@aopslabs/aops 0.2.0

package/dist/commands/commercial-artifact.js

@@ -0,0 +1,475 @@
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { Command } from 'commander';
+import { CommercialArtifactError, RELEASE_MANIFEST_PURPOSE, managedInstallationLayoutBinding, readVerifiedActiveCommercialArtifact, reestablishCommercialIntegrityAuthority, resolveManagedInstallationLayout, verifyOfflineArtifactImportAuthorization, } from '@aopslabs/artifact-trust-contracts';
+import { installCommercialArtifactBundle, readActiveCommercialArtifact, rollbackCommercialArtifact, } from '@aopslabs/artifact-trust-contracts';
+import { parseLeaseTrustBundleFile } from './commercial-license.js';
+import { setupInstallerReleaseBinding, verifySetupInstallerReleaseManifest, } from '../lib/setup-installer-release.js';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, expected, reason) {
+    const actual = Object.keys(value).sort();
+    if (JSON.stringify(actual) !== JSON.stringify([...expected].sort()))
+        throw new Error(reason);
+}
+function regularFile(filePath, reason) {
+    const absolute = path.resolve(process.cwd(), filePath);
+    const stat = lstatSync(absolute);
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error(reason);
+    return realpathSync.native(absolute);
+}
+function jsonFile(filePath, reason) {
+    try {
+        return JSON.parse(readFileSync(regularFile(filePath, reason), 'utf8'));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === reason)
+            throw error;
+        throw new Error(reason);
+    }
+}
+function requiredOption(value, reason) {
+    const normalized = value?.trim();
+    if (!normalized)
+        throw new Error(reason);
+    return normalized;
+}
+function optionalEpoch(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+        throw new Error('minimum_revocation_epoch_invalid');
+    }
+    return parsed;
+}
+export function loadReleaseTrustBundleFile(filePath) {
+    const resolved = regularFile(filePath, 'release_trust_bundle_unsafe');
+    let value;
+    try {
+        value = JSON.parse(readFileSync(resolved, 'utf8'));
+    }
+    catch {
+        throw new Error('release_trust_bundle_json_invalid');
+    }
+    if (!isRecord(value))
+        throw new Error('release_trust_bundle_schema_invalid');
+    exactKeys(value, ['schemaVersion', 'objectType', 'purpose', 'keys'], 'release_trust_bundle_schema_invalid');
+    if (value.schemaVersion !== 1 ||
+        value.objectType !== 'aops-release-trust-bundle-v1' ||
+        value.purpose !== RELEASE_MANIFEST_PURPOSE ||
+        !Array.isArray(value.keys) ||
+        value.keys.length === 0)
+        throw new Error('release_trust_bundle_schema_invalid');
+    const keys = value.keys.map((candidate) => {
+        if (!isRecord(candidate))
+            throw new Error('release_trust_key_invalid');
+        const actualKeys = Object.keys(candidate).sort();
+        const legacyKeys = ['alg', 'kid', 'publicKeyPem', 'purpose'];
+        const rotatingKeys = [
+            'alg', 'kid', 'notAfter', 'notBefore', 'publicKeyPem', 'purpose', 'status',
+        ];
+        const rotating = actualKeys.length === rotatingKeys.length &&
+            actualKeys.every((key, index) => key === rotatingKeys[index]);
+        if (!rotating &&
+            (actualKeys.length !== legacyKeys.length ||
+                actualKeys.some((key, index) => key !== legacyKeys[index])))
+            throw new Error('release_trust_key_invalid');
+        if (typeof candidate.kid !== 'string' ||
+            !/^release\/[A-Za-z0-9._~-]{1,160}$/.test(candidate.kid) ||
+            candidate.purpose !== RELEASE_MANIFEST_PURPOSE ||
+            candidate.alg !== 'EdDSA' ||
+            typeof candidate.publicKeyPem !== 'string' ||
+            !candidate.publicKeyPem.startsWith('-----BEGIN PUBLIC KEY-----') ||
+            (rotating &&
+                !['active', 'verify-only', 'retired', 'revoked'].includes(String(candidate.status))) ||
+            (rotating &&
+                candidate.notBefore !== null &&
+                typeof candidate.notBefore !== 'string') ||
+            (rotating &&
+                candidate.notAfter !== null &&
+                typeof candidate.notAfter !== 'string'))
+            throw new Error('release_trust_key_invalid');
+        if (candidate.kid.toLowerCase().includes('test-ephemeral')) {
+            throw new Error('release_trust_test_key_refused');
+        }
+        return {
+            kid: candidate.kid,
+            purpose: RELEASE_MANIFEST_PURPOSE,
+            alg: 'EdDSA',
+            publicKeyPem: candidate.publicKeyPem,
+            ...(rotating ? {
+                status: candidate.status,
+                ...(candidate.notBefore === null
+                    ? {}
+                    : { notBefore: candidate.notBefore }),
+                ...(candidate.notAfter === null
+                    ? {}
+                    : { notAfter: candidate.notAfter }),
+            } : {}),
+        };
+    });
+    if (new Set(keys.map((key) => key.kid)).size !== keys.length) {
+        throw new Error('release_trust_key_duplicate');
+    }
+    return { filePath: resolved, keys: Object.freeze(keys) };
+}
+function storeRoot(options) {
+    const configured = options.storeRoot?.trim() || process.env.AOPS_COMMERCIAL_ARTIFACT_STORE?.trim();
+    return path.resolve(configured || resolveManagedInstallationLayout().storeRoot);
+}
+function managedIntegrityStateRoot(selectedStoreRoot, layout = resolveManagedInstallationLayout()) {
+    return path.resolve(selectedStoreRoot) === path.resolve(layout.storeRoot)
+        ? layout.stateRoot
+        : undefined;
+}
+function commercialIntegrityStatus(managed, active, metrics) {
+    if (!active) {
+        return Object.freeze({
+            verificationMode: managed ? 'routine' : 'full',
+            scheduledVerification: managed
+                ? 'listener-readiness-worker-24h'
+                : 'not-applicable-custom-store',
+            authorityDecision: null,
+            fastPathEnabled: false,
+            fullVerificationPerformed: false,
+            customerVisibleRoutineStartupBudgetMs: 15000,
+            startupBudgetEvidenceClass: 'cold-process-real-time-antivirus-enabled-supported-machine',
+            reason: 'commercial_artifact_inactive',
+        });
+    }
+    if (!managed) {
+        return Object.freeze({
+            verificationMode: 'full',
+            scheduledVerification: 'not-applicable-custom-store',
+            authorityDecision: null,
+            fastPathEnabled: false,
+            fullVerificationPerformed: true,
+            customerVisibleRoutineStartupBudgetMs: 15000,
+            startupBudgetEvidenceClass: 'cold-process-real-time-antivirus-enabled-supported-machine',
+            reason: 'commercial_integrity_custom_store_full_verification',
+        });
+    }
+    const authorityDecision = metrics?.authorityDecision ?? null;
+    const reasons = {
+        verified: 'commercial_integrity_fast_path_verified',
+        'full-fallback-authority-unavailable': 'commercial_integrity_authority_unavailable_full_verification',
+        'full-fallback-authority-behind': 'commercial_integrity_authority_behind_full_verification',
+        'full-fallback-size-drift': 'commercial_integrity_size_drift_full_verification',
+        'full-heal-forward': 'commercial_integrity_pending_healed_by_full_verification',
+    };
+    return Object.freeze({
+        verificationMode: 'routine',
+        scheduledVerification: 'listener-readiness-worker-24h',
+        authorityDecision,
+        fastPathEnabled: authorityDecision === 'verified',
+        fullVerificationPerformed: metrics?.fullVerificationPerformed ?? true,
+        customerVisibleRoutineStartupBudgetMs: 15000,
+        startupBudgetEvidenceClass: 'cold-process-real-time-antivirus-enabled-supported-machine',
+        reason: authorityDecision === null
+            ? 'commercial_integrity_diagnostics_unavailable'
+            : reasons[authorityDecision],
+    });
+}
+function print(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function handleError(error) {
+    if (error instanceof CommercialArtifactError) {
+        print({
+            ok: false,
+            stage: error.stage,
+            decision: error.decision,
+            reason: error.reason,
+        });
+    }
+    else {
+        print({
+            ok: false,
+            stage: 'command-input',
+            decision: 'deny',
+            reason: error instanceof Error ? error.message : String(error),
+        });
+    }
+    process.exitCode = 1;
+}
+export function runCommercialArtifactInstall(options) {
+    try {
+        const bundleRoot = realpathSync.native(path.resolve(process.cwd(), options.from));
+        const trust = loadReleaseTrustBundleFile(options.trustBundle);
+        const trustRelative = path.relative(bundleRoot, trust.filePath);
+        if (!trustRelative.startsWith('..') && !path.isAbsolute(trustRelative)) {
+            throw new Error('release_trust_bundle_must_be_host_pinned_outside_artifact_bundle');
+        }
+        const managedLayout = options.bootstrapJson
+            ? (options.managedLayout ?? resolveManagedInstallationLayout())
+            : undefined;
+        const selectedStoreRoot = storeRoot(options);
+        if (managedLayout &&
+            path.resolve(selectedStoreRoot) !== path.resolve(managedLayout.storeRoot))
+            throw new Error('customer_managed_store_root_override_refused');
+        let offlineAuthorization;
+        let installerRelease;
+        if (options.bootstrapJson) {
+            const challengeFile = requiredOption(options.activationChallengeFile, 'offline_activation_challenge_file_required');
+            const leaseTrustFile = requiredOption(options.leaseTrustBundle, 'lease_trust_bundle_required');
+            const leaseTrust = regularFile(leaseTrustFile, 'lease_trust_bundle_invalid');
+            const leaseTrustRelative = path.relative(bundleRoot, leaseTrust);
+            if (!leaseTrustRelative.startsWith('..') && !path.isAbsolute(leaseTrustRelative)) {
+                throw new Error('lease_trust_bundle_must_be_host_pinned_outside_artifact_bundle');
+            }
+            const envelope = jsonFile(path.join(bundleRoot, 'release-manifest.json'), 'release_manifest_invalid');
+            const activationResponse = jsonFile(path.join(bundleRoot, 'offline-activation-response.json'), 'offline_activation_response_invalid');
+            const activationChallengeToken = readFileSync(regularFile(challengeFile, 'offline_activation_challenge_file_invalid'), 'utf8').trim();
+            const hostProtocolVersion = options.hostProtocolVersion;
+            const minimumRevocationEpoch = optionalEpoch(options.minimumRevocationEpoch);
+            offlineAuthorization = verifyOfflineArtifactImportAuthorization({
+                manifestEnvelope: envelope,
+                releaseTrustKeys: trust.keys,
+                hostProtocolVersion,
+                activationResponse,
+                activationChallengeToken,
+                leaseTrustKeys: parseLeaseTrustBundleFile(leaseTrust),
+                leaseIssuer: requiredOption(options.leaseIssuer, 'lease_issuer_required'),
+                expected: {
+                    tenantId: requiredOption(options.tenantId, 'tenant_id_required'),
+                    installationId: options.installationId,
+                    hostInstanceId: options.hostInstanceId,
+                    productId: requiredOption(options.productId, 'product_id_required'),
+                    ...(minimumRevocationEpoch === undefined
+                        ? {}
+                        : { minimumRevocationEpoch }),
+                },
+                now: options.now,
+            });
+            installerRelease = verifySetupInstallerReleaseManifest(envelope, {
+                trustKeys: trust.keys,
+                hostProtocolVersion,
+                now: options.now,
+            });
+        }
+        const receipt = installCommercialArtifactBundle({
+            storeRoot: selectedStoreRoot,
+            bundleRoot,
+            installationId: options.installationId,
+            hostInstanceId: options.hostInstanceId,
+            hostProtocolVersion: options.hostProtocolVersion,
+            trustKeys: trust.keys,
+            now: options.now,
+            customerMode: options.bootstrapJson === true,
+            ...(offlineAuthorization === undefined ? {} : { offlineAuthorization }),
+            requireRetainedRevocationEpoch: options.recovery === true,
+            ...(managedLayout === undefined ? {} : { managedLayout }),
+        });
+        if (options.bootstrapJson) {
+            if (!installerRelease)
+                throw new Error('installer_release_binding_required');
+            if (!managedLayout)
+                throw new Error('managed_installation_layout_required');
+            print({
+                schemaVersion: 1,
+                action: 'commercial-artifact.offline-install',
+                mode: 'offline',
+                ok: true,
+                decision: 'activated',
+                installationId: receipt.installationId,
+                hostInstanceId: receipt.hostInstanceId,
+                layout: managedInstallationLayoutBinding(managedLayout),
+                release: setupInstallerReleaseBinding(installerRelease),
+                artifact: {
+                    packageName: receipt.packageName,
+                    version: receipt.version,
+                    manifestDigest: receipt.manifestDigest,
+                    closureDigest: receipt.closureDigest,
+                    activationGeneration: receipt.activation.generation,
+                },
+                verification: {
+                    manifestSignature: receipt.verification.manifestSignatureDecision,
+                    closureReadback: receipt.verification.closureReadbackDecision,
+                    hostAbi: receipt.hostAbiReadback.decision,
+                    antiDowngrade: 'enforced',
+                    entitlement: 'verified',
+                    revocationEpoch: 'retained',
+                },
+            });
+            return;
+        }
+        print({
+            ok: true,
+            action: 'commercial-artifact.install',
+            decision: 'activated',
+            storeRoot: selectedStoreRoot,
+            receipt,
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function runCommercialArtifactStatus(options) {
+    try {
+        const selectedStoreRoot = storeRoot(options);
+        const integrityStateRoot = managedIntegrityStateRoot(selectedStoreRoot, options.managedLayout);
+        let routineVerification;
+        const receipt = readActiveCommercialArtifact({
+            storeRoot: selectedStoreRoot,
+            integrityStateRoot,
+            verificationMode: integrityStateRoot ? 'routine' : 'full',
+            onRoutineVerified: (metrics) => { routineVerification = metrics; },
+        });
+        print({
+            ok: true,
+            action: 'commercial-artifact.status',
+            storeRoot: selectedStoreRoot,
+            active: receipt,
+            integrity: commercialIntegrityStatus(integrityStateRoot !== undefined, receipt !== null, routineVerification),
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function runCommercialArtifactVerify(options) {
+    try {
+        const selectedStoreRoot = storeRoot(options);
+        const integrityStateRoot = managedIntegrityStateRoot(selectedStoreRoot, options.managedLayout);
+        if (!integrityStateRoot)
+            throw new Error('commercial_integrity_verify_requires_managed_store');
+        const trust = loadReleaseTrustBundleFile(options.trustBundle);
+        const active = readVerifiedActiveCommercialArtifact({
+            storeRoot: selectedStoreRoot,
+            integrityStateRoot,
+            verificationMode: 'scheduled',
+            trustKeys: trust.keys,
+            expectedIdentity: {
+                installationId: options.installationId,
+                hostInstanceId: options.hostInstanceId,
+            },
+        });
+        if (!active)
+            throw new Error('commercial_artifact_not_active');
+        print({
+            ok: true,
+            action: 'commercial-artifact.verify-full',
+            decision: 'verified',
+            receiptId: active.receipt.receiptId,
+            closureDigest: active.receipt.closureDigest,
+            activationGeneration: active.receipt.activation.generation,
+            nextScheduledVerificationAfterHours: 24,
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function runCommercialArtifactReestablishAuthority(options) {
+    try {
+        if (options.confirmAuthorityReestablish !== 'REESTABLISH-INTEGRITY-AUTHORITY') {
+            throw new Error('commercial_integrity_authority_reestablish_confirmation_required');
+        }
+        const selectedStoreRoot = storeRoot(options);
+        const integrityStateRoot = managedIntegrityStateRoot(selectedStoreRoot, options.managedLayout);
+        if (!integrityStateRoot) {
+            throw new Error('commercial_integrity_authority_reestablish_requires_managed_store');
+        }
+        const trust = loadReleaseTrustBundleFile(options.trustBundle);
+        const result = reestablishCommercialIntegrityAuthority({
+            storeRoot: selectedStoreRoot,
+            integrityStateRoot,
+            trustKeys: trust.keys,
+            expectedIdentity: {
+                installationId: options.installationId,
+                hostInstanceId: options.hostInstanceId,
+            },
+        });
+        print({
+            ok: true,
+            action: 'commercial-artifact.reestablish-integrity-authority',
+            decision: 'authority-reestablished-restart-required',
+            receiptId: result.authority.receiptId,
+            closureDigest: result.authority.closureDigest,
+            activationGeneration: result.authority.activationGeneration,
+            authorityReestablished: result.authority.authorityReestablished,
+            previousAnchorUnknown: result.authority.previousAnchorUnknown,
+            evidencePath: result.evidencePath,
+            nextAction: 'restart_aops_server_and_confirm_commercial_integrity_readback',
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+export function runCommercialArtifactRollback(options) {
+    try {
+        const trust = loadReleaseTrustBundleFile(options.trustBundle);
+        const selectedStoreRoot = storeRoot(options);
+        const receipt = rollbackCommercialArtifact({
+            storeRoot: selectedStoreRoot,
+            integrityStateRoot: managedIntegrityStateRoot(selectedStoreRoot, options.managedLayout),
+            trustKeys: trust.keys,
+        });
+        print({
+            ok: true,
+            action: 'commercial-artifact.rollback',
+            decision: 'activated-previous',
+            storeRoot: selectedStoreRoot,
+            receipt,
+        });
+    }
+    catch (error) {
+        handleError(error);
+    }
+}
+function withStoreRoot(command) {
+    return command
+        .option('--store-root <path>', 'Operator-mode artifact store override; customer bootstrap uses the canonical managed per-user root')
+        .option('--json', 'Print JSON output');
+}
+export function makeCommercialArtifactCommand() {
+    const command = new Command('commercial-artifact')
+        .description('Verify, install, inspect, and roll back signed private artifact closures');
+    withStoreRoot(command
+        .command('install')
+        .description('Verify a signed release bundle into CAS and atomically activate its receipt')
+        .requiredOption('--from <path>', 'Bundle directory containing release-manifest.json and objects/sha256')
+        .requiredOption('--trust-bundle <path>', 'Host-pinned release trust bundle outside the artifact bundle')
+        .requiredOption('--installation-id <id>', 'License-bound installation identity')
+        .requiredOption('--host-instance-id <id>', 'Host instance identity')
+        .option('--host-protocol-version <version>', 'Host commercial artifact ABI protocol', '1')
+        .option('--activation-challenge-file <path>', 'Customer offline mode: installation-signed challenge token file')
+        .option('--lease-trust-bundle <path>', 'Customer offline mode: host-pinned South lease trust bundle')
+        .option('--lease-issuer <issuer>', 'Customer offline mode: expected South lease issuer')
+        .option('--tenant-id <id>', 'Customer offline mode: expected tenant identity')
+        .option('--product-id <id>', 'Customer offline mode: expected licensed product identity')
+        .option('--minimum-revocation-epoch <epoch>', 'Customer offline mode: optional external epoch floor')
+        .option('--recovery', 'Require an existing retained revocation epoch before repair')
+        .option('--bootstrap-json', 'Print the strict secret-free native bootstrap receipt')
+        .action((options) => runCommercialArtifactInstall(options)));
+    withStoreRoot(command
+        .command('status')
+        .description('Verify and print the active host-owned installation receipt')
+        .action((options) => runCommercialArtifactStatus(options)));
+    withStoreRoot(command
+        .command('verify-full')
+        .description('Run an explicit full closure verification and refresh scheduled integrity authority')
+        .requiredOption('--trust-bundle <path>', 'Host-pinned release trust bundle')
+        .requiredOption('--installation-id <id>', 'Expected installation identity')
+        .requiredOption('--host-instance-id <id>', 'Expected host instance identity')
+        .action((options) => runCommercialArtifactVerify(options)));
+    withStoreRoot(command
+        .command('reestablish-integrity-authority')
+        .description('Guarded full verification that creates a new local integrity anchor after authority loss')
+        .requiredOption('--trust-bundle <path>', 'Host-pinned release trust bundle')
+        .requiredOption('--installation-id <id>', 'Expected installation identity')
+        .requiredOption('--host-instance-id <id>', 'Expected host instance identity')
+        .requiredOption('--confirm-authority-reestablish <phrase>', 'Must equal REESTABLISH-INTEGRITY-AUTHORITY; the prior local anchor becomes explicitly unknown')
+        .action((options) => runCommercialArtifactReestablishAuthority(options)));
+    withStoreRoot(command
+        .command('rollback')
+        .description('Re-verify the previous manifest and CAS closure before activation')
+        .requiredOption('--trust-bundle <path>', 'Host-pinned release trust bundle')
+        .action((options) => runCommercialArtifactRollback(options)));
+    return command;
+}