mecord-connect 1.0.0

package/DISCLOSURE

@@ -0,0 +1,47 @@
+MECORD CONNECT — DUAL-USE CONTENT DISCLOSURE
+
+Package: mecord-connect
+Publisher: Kinthala Samuel Sampath Kumar
+Contact: support@splcart.in
+
+Purpose
+
+mecord-connect is the Windows runtime used to pair a user-authorized computer with Mecord Connect for legitimate development and computer-automation workflows initiated through ChatGPT.
+
+Why this package is declared dual-use
+
+The package contains security-relevant remote-management capabilities because it can:
+- connect a local runtime to an authenticated remote relay;
+- inspect and modify files within locally authorized project roots;
+- expose bounded Git/project operations;
+- run locally trusted project commands subject to policy and approval controls;
+- interact with browser/UI automation capabilities that are available to the private local runtime but are not broadly exposed by the public plugin.
+
+These capabilities can be useful for legitimate development, administration, automation, support, and security work, but similar capabilities could be misused if operated without authorization. For that reason the package declares:
+
+  "contentPolicy": {
+    "class": "dual-use"
+  }
+
+Intended legitimate use
+
+The Runtime is intended only for computers, accounts, repositories, websites, data, and services the user owns or is authorized to control.
+
+Safeguards
+
+Mecord Connect is designed to reduce misuse through multiple independent controls, including:
+- authenticated OAuth access to the hosted MCP service;
+- explicit device pairing and signed device identity;
+- locally enforced capability policy and authorized filesystem roots;
+- approval requirements for risk-bearing operations;
+- restricted public plugin tooling rather than unrestricted terminal/browser/UIA exposure;
+- credential/restricted-data guards and minimized public responses;
+- fail-closed relay/session behavior;
+- ambient credential stripping in the npm launcher;
+- immutable source/payload binding, integrity hashes, and Windows-native helper self-tests.
+
+The package is not intended to provide stealth, persistence, credential theft, malware delivery, access-control bypass, or unauthorized surveillance.
+
+Security and abuse reports
+
+Report suspected abuse or security issues privately to support@splcart.in. Do not send live passwords, access tokens, private keys, recovery credentials, or other active secrets.

package/LICENSE

@@ -0,0 +1,64 @@
+MECORD CONNECT RUNTIME LICENSE AGREEMENT
+
+Copyright (c) 2026 Kinthala Samuel Sampath Kumar. All rights reserved.
+
+This Mecord Connect Runtime License Agreement ("Agreement") governs your use of the software distributed as the mecord-connect package, including its bundled runtime payload, launchers, native helpers, updates, and accompanying documentation (collectively, the "Runtime").
+
+Licensor
+Kinthala Samuel Sampath Kumar
+Akkayapalem, Visakhapatnam, Andhra Pradesh, India
+Support contact: support@splcart.in
+
+1. License Grant
+
+Subject to this Agreement, the Licensor grants you a limited, non-exclusive, revocable, non-transferable, non-sublicensable license to install and use the Runtime on computers and accounts that you own or are authorized to control, solely for legitimate use with Mecord Connect and its supported local-development workflows.
+
+2. Permitted Use
+
+You may:
+- install and run the Runtime on authorized Windows computers;
+- use it to connect an authorized computer to Mecord Connect;
+- use functionality exposed through the Runtime only within the authorization, safety, approval, and access-control boundaries provided by Mecord Connect and the local Runtime;
+- make a reasonable backup copy solely for your own permitted use where applicable law allows.
+
+3. Restrictions
+
+Unless applicable law expressly requires otherwise, you may not:
+- redistribute, sell, sublicense, rent, lease, host, mirror, or republish the Runtime or a modified copy;
+- remove or alter copyright, license, safety, provenance, or security notices;
+- reverse engineer, decompile, disassemble, or attempt to derive source code from compiled components except to the limited extent such restriction is prohibited by applicable law;
+- bypass, disable, tamper with, or circumvent pairing, authentication, local approvals, capability policy, authorized-root restrictions, credential protections, rate limits, security checks, or other safeguards;
+- use the Runtime to access computers, accounts, data, services, repositories, or networks without authorization;
+- use the Runtime to distribute malware, steal credentials, evade access controls, interfere with systems, or violate applicable law or third-party rights.
+
+4. Ownership
+
+The Runtime is licensed, not sold. The Licensor and applicable contributors retain all right, title, and interest in and to the Runtime and all associated intellectual-property rights, except for third-party components governed by their own licenses.
+
+5. Hosted Services and Third Parties
+
+The Runtime may connect to Mecord Connect hosted services and third-party services. Access to those services may be subject to separate terms, privacy notices, availability limits, provider rules, and charges. This Agreement does not grant rights in third-party software or services.
+
+6. Updates and Changes
+
+The Licensor may update, replace, suspend, or discontinue the Runtime or related hosted functionality. Updated versions may require acceptance of updated terms where permitted by law.
+
+7. Termination
+
+This Agreement terminates automatically if you materially breach it. Upon termination, you must stop using and delete copies of the Runtime, except where retention is required by law. Provisions that by their nature should survive termination, including ownership, restrictions, disclaimers, liability limits, and governing law, survive.
+
+8. Disclaimer
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE RUNTIME IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR UNINTERRUPTED OR ERROR-FREE OPERATION. NOTHING IN THIS AGREEMENT EXCLUDES WARRANTIES OR RIGHTS THAT CANNOT LEGALLY BE EXCLUDED.
+
+9. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSOR WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, BUSINESS, OR GOODWILL ARISING FROM OR RELATED TO THE RUNTIME. NOTHING IN THIS AGREEMENT LIMITS LIABILITY THAT CANNOT LEGALLY BE LIMITED.
+
+10. Governing Law and Jurisdiction
+
+This Agreement is governed by the laws of India. Subject to mandatory consumer-protection and jurisdiction rules that cannot be waived, disputes relating to this Agreement are subject to the competent courts at Visakhapatnam, Andhra Pradesh, India.
+
+11. Contact
+
+Questions about this Agreement may be sent to support@splcart.in.

package/README.md

@@ -0,0 +1,44 @@
+# mecord-connect
+
+One-command Windows runtime for connecting a user-authorized computer to Mecord Connect in ChatGPT.
+
+```powershell
+npx mecord-connect@latest remote
+```
+
+Requires Windows x64 with a supported Node.js line: 22.14+, 24.x, or 26.x. Git features additionally require Git 2.45 or newer; older or missing Git disables only the Git capabilities while the rest of the Mecord Connect runtime remains available.
+
+The command does **not** install an MSIX and does **not** start a local MCP server. It verifies the package's runtime manifest, starts the existing hardened local policy/runtime agent, and connects that agent to the pinned production relay at `wss://operator.splcart.in/device`. ChatGPT talks to the hosted MCP edge.
+
+On first use the runtime prints a one-time device pairing code. Claim that code from Mecord Connect in the authenticated ChatGPT connection. The resulting short-lived relay credential is protected for the current Windows user with DPAPI and is rotated by the existing relay-session authority.
+
+By default the current directory is the authorized filesystem/project root. To authorize another folder explicitly:
+
+```powershell
+npx mecord-connect@latest remote --root C:\path\to\project
+```
+
+Use `--no-browser` to disable automatic launch of Mecord Connect's managed-browser capability. Generic terminal execution remains disabled by default; project commands continue to use the existing policy/approval boundary.
+
+Before starting a session you can verify the package payload and all three Windows-native security helpers:
+
+```powershell
+npx mecord-connect@latest doctor
+```
+
+`doctor` verifies every packaged runtime file against SHA-256/size metadata, exercises the DPAPI and Windows path-lease self-tests, and performs a protocol health check against the UI Automation sidecar. It does not start the relay connection.
+
+## Security model
+
+The npm launcher deliberately rebuilds the child environment from a small desktop allowlist. npm/GitHub/cloud tokens, `.npmrc` pointers, `NODE_OPTIONS`, caller-supplied Mecord Connect relay variables, and other ambient credentials are not inherited by the long-running runtime. The public package pins its relay/result authority to `operator.splcart.in`; callers cannot redirect a paired device by setting environment variables.
+
+The runtime payload is produced from the canonical repository sources at publication time, and includes the native DPAPI, UI Automation, and Windows path-lease helpers compiled in the Windows release workflow. The payload manifest records the exact Git commit and hashes every shipped file.
+
+## Support and policies
+
+- Support: https://operator.splcart.in/support
+- Privacy: https://operator.splcart.in/privacy
+- Terms: https://operator.splcart.in/terms
+- License: proprietary Mecord Connect Runtime License in `LICENSE`
+- Dual-use disclosure: `DISCLOSURE`
+- Issues: https://github.com/sampathkumar-co/Operator-runtime/issues

package/bin/operator.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { main } from '../src/cli.mjs';
+
+try {
+  await main(process.argv.slice(2));
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(`[mecord-connect] ${message}`);
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "mecord-connect",
+  "version": "1.0.0",
+  "description": "Secure one-command Mecord Connect runtime for connecting ChatGPT to a user-authorized Windows computer.",
+  "type": "module",
+  "bin": {
+    "mecord-connect": "bin/operator.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "runtime",
+    "README.md",
+    "DISCLOSURE",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.14.0 <23 || >=24.0.0 <25 || >=26.0.0 <27"
+  },
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "scripts": {
+    "build:runtime": "node ./scripts/build-runtime-payload.mjs",
+    "prepublishOnly": "node ./src/publish-check.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sampathkumar-co/Operator-runtime.git"
+  },
+  "homepage": "https://operator.splcart.in",
+  "keywords": [
+    "mecord-connect",
+    "chatgpt",
+    "mcp",
+    "windows",
+    "automation",
+    "developer-tools"
+  ],
+  "bugs": {
+    "url": "https://github.com/sampathkumar-co/Operator-runtime/issues",
+    "email": "support@splcart.in"
+  },
+  "contentPolicy": {
+    "class": "dual-use"
+  },
+  "author": {
+    "name": "Kinthala Samuel Sampath Kumar",
+    "email": "support@splcart.in"
+  }
+}

package/runtime/app/apps/local-agent/src/approval-store.js

@@ -0,0 +1,342 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+                                                                
+import { actionHash, canonicalJson } from '../../../src/core/action-identity.js';
+import { OperatorError } from '../../../src/core/errors.js';
+import { readDurableStateText, writeDurableStateText } from '../../../src/core/durable-state.js';
+
+const MAX_RECORDS = 2000;
+const RETENTION_MS = 24 * 60 * 60_000;
+const PENDING_TTL_MS = 10 * 60_000;
+const APPROVAL_TTL_MS = 10 * 60_000;
+
+                                                                            
+                                        
+                    
+                   
+                     
+  
+
+                              
+                   
+                     
+                        
+                            
+                     
+                              
+                  
+                         
+                    
+                           
+                      
+                             
+                      
+                    
+  
+
+                                                       
+                                                      
+
+export class ApprovalStore {
+  #file        ;
+  #clock            ;
+  #queue                = Promise.resolve();
+
+  constructor(stateDir        , options                         = {}) {
+    this.#file = path.join(path.resolve(stateDir), 'approvals.json');
+    this.#clock = options.clock ?? (() => new Date());
+  }
+
+  async register(action               , authority                           )                          {
+    const hash = actionHash(action);
+    const boundAuthority = approvalAuthorityHash(authority);
+    return await this.#mutate((state) => {
+      const now = this.#clock();
+      prune(state, now.getTime());
+      const existing = state.records.find((entry) => entry.actionId === action.id);
+      if (existing && existing.actionHash !== hash) {
+        throw new OperatorError('APPROVAL_ACTION_MISMATCH', 'Action ID is already bound to different action content.');
+      }
+      if (
+        existing
+        && existing.authorityHash === boundAuthority
+        && existing.status === 'pending'
+        && Date.parse(existing.pendingExpiresAt) > now.getTime()
+      ) return clone(existing);
+      if (
+        existing
+        && existing.authorityHash === boundAuthority
+        && existing.status === 'approved'
+        && existing.approvalExpiresAt
+        && Date.parse(existing.approvalExpiresAt) > now.getTime()
+      ) return clone(existing);
+
+      const record                 = {
+        actionId: action.id,
+        actionHash: hash,
+        authorityHash: boundAuthority,
+        approvalRequestId: crypto.randomUUID(),
+        capability: action.capability,
+        risk: action.risk,
+        target: action.target,
+        status: 'pending',
+        createdAt: now.toISOString(),
+        pendingExpiresAt: new Date(now.getTime() + PENDING_TTL_MS).toISOString()
+      };
+      if (existing) Object.assign(existing, record, {
+        approvedAt: undefined,
+        approvalExpiresAt: undefined,
+        consumedAt: undefined,
+        deniedAt: undefined
+      });
+      else {
+        if (state.records.length >= MAX_RECORDS) throw new OperatorError('APPROVAL_STORE_LIMIT', 'Approval store is full.');
+        state.records.push(record);
+      }
+      return clone(existing ?? record);
+    });
+  }
+
+  async list()                            {
+    return await this.#mutate((state) => {
+      prune(state, this.#clock().getTime());
+      return state.records.slice().reverse().map(clone);
+    });
+  }
+
+  async approve(actionId        , approvalRequestId        )                          {
+    const outcome = await this.#mutate((state) => {
+      const record = requireRecord(state, actionId);
+      requireApprovalRequest(record, approvalRequestId);
+      const now = this.#clock();
+      if (Date.parse(record.pendingExpiresAt) <= now.getTime()) {
+        removeRecord(state, actionId);
+        return { expired: true          };
+      }
+      if (record.status !== 'pending') {
+        throw new OperatorError('APPROVAL_NOT_PENDING', 'Only pending actions can be approved.');
+      }
+      record.status = 'approved';
+      record.approvedAt = now.toISOString();
+      record.approvalExpiresAt = new Date(now.getTime() + APPROVAL_TTL_MS).toISOString();
+      return { record: clone(record) };
+    });
+    if ('expired' in outcome) throw new OperatorError('APPROVAL_EXPIRED', 'Approval request has expired.');
+    return outcome.record;
+  }
+
+  async deny(actionId        , approvalRequestId        )                          {
+    const outcome = await this.#mutate((state) => {
+      const record = requireRecord(state, actionId);
+      requireApprovalRequest(record, approvalRequestId);
+      const now = this.#clock();
+      const expired = record.status === 'pending'
+        ? Date.parse(record.pendingExpiresAt) <= now.getTime()
+        : record.status === 'approved'
+          ? !record.approvalExpiresAt || Date.parse(record.approvalExpiresAt) <= now.getTime()
+          : false;
+      if (expired) {
+        removeRecord(state, actionId);
+        return { expired: true          };
+      }
+      if (record.status !== 'pending' && record.status !== 'approved') {
+        throw new OperatorError('APPROVAL_NOT_ACTIVE', 'Only pending or approved actions can be denied.');
+      }
+      record.status = 'denied';
+      record.deniedAt = now.toISOString();
+      return { record: clone(record) };
+    });
+    if ('expired' in outcome) throw new OperatorError('APPROVAL_EXPIRED', 'Approval request has expired.');
+    return outcome.record;
+  }
+
+  async isApproved(action               , authority                           )                   {
+    const expectedHash = actionHash(action);
+    const expectedAuthority = approvalAuthorityHash(authority);
+    return await this.#mutate((state) => {
+      prune(state, this.#clock().getTime());
+      const record = state.records.find((entry) => entry.actionId === action.id);
+      if (!record || record.status !== 'approved') return false;
+      if (record.actionHash !== expectedHash || record.authorityHash !== expectedAuthority) return false;
+      if (!record.approvalExpiresAt) return false;
+      return Date.parse(record.approvalExpiresAt) > this.#clock().getTime();
+    });
+  }
+
+  async consume(action               , authority                           )                {
+    const expectedHash = actionHash(action);
+    const expectedAuthority = approvalAuthorityHash(authority);
+    const outcome = await this.#mutate((state) => {
+      const record = requireRecord(state, action.id);
+      if (record.status !== 'approved' || record.actionHash !== expectedHash || record.authorityHash !== expectedAuthority) {
+        throw new OperatorError('APPROVAL_NOT_VALID', 'Action approval is not valid for this exact action and authority.');
+      }
+      if (!record.approvalExpiresAt || Date.parse(record.approvalExpiresAt) <= this.#clock().getTime()) {
+        removeRecord(state, action.id);
+        return { expired: true          };
+      }
+      record.status = 'consumed';
+      record.consumedAt = this.#clock().toISOString();
+      return { ok: true          };
+    });
+    if ('expired' in outcome) throw new OperatorError('APPROVAL_EXPIRED', 'Action approval has expired.');
+  }
+
+  async #read()                 {
+    try {
+      const text = await readDurableStateText(this.#file, {
+        maxBytes: 4 * 1024 * 1024,
+        errorCode: 'APPROVAL_STORE_CORRUPT',
+        invalidMessage: 'Approval store is invalid.'
+      });
+      const parsed = JSON.parse(text)                       ;
+      if (parsed?.version === 1) return { version: 2, records: [] };
+      return validateState(parsed         );
+    } catch (error) {
+      if ((error                         ).code === 'ENOENT') return { version: 2, records: [] };
+      throw error;
+    }
+  }
+
+  async #write(state       )                {
+    await writeDurableStateText(this.#file, JSON.stringify(validateState(state), null, 2), {
+      maxBytes: 4 * 1024 * 1024,
+      errorCode: 'APPROVAL_STORE_CORRUPT',
+      invalidMessage: 'Approval store is invalid.'
+    });
+  }
+
+  async #mutate   (fn                                  )             {
+    let release             ;
+    const previous = this.#queue;
+    this.#queue = new Promise      ((resolve) => { release = resolve; });
+    await previous;
+    try {
+      const state = await this.#read();
+      const value = await fn(state);
+      await this.#write(state);
+      return value;
+    } finally {
+      release();
+    }
+  }
+}
+
+function approvalAuthorityHash(authority                           )         {
+  const normalized = authority === undefined
+    ? { kind: 'local'          }
+    : {
+        kind: 'account'         ,
+        accountId: validUuid(authority.accountId, 'approval accountId'),
+        deviceId: validUuid(authority.deviceId, 'approval deviceId'),
+        generation: validGeneration(authority.generation)
+      };
+  return crypto.createHash('sha256').update(canonicalJson(normalized), 'utf8').digest('hex');
+}
+function requireRecord(state       , actionId        )                 {
+  const record = state.records.find((entry) => entry.actionId === actionId);
+  if (!record) throw new OperatorError('APPROVAL_NOT_FOUND', 'Approval request was not found.');
+  return record;
+}
+
+function requireApprovalRequest(record                , approvalRequestId        )       {
+  if (typeof approvalRequestId !== 'string' || approvalRequestId !== record.approvalRequestId) {
+    throw new OperatorError('APPROVAL_REQUEST_MISMATCH', 'Approval request identity is stale or invalid.');
+  }
+}
+
+function removeRecord(state       , actionId        )       {
+  state.records = state.records.filter((entry) => entry.actionId !== actionId);
+}
+
+function prune(state       , now        )       {
+  state.records = state.records.filter((entry) => {
+    if (Date.parse(entry.createdAt) < now - RETENTION_MS) return false;
+    if (entry.status === 'pending' && Date.parse(entry.pendingExpiresAt) <= now) return false;
+    if (entry.status === 'approved' && (!entry.approvalExpiresAt || Date.parse(entry.approvalExpiresAt) <= now)) return false;
+    return true;
+  });
+}
+
+function clone(record                )                 { return { ...record }; }
+function validateState(input       )        {
+  if (!input || typeof input !== 'object' || input.version !== 2 || !Array.isArray(input.records) || input.records.length > MAX_RECORDS) {
+    throw corrupt('Approval store structure is invalid.');
+  }
+  const actionIds = new Set        ();
+  const requestIds = new Set        ();
+  const records = input.records.map((raw) => {
+    if (!raw || typeof raw !== 'object') throw corrupt('Approval record is invalid.');
+    const actionId = validStoredText(raw.actionId, 256, 'action ID');
+    if (actionIds.has(actionId)) throw corrupt('Approval action ID is duplicated.');
+    actionIds.add(actionId);
+    const actionHashValue = String(raw.actionHash ?? '');
+    const authorityHash = String(raw.authorityHash ?? '');
+    if (!/^[0-9a-f]{64}$/.test(actionHashValue) || !/^[0-9a-f]{64}$/.test(authorityHash)) {
+      throw corrupt('Approval hashes are invalid.');
+    }
+    const approvalRequestId = String(raw.approvalRequestId ?? '');
+    if (!isUuid(approvalRequestId) || requestIds.has(approvalRequestId)) throw corrupt('Approval request ID is invalid or duplicated.');
+    requestIds.add(approvalRequestId);
+    const capability = validStoredText(raw.capability, 128, 'capability');
+    const risk = raw.risk;
+    if (!['read', 'write', 'external', 'system', 'destructive'].includes(risk)) throw corrupt('Approval risk is invalid.');
+    const status = raw.status;
+    if (!['pending', 'approved', 'consumed', 'denied'].includes(status)) throw corrupt('Approval status is invalid.');
+    const target = raw.target === undefined ? undefined : validStoredText(raw.target, 4096, 'target');
+    const createdAt = validIso(raw.createdAt, 'createdAt');
+    const pendingExpiresAt = validIso(raw.pendingExpiresAt, 'pendingExpiresAt');
+    if (Date.parse(pendingExpiresAt) <= Date.parse(createdAt)) throw corrupt('Pending approval expiry is invalid.');
+    const approvedAt = raw.approvedAt === undefined ? undefined : validIso(raw.approvedAt, 'approvedAt');
+    const approvalExpiresAt = raw.approvalExpiresAt === undefined ? undefined : validIso(raw.approvalExpiresAt, 'approvalExpiresAt');
+    const consumedAt = raw.consumedAt === undefined ? undefined : validIso(raw.consumedAt, 'consumedAt');
+    const deniedAt = raw.deniedAt === undefined ? undefined : validIso(raw.deniedAt, 'deniedAt');
+
+    if (status === 'pending' && (approvedAt || approvalExpiresAt || consumedAt || deniedAt)) throw corrupt('Pending approval metadata is inconsistent.');
+    if (status === 'approved' && (!approvedAt || !approvalExpiresAt || consumedAt || deniedAt)) throw corrupt('Approved metadata is inconsistent.');
+    if (status === 'consumed' && (!approvedAt || !approvalExpiresAt || !consumedAt || deniedAt)) throw corrupt('Consumed approval metadata is inconsistent.');
+    if (status === 'denied' && (!deniedAt || consumedAt)) throw corrupt('Denied approval metadata is inconsistent.');
+    if (approvedAt && Date.parse(approvedAt) < Date.parse(createdAt)) throw corrupt('Approval timestamp ordering is invalid.');
+    if (approvalExpiresAt && (!approvedAt || Date.parse(approvalExpiresAt) <= Date.parse(approvedAt))) throw corrupt('Approval expiry ordering is invalid.');
+    if (consumedAt && approvedAt && Date.parse(consumedAt) < Date.parse(approvedAt)) throw corrupt('Approval consumption ordering is invalid.');
+
+    return {
+      actionId, actionHash: actionHashValue, authorityHash, approvalRequestId,
+      capability, risk: risk                         , target, status: status                  ,
+      createdAt, pendingExpiresAt, approvedAt, approvalExpiresAt, consumedAt, deniedAt
+    }                         ;
+  });
+  return { version: 2, records };
+}
+function validStoredText(value         , max        , label        )         {
+  const text = String(value ?? '');
+  if (!text || text.length > max || /\0/.test(text)) throw corrupt(`Approval ${label} is invalid.`);
+  return text;
+}
+
+function validIso(value         , label        )         {
+  const text = String(value ?? '');
+  const time = Date.parse(text);
+  if (!Number.isFinite(time) || new Date(time).toISOString() !== text) throw corrupt(`Approval ${label} is invalid.`);
+  return text;
+}
+
+function validUuid(value         , label        )         {
+  const text = String(value ?? '');
+  if (!isUuid(text)) throw new OperatorError('APPROVAL_AUTHORITY_INVALID', `${label} must be a UUID.`);
+  return text.toLowerCase();
+}
+
+function validGeneration(value         )         {
+  const generation = Number(value);
+  if (!Number.isSafeInteger(generation) || generation < 1) throw new OperatorError('APPROVAL_AUTHORITY_INVALID', 'Approval authority generation is invalid.');
+  return generation;
+}
+
+function isUuid(value        )          {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+
+function corrupt(message        )                {
+  return new OperatorError('APPROVAL_STORE_CORRUPT', message);
+}