("/").includes("..")) {
+        throw new Error("event_v3_support_path_is_noncanonical");
+    }
+    if (value === "support-packs" || value.startsWith("support-packs/")) {
+        throw new Error("event_v3_support_path_uses_reserved_subtree");
+    }
+    return value;
+}
+export function logicalEntriesDigestV3(entries) {
+    const sorted = [...entries].sort((left, right) => left.path.localeCompare(right.path));
+    return `sha256:${createHash("sha256").update(canonicalJsonV3(sorted)).digest("hex")}`;
+}
+export function validateEventV3SupportPackRecord(value) {
+    const record = object(value, "event_v3_support_record_invalid");
+    exactKeys(record, ["path", "bytes", "digest", "content_base64"]);
+    const path = normalizeEventV3SupportPath(string(record.path));
+    const bytes = nonnegativeInteger(record.bytes);
+    const digest = sha256(record.digest);
+    const content = string(record.content_base64);
+    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(content)) {
+        throw new Error("event_v3_support_record_base64_invalid");
+    }
+    return { path, bytes, digest, content_base64: content };
+}
+export function validateEventV3SupportPackManifest(value) {
+    const manifest = object(value, "event_v3_support_manifest_invalid");
+    exactKeys(manifest, [
+        "format",
+        "format_version",
+        "pack_id",
+        "authority",
+        "scope",
+        "entries",
+        "payload",
+        "minimum_harnery_version",
+        "created_at",
+    ]);
+    if (manifest.format !== EVENT_V3_SUPPORT_PACK_FORMAT || manifest.format_version !== 1) {
+        throw new Error("event_v3_support_manifest_version_unsupported");
+    }
+    const packId = string(manifest.pack_id);
+    if (!PACK_ID.test(packId))
+        throw new Error("event_v3_support_pack_id_invalid");
+    const authority = object(manifest.authority, "event_v3_support_authority_invalid");
+    const authorityKeys = ["root_id", "genesis_id", "verification_mode", "source_files_digest"];
+    if (authority.source_authority_digest !== undefined)
+        authorityKeys.push("source_authority_digest");
+    exactKeys(authority, authorityKeys);
+    const verificationMode = string(authority.verification_mode);
+    if (verificationMode !== "archive-logical-authority" &&
+        verificationMode !== "active-frozen-files") {
+        throw new Error("event_v3_support_verification_mode_invalid");
+    }
+    const sourceAuthorityDigest = optionalSha256(authority.source_authority_digest);
+    if (verificationMode === "archive-logical-authority" && !sourceAuthorityDigest) {
+        throw new Error("event_v3_support_archive_digest_required");
+    }
+    if (verificationMode === "active-frozen-files" && sourceAuthorityDigest) {
+        throw new Error("event_v3_support_active_authority_digest_forbidden");
+    }
+    const scope = object(manifest.scope, "event_v3_support_scope_invalid");
+    exactKeys(scope, ["families", "minimum_recorded_at", "maximum_recorded_at"]);
+    if (!Array.isArray(scope.families) || scope.families.length === 0) {
+        throw new Error("event_v3_support_scope_families_invalid");
+    }
+    const families = [...new Set(scope.families.map(family))].sort();
+    if (families.length !== scope.families.length) {
+        throw new Error("event_v3_support_scope_family_duplicate");
+    }
+    const minimumRecordedAt = nullableTimestamp(scope.minimum_recorded_at);
+    const maximumRecordedAt = nullableTimestamp(scope.maximum_recorded_at);
+    if ((minimumRecordedAt === null) !== (maximumRecordedAt === null)) {
+        throw new Error("event_v3_support_scope_time_range_incomplete");
+    }
+    if (minimumRecordedAt && maximumRecordedAt && minimumRecordedAt > maximumRecordedAt) {
+        throw new Error("event_v3_support_scope_time_range_invalid");
+    }
+    const entries = object(manifest.entries, "event_v3_support_entries_invalid");
+    exactKeys(entries, [
+        "count",
+        "uncompressed_bytes",
+        "logical_entries_digest",
+        "by_family",
+        "by_diagnostic_category",
+        "by_diagnostic_reason",
+    ]);
+    const count = nonnegativeInteger(entries.count);
+    if (count === 0)
+        throw new Error("event_v3_support_pack_empty");
+    const byFamily = familyRollup(entries.by_family);
+    if (Object.values(byFamily).reduce((sum, current) => sum + current, 0) !== count) {
+        throw new Error("event_v3_support_family_rollup_mismatch");
+    }
+    for (const key of EVENT_V3_SUPPORT_FAMILIES) {
+        if (byFamily[key] > 0 && !families.includes(key)) {
+            throw new Error("event_v3_support_scope_rollup_mismatch");
+        }
+    }
+    const payload = object(manifest.payload, "event_v3_support_payload_invalid");
+    exactKeys(payload, ["algorithm", "path", "bytes", "digest"]);
+    if (payload.algorithm !== "gzip")
+        throw new Error("event_v3_support_algorithm_unsupported");
+    const payloadPath = string(payload.path);
+    if (payloadPath !== `${packId}.ndjson.gz`) {
+        throw new Error("event_v3_support_payload_path_mismatch");
+    }
+    const minimumVersion = string(manifest.minimum_harnery_version);
+    if (!VERSION.test(minimumVersion))
+        throw new Error("event_v3_support_minimum_version_invalid");
+    return {
+        format: EVENT_V3_SUPPORT_PACK_FORMAT,
+        format_version: 1,
+        pack_id: packId,
+        authority: {
+            root_id: nonemptyString(authority.root_id),
+            genesis_id: nonemptyString(authority.genesis_id),
+            verification_mode: verificationMode,
+            ...(sourceAuthorityDigest ? { source_authority_digest: sourceAuthorityDigest } : {}),
+            source_files_digest: sha256(authority.source_files_digest),
+        },
+        scope: {
+            families,
+            minimum_recorded_at: minimumRecordedAt,
+            maximum_recorded_at: maximumRecordedAt,
+        },
+        entries: {
+            count,
+            uncompressed_bytes: nonnegativeInteger(entries.uncompressed_bytes),
+            logical_entries_digest: sha256(entries.logical_entries_digest),
+            by_family: byFamily,
+            by_diagnostic_category: stringRollup(entries.by_diagnostic_category),
+            by_diagnostic_reason: stringRollup(entries.by_diagnostic_reason),
+        },
+        payload: {
+            algorithm: "gzip",
+            path: payloadPath,
+            bytes: nonnegativeInteger(payload.bytes),
+            digest: sha256(payload.digest),
+        },
+        minimum_harnery_version: minimumVersion,
+        created_at: timestamp(manifest.created_at),
+    };
+}
+export function assertEventV3SupportPackAuthority(manifest, expected) {
+    if (manifest.authority.root_id !== expected.root_id) {
+        throw new Error("event_v3_support_pack_wrong_root_authority");
+    }
+    if (manifest.authority.genesis_id !== expected.genesis_id) {
+        throw new Error("event_v3_support_pack_wrong_genesis_authority");
+    }
+    if (expected.verification_mode !== undefined &&
+        manifest.authority.verification_mode !== expected.verification_mode) {
+        throw new Error("event_v3_support_pack_wrong_verification_mode");
+    }
+}
+function object(value, code) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(code);
+    return value;
+}
+function exactKeys(value, expected) {
+    if (Object.keys(value).sort().join("\0") !== [...expected].sort().join("\0")) {
+        throw new Error("event_v3_support_schema_unknown_field");
+    }
+}
+function string(value) {
+    if (typeof value !== "string")
+        throw new Error("event_v3_support_string_invalid");
+    return value;
+}
+function nonemptyString(value) {
+    const result = string(value);
+    if (result.length === 0 || result.length > 256)
+        throw new Error("event_v3_support_id_invalid");
+    return result;
+}
+function nonnegativeInteger(value) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error("event_v3_support_integer_invalid");
+    }
+    return value;
+}
+function sha256(value) {
+    const result = string(value);
+    if (!DIGEST.test(result))
+        throw new Error("event_v3_support_digest_invalid");
+    return result;
+}
+function optionalSha256(value) {
+    return value === undefined ? undefined : sha256(value);
+}
+function family(value) {
+    const result = string(value);
+    if (!EVENT_V3_SUPPORT_FAMILIES.includes(result)) {
+        throw new Error("event_v3_support_family_unknown");
+    }
+    return result;
+}
+function timestamp(value) {
+    const result = string(value);
+    if (!/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(result) ||
+        !Number.isFinite(Date.parse(result))) {
+        throw new Error("event_v3_support_timestamp_invalid");
+    }
+    return result;
+}
+function nullableTimestamp(value) {
+    return value === null ? null : timestamp(value);
+}
+function familyRollup(value) {
+    const rollup = object(value, "event_v3_support_family_rollup_invalid");
+    exactKeys(rollup, [...EVENT_V3_SUPPORT_FAMILIES]);
+    return Object.fromEntries(EVENT_V3_SUPPORT_FAMILIES.map((key) => [key, nonnegativeInteger(rollup[key])]));
+}
+function stringRollup(value) {
+    const rollup = object(value, "event_v3_support_rollup_invalid");
+    const result = {};
+    for (const [key, current] of Object.entries(rollup).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!/^[a-z0-9][a-z0-9_.-]{0,127}$/.test(key)) {
+            throw new Error("event_v3_support_rollup_key_invalid");
+        }
+        result[key] = nonnegativeInteger(current);
+    }
+    return result;
+}