@ashlr/hub 3.2.6 → 3.3.0

package/dist/core/daemon/goal-conductor-permit-operator.js

@@ -0,0 +1,842 @@
+import { createHash, createPrivateKey, createPublicKey, randomBytes, } from 'node:crypto';
+import { closeSync, constants as fsConstants, fstatSync, existsSync, fchmodSync, lstatSync, openSync, opendirSync, readSync, realpathSync, fsyncSync, writeSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fsyncDirectory } from '../util/durability.js';
+import { assurePrivateStoragePath } from '../util/private-storage.js';
+import { writeImmutablePrivateRecord, } from '../util/immutable-private-record-store.js';
+import { resolveGoalConductorTarget, } from '../goals/conductor-target.js';
+import { nextActionableMilestone } from '../goals/advance.js';
+import { goalSnapshotDigest, listGoalsDetailed } from '../goals/store.js';
+import { listEnrolled } from '../sandbox/policy.js';
+import { GOAL_CONDUCTOR_ACTIVATION_TRUST_ROOTS, buildGoalConductorActivationPermitPayload, canonicalizeDaemonActivationValue, collectGoalConductorActivationContext, daemonActivationConfigDigest, goalConductorActivationNonceReceiptPath, goalConductorActivationReceiptPath, parseGoalConductorActivationPermitEnvelope, signGoalConductorActivationPermit, verifyGoalConductorActivationPermit, } from './activation-permit.js';
+const REQUEST_POLICY = 'goal-conductor-permit-request-v1';
+const SHA40_RE = /^[a-f0-9]{40}$/u;
+const SHA64_RE = /^[a-f0-9]{64}$/u;
+const MAX_OPERATOR_FILE_BYTES = 64 * 1024;
+const PRIVATE_FILE_MODE = 0o600;
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PERMIT_LIFETIME_MS = 120_000;
+const PERMIT_FILE_NAME = 'goal-conductor-activation-permit.json';
+const PUBLICATION_ROOT_NAME = 'goal-conductor-permit-publication';
+export const GOAL_CONDUCTOR_PERMIT_OPERATOR_TEST_CONTROL = Symbol.for('ashlr.goal-conductor-permit-operator.test-control.v1');
+const TEST_CONTROL_STATE = Symbol.for('ashlr.goal-conductor-permit-operator.test-control.state.v1');
+export function _setGoalConductorPermitOperatorTestControlForTest(sentinel, control) {
+    if (sentinel !== GOAL_CONDUCTOR_PERMIT_OPERATOR_TEST_CONTROL || process.env['VITEST'] !== 'true') {
+        throw new Error('goal conductor permit operator test control unavailable');
+    }
+    if (control === undefined)
+        Reflect.deleteProperty(globalThis, TEST_CONTROL_STATE);
+    else
+        Reflect.set(globalThis, TEST_CONTROL_STATE, Object.freeze({ ...control }));
+}
+function testControl() {
+    if (process.env['VITEST'] !== 'true')
+        return undefined;
+    return Reflect.get(globalThis, TEST_CONTROL_STATE);
+}
+function resolveLiveGoalConductorTarget(goalId) {
+    return resolveGoalConductorTarget(goalId, {
+        listGoalsDetailed,
+        listEnrolled,
+        nextActionableMilestone,
+        goalSnapshotDigest,
+    });
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((entry, index) => entry === expected[index]);
+}
+function iso(value) {
+    if (typeof value !== 'string')
+        return false;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
+function sha256(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function sameSnapshot(left, right) {
+    return left.dev === right.dev
+        && left.ino === right.ino
+        && left.mode === right.mode
+        && left.uid === right.uid
+        && left.gid === right.gid
+        && left.nlink === right.nlink
+        && left.size === right.size
+        && left.mtimeNs === right.mtimeNs
+        && left.ctimeNs === right.ctimeNs;
+}
+function ownedByCurrent(stat) {
+    return typeof process.getuid !== 'function' || stat.uid === BigInt(process.getuid());
+}
+function nestedWithin(anchor, candidate) {
+    const nested = relative(anchor, candidate);
+    return nested === '' || (nested !== '..' && !nested.startsWith(`..${sep}`) && !isAbsolute(nested));
+}
+function exactPrivateDirectory(path) {
+    try {
+        const stat = lstatSync(path, { bigint: true });
+        return stat.isDirectory() && !stat.isSymbolicLink() && ownedByCurrent(stat)
+            && (process.platform === 'win32' || (stat.mode & 511n) === BigInt(PRIVATE_DIRECTORY_MODE))
+            && realpathSync(path) === path;
+    }
+    catch {
+        return false;
+    }
+}
+function canonicalHome() {
+    try {
+        const requested = resolve(homedir());
+        const canonical = realpathSync(requested);
+        return requested === canonical ? canonical : null;
+    }
+    catch {
+        return null;
+    }
+}
+function inspectExistingPrivateControl() {
+    const home = canonicalHome();
+    if (!home)
+        return null;
+    const ashlrHome = join(home, '.ashlr');
+    const control = join(ashlrHome, 'control');
+    if (!exactPrivateDirectory(ashlrHome) || !exactPrivateDirectory(control))
+        return null;
+    const ashlrAssurance = assurePrivateStoragePath(ashlrHome, 'directory', 'inspect-existing', { anchorPath: home });
+    const controlAssurance = assurePrivateStoragePath(control, 'directory', 'inspect-existing', { anchorPath: home });
+    return ashlrAssurance.ok && controlAssurance.ok ? { home, ashlrHome, control } : null;
+}
+function nearestGitCheckout(path) {
+    let cursor = path;
+    for (;;) {
+        if (existsSync(join(cursor, '.git'))) {
+            try {
+                return realpathSync(cursor);
+            }
+            catch {
+                return null;
+            }
+        }
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            return null;
+        cursor = parent;
+    }
+}
+function externalArtifactPathReason(path, context, peers = []) {
+    if (!isAbsolute(path) || resolve(path) !== path || basename(path) === '' || existsSync(path)) {
+        return 'goal-conductor-operator-output-must-be-new-absolute-canonical-path';
+    }
+    let parent;
+    try {
+        parent = realpathSync(dirname(path));
+    }
+    catch {
+        return 'goal-conductor-operator-output-parent-unavailable';
+    }
+    if (parent !== dirname(path) || !exactPrivateDirectory(parent)) {
+        return 'goal-conductor-operator-output-parent-not-exact-private';
+    }
+    const home = canonicalHome();
+    const gitRoot = nearestGitCheckout(parent);
+    const forbidden = [
+        ...(home ? [join(home, '.ashlr')] : []),
+        ...(gitRoot ? [gitRoot] : []),
+        ...(context ? [context.releaseTree.path, context.target.projectPath] : []),
+        ...peers.map((peer) => dirname(peer)),
+    ].map((entry) => resolve(entry));
+    if (forbidden.some((entry) => nestedWithin(entry, path))) {
+        return 'goal-conductor-operator-output-inside-bound-or-custody-tree';
+    }
+    return null;
+}
+function externalExistingArtifactReason(path, context) {
+    if (!isAbsolute(path) || resolve(path) !== path) {
+        return 'goal-conductor-operator-input-path-not-absolute-canonical';
+    }
+    let canonical;
+    try {
+        canonical = realpathSync(path);
+    }
+    catch {
+        return 'goal-conductor-operator-input-unavailable';
+    }
+    if (canonical !== path || !exactPrivateDirectory(dirname(path))) {
+        return 'goal-conductor-operator-input-parent-not-exact-private';
+    }
+    const home = canonicalHome();
+    const gitRoot = nearestGitCheckout(dirname(path));
+    const forbidden = [
+        ...(home ? [join(home, '.ashlr')] : []),
+        ...(gitRoot ? [gitRoot] : []),
+        context.releaseTree.path,
+        context.target.projectPath,
+    ].map((entry) => resolve(entry));
+    return forbidden.some((entry) => nestedWithin(entry, path))
+        ? 'goal-conductor-operator-input-inside-bound-tree'
+        : null;
+}
+function processGroupIds() {
+    const groups = new Set();
+    if (typeof process.getgid === 'function')
+        groups.add(BigInt(process.getgid()));
+    if (typeof process.getgroups === 'function') {
+        for (const gid of process.getgroups())
+            groups.add(BigInt(gid));
+    }
+    return groups;
+}
+function custodyAnchorForPath(path) {
+    const parent = dirname(path);
+    const home = canonicalHome();
+    return home && nestedWithin(home, parent) ? home : parent;
+}
+function inspectCustodyAncestors(path, expectedAnchor) {
+    if (process.platform === 'win32') {
+        throw new Error('goal-conductor-permit-operator-unsupported-on-windows');
+    }
+    const immediateParent = dirname(path);
+    const anchor = expectedAnchor ?? custodyAnchorForPath(path);
+    if (!isAbsolute(anchor) || resolve(anchor) !== anchor || !nestedWithin(anchor, immediateParent)) {
+        throw new Error('unsafe-custody-anchor');
+    }
+    const currentUid = typeof process.getuid === 'function' ? BigInt(process.getuid()) : null;
+    const allowedGroups = processGroupIds();
+    let cursor = immediateParent;
+    for (;;) {
+        const stat = lstatSync(cursor, { bigint: true });
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.nlink < 1n) {
+            throw new Error('unsafe-custody-ancestor');
+        }
+        const ownerAllowed = currentUid === null || stat.uid === currentUid || stat.uid === 0n;
+        const worldWritable = (stat.mode & 2n) !== 0n;
+        const groupWritable = (stat.mode & 16n) !== 0n;
+        const trustedGroupWrite = groupWritable && currentUid !== null
+            && stat.uid === currentUid && allowedGroups.has(stat.gid);
+        if (!ownerAllowed || worldWritable || (groupWritable && !trustedGroupWrite)
+            || realpathSync(cursor) !== cursor) {
+            throw new Error('unsafe-custody-ancestor');
+        }
+        if (cursor === immediateParent) {
+            if (!ownedByCurrent(stat) || (stat.mode & 511n) !== BigInt(PRIVATE_DIRECTORY_MODE)) {
+                throw new Error('unsafe-custody-parent');
+            }
+            const assurance = assurePrivateStoragePath(immediateParent, 'directory', 'inspect-owned', { anchorPath: anchor });
+            if (!assurance.ok)
+                throw new Error('unsafe-custody-parent-acl');
+        }
+        if (cursor === anchor)
+            return anchor;
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            throw new Error('unsafe-custody-anchor');
+        cursor = parent;
+    }
+}
+function safePinnedPrivateFile(stat, maxBytes) {
+    return stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1n
+        && ownedByCurrent(stat) && (stat.mode & 511n) === 384n
+        && stat.size > 0n && stat.size <= BigInt(maxBytes);
+}
+function readPinnedPrivateFile(path, maxBytes = MAX_OPERATOR_FILE_BYTES) {
+    if (!isAbsolute(path) || resolve(path) !== path) {
+        throw new Error('private-file-path-not-canonical');
+    }
+    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+    const fd = openSync(path, fsConstants.O_RDONLY | noFollow);
+    let bytes;
+    let transferred = false;
+    try {
+        try {
+            const openedBefore = fstatSync(fd, { bigint: true });
+            if (!safePinnedPrivateFile(openedBefore, maxBytes)) {
+                throw new Error('private-file-custody-unsafe');
+            }
+            const control = testControl();
+            control?.pinnedFileAfterOpen?.({ path });
+            const custodyAnchor = inspectCustodyAncestors(path);
+            const assuranceBefore = assurePrivateStoragePath(path, 'file', 'inspect-owned', {
+                anchorPath: custodyAnchor,
+            });
+            if (!assuranceBefore.ok)
+                throw new Error('private-file-acl-unsafe');
+            if (realpathSync(path) !== path)
+                throw new Error('private-file-path-not-canonical');
+            const namedBefore = lstatSync(path, { bigint: true });
+            if (!safePinnedPrivateFile(namedBefore, maxBytes)
+                || !sameSnapshot(openedBefore, namedBefore)) {
+                throw new Error('private-file-changed-during-open');
+            }
+            bytes = Buffer.alloc(Number(openedBefore.size));
+            control?.observePinnedFileBuffer?.(path, bytes);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const length = bytes.length - offset;
+                const read = (requestedLength = length) => {
+                    if (!Number.isSafeInteger(requestedLength) || requestedLength <= 0 || requestedLength > length) {
+                        throw new Error('invalid-test-private-file-read-length');
+                    }
+                    return readSync(fd, bytes, offset, requestedLength, offset);
+                };
+                const count = control?.pinnedFileRead
+                    ? control.pinnedFileRead({ path, offset, length, read })
+                    : read();
+                if (!Number.isSafeInteger(count) || count <= 0 || count > length) {
+                    throw new Error('private-file-short-read');
+                }
+                offset += count;
+            }
+            const openedAfter = control?.pinnedFilePostFstat
+                ? control.pinnedFilePostFstat({ path, stat: () => fstatSync(fd, { bigint: true }) })
+                : fstatSync(fd, { bigint: true });
+            const namedAfter = control?.pinnedFilePostLstat
+                ? control.pinnedFilePostLstat({ path, stat: () => lstatSync(path, { bigint: true }) })
+                : lstatSync(path, { bigint: true });
+            if (!sameSnapshot(openedBefore, openedAfter) || !sameSnapshot(openedAfter, namedAfter)) {
+                throw new Error('private-file-changed-during-read');
+            }
+            inspectCustodyAncestors(path, custodyAnchor);
+            const assuranceAfter = assurePrivateStoragePath(path, 'file', 'inspect-owned', {
+                anchorPath: custodyAnchor,
+            });
+            if (!assuranceAfter.ok)
+                throw new Error('private-file-acl-unsafe');
+            if (realpathSync(path) !== path)
+                throw new Error('private-file-path-not-canonical');
+            const openedFinal = fstatSync(fd, { bigint: true });
+            const namedFinal = lstatSync(path, { bigint: true });
+            if (!safePinnedPrivateFile(openedFinal, maxBytes)
+                || !safePinnedPrivateFile(namedFinal, maxBytes)
+                || !sameSnapshot(openedBefore, openedFinal)
+                || !sameSnapshot(openedFinal, namedFinal)) {
+                throw new Error('private-file-changed-during-read');
+            }
+        }
+        finally {
+            const control = testControl();
+            const close = () => closeSync(fd);
+            if (control?.pinnedFileClose)
+                control.pinnedFileClose({ path, close });
+            else
+                close();
+        }
+        if (!bytes)
+            throw new Error('private-file-read-buffer-unavailable');
+        transferred = true;
+        return bytes;
+    }
+    finally {
+        if (!transferred)
+            bytes?.fill(0);
+    }
+}
+function privateKeyLocationReason(input, context) {
+    const path = input.privateKeyPath;
+    if (!isAbsolute(path) || resolve(path) !== path) {
+        return 'goal-conductor-private-key-path-not-absolute-canonical';
+    }
+    let canonical;
+    try {
+        canonical = realpathSync(path);
+    }
+    catch {
+        return 'goal-conductor-private-key-unavailable';
+    }
+    if (canonical !== path || !exactPrivateDirectory(dirname(path))) {
+        return 'goal-conductor-private-key-custody-directory-not-exact-private';
+    }
+    const home = canonicalHome();
+    const gitRoot = nearestGitCheckout(dirname(path));
+    const forbidden = [
+        ...(home ? [join(home, '.ashlr')] : []),
+        ...(gitRoot ? [gitRoot] : []),
+        context.releaseTree.path,
+        context.target.projectPath,
+        dirname(input.requestPath),
+        dirname(input.outputPath),
+    ].map((entry) => resolve(entry));
+    if (forbidden.some((entry) => nestedWithin(entry, path))) {
+        return 'goal-conductor-private-key-inside-forbidden-tree';
+    }
+    return null;
+}
+function validTrustRoot(value) {
+    if (!isRecord(value) || !exactKeys(value, ['keyId', 'publicKeyPem']))
+        return false;
+    if (typeof value['keyId'] !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(value['keyId'])) {
+        return false;
+    }
+    if (typeof value['publicKeyPem'] !== 'string')
+        return false;
+    try {
+        return createPublicKey(value['publicKeyPem']).asymmetricKeyType === 'ed25519';
+    }
+    catch {
+        return false;
+    }
+}
+function parseRequest(value) {
+    if (!isRecord(value) || !exactKeys(value, [
+        'schemaVersion', 'policyVersion', 'requestId', 'requestedAt',
+        'expectedReleaseRevision', 'trustRoots', 'context',
+    ]))
+        return null;
+    if (value['schemaVersion'] !== 1 || value['policyVersion'] !== REQUEST_POLICY
+        || typeof value['requestId'] !== 'string' || !SHA64_RE.test(value['requestId'])
+        || !iso(value['requestedAt'])
+        || typeof value['expectedReleaseRevision'] !== 'string'
+        || !SHA40_RE.test(value['expectedReleaseRevision'])
+        || !Array.isArray(value['trustRoots']) || value['trustRoots'].length < 1
+        || value['trustRoots'].length > 16 || !value['trustRoots'].every(validTrustRoot)
+        || !isRecord(value['context']))
+        return null;
+    if (!exactKeys(value['context'], [
+        'nowMs', 'configDigest', 'buildIdentity', 'executable', 'entrypoint',
+        'releaseTree', 'authorityStateDigest', 'killSwitchOff',
+        'guardHealthHealthy', 'target',
+    ]))
+        return null;
+    const context = value['context'];
+    try {
+        const probe = buildGoalConductorActivationPermitPayload({
+            permitId: '0'.repeat(32), nonce: '0'.repeat(64), keyId: value['trustRoots'][0].keyId,
+            issuedAt: value['requestedAt'], expiresAt: new Date(Date.parse(value['requestedAt']) + PERMIT_LIFETIME_MS).toISOString(),
+            context,
+        });
+        void probe;
+    }
+    catch {
+        return null;
+    }
+    const roots = value['trustRoots'];
+    if (new Set(roots.map((root) => root.keyId)).size !== roots.length)
+        return null;
+    const spkiIdentities = roots.map((root) => Buffer.from(createPublicKey(root.publicKeyPem).export({ format: 'der', type: 'spki' })).toString('base64'));
+    if (new Set(spkiIdentities).size !== spkiIdentities.length)
+        return null;
+    if (context.buildIdentity.provenance !== 'github-actions'
+        || context.buildIdentity.dirty !== null
+        || context.buildIdentity.revision !== value['expectedReleaseRevision']
+        || !context.killSwitchOff
+        || !context.guardHealthHealthy
+        || context.releaseTree.path !== resolve(context.releaseTree.path)
+        || basename(context.releaseTree.path) !== value['expectedReleaseRevision']
+        || !context.entrypoint.path.startsWith(`${context.releaseTree.path}${sep}`))
+        return null;
+    return value;
+}
+export function canonicalGoalConductorPermitRequest(request) {
+    if (!parseRequest(request))
+        throw new Error('invalid-goal-conductor-permit-request');
+    return `${canonicalizeDaemonActivationValue(request)}\n`;
+}
+function immutableReleaseReason(context, revision) {
+    if (context.buildIdentity.provenance !== 'github-actions'
+        || context.buildIdentity.dirty !== null
+        || context.buildIdentity.revision !== revision) {
+        return 'goal-conductor-runtime-build-identity-not-exact-github-actions-release';
+    }
+    const canonicalHome = realpathSync(resolve(homedir()));
+    const expectedRoot = join(canonicalHome, '.local', 'share', 'ashlr', 'releases', revision);
+    if (context.releaseTree.path !== expectedRoot || basename(context.releaseTree.path) !== revision) {
+        return 'goal-conductor-runtime-is-not-exact-installed-release';
+    }
+    if (!context.entrypoint.path.startsWith(`${expectedRoot}${sep}`)) {
+        return 'goal-conductor-entrypoint-outside-installed-release';
+    }
+    const pending = [expectedRoot];
+    let entries = 0;
+    while (pending.length > 0) {
+        const path = pending.pop();
+        const stat = lstatSync(path, { bigint: true });
+        if (stat.isSymbolicLink() || !ownedByCurrent(stat) || (stat.mode & 146n) !== 0n) {
+            return 'goal-conductor-installed-release-not-immutable';
+        }
+        if (stat.isDirectory()) {
+            const directory = opendirSync(path);
+            try {
+                for (;;) {
+                    const entry = directory.readSync();
+                    if (!entry)
+                        break;
+                    entries += 1;
+                    if (entries > 20_000)
+                        return 'goal-conductor-installed-release-entry-bound-exceeded';
+                    pending.push(join(path, entry.name));
+                }
+            }
+            finally {
+                directory.closeSync();
+            }
+        }
+        else if (!stat.isFile()) {
+            return 'goal-conductor-installed-release-contains-unsupported-entry';
+        }
+    }
+    return null;
+}
+export function buildGoalConductorPermitRequest(cfg, input, dependencies = {}) {
+    const roots = dependencies.trustRoots ?? GOAL_CONDUCTOR_ACTIVATION_TRUST_ROOTS;
+    if (roots.length === 0) {
+        return { ok: false, state: 'blocked', reason: 'no-trusted-goal-conductor-activation-roots' };
+    }
+    if (!SHA40_RE.test(input.expectedReleaseRevision)) {
+        return { ok: false, state: 'blocked', reason: 'expected-release-revision-invalid' };
+    }
+    if (!inspectExistingPrivateControl()) {
+        return { ok: false, state: 'blocked', reason: 'goal-conductor-preexisting-private-control-required' };
+    }
+    const resolution = (dependencies.resolveTarget ?? resolveLiveGoalConductorTarget)(input.goalId);
+    if (!resolution.ok || !resolution.target) {
+        return { ok: false, state: 'blocked', reason: resolution.reason };
+    }
+    let context;
+    try {
+        context = (dependencies.collectContext ?? collectGoalConductorActivationContext)(cfg, resolution.target);
+    }
+    catch {
+        return { ok: false, state: 'degraded', reason: 'goal-conductor-runtime-context-unavailable' };
+    }
+    if (context.configDigest !== daemonActivationConfigDigest(cfg)) {
+        return { ok: false, state: 'blocked', reason: 'goal-conductor-strict-config-digest-mismatch' };
+    }
+    if (!context.killSwitchOff) {
+        return { ok: false, state: 'blocked', reason: 'kill-switch-is-on' };
+    }
+    if (!context.guardHealthHealthy) {
+        return { ok: false, state: 'blocked', reason: 'guard-health-degraded' };
+    }
+    let releaseReason;
+    try {
+        releaseReason = (dependencies.verifyInstalledRelease ?? immutableReleaseReason)(context, input.expectedReleaseRevision);
+    }
+    catch {
+        releaseReason = 'goal-conductor-installed-release-inspection-failed';
+    }
+    if (releaseReason)
+        return { ok: false, state: 'blocked', reason: releaseReason };
+    const outputReason = externalArtifactPathReason(input.outputPath, context);
+    if (outputReason)
+        return { ok: false, state: 'blocked', reason: outputReason };
+    const requestedAt = new Date((dependencies.nowMs ?? Date.now)()).toISOString();
+    const requestWithoutId = {
+        schemaVersion: 1,
+        policyVersion: REQUEST_POLICY,
+        requestedAt,
+        expectedReleaseRevision: input.expectedReleaseRevision,
+        trustRoots: roots.map((root) => ({ keyId: root.keyId, publicKeyPem: root.publicKeyPem })),
+        context,
+    };
+    const request = {
+        ...requestWithoutId,
+        requestId: sha256(canonicalizeDaemonActivationValue(requestWithoutId)),
+    };
+    if (!parseRequest(request)) {
+        return { ok: false, state: 'degraded', reason: 'goal-conductor-permit-request-invalid' };
+    }
+    return { ok: true, state: 'ready', reason: 'goal-conductor-permit-request-ready', value: request };
+}
+function keySpki(key) {
+    return Buffer.from(createPublicKey(key).export({ format: 'der', type: 'spki' }));
+}
+export function mintGoalConductorPermitOffline(input) {
+    let requestBytes;
+    let privateBytes;
+    try {
+        requestBytes = readPinnedPrivateFile(input.requestPath);
+        const requestText = requestBytes.toString('utf8');
+        const raw = JSON.parse(requestText);
+        const request = parseRequest(raw);
+        if (!request || canonicalGoalConductorPermitRequest(request) !== requestText) {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-permit-request-not-canonical' };
+        }
+        const expectedRequestId = sha256(canonicalizeDaemonActivationValue({
+            schemaVersion: request.schemaVersion,
+            policyVersion: request.policyVersion,
+            requestedAt: request.requestedAt,
+            expectedReleaseRevision: request.expectedReleaseRevision,
+            trustRoots: request.trustRoots,
+            context: request.context,
+        }));
+        if (request.requestId !== expectedRequestId) {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-permit-request-id-mismatch' };
+        }
+        const requestPathReason = externalExistingArtifactReason(input.requestPath, request.context);
+        if (requestPathReason)
+            return { ok: false, state: 'blocked', reason: requestPathReason };
+        const outputReason = externalArtifactPathReason(input.outputPath, request.context, [input.requestPath]);
+        if (outputReason)
+            return { ok: false, state: 'blocked', reason: outputReason };
+        const keyLocationReason = privateKeyLocationReason(input, request.context);
+        if (keyLocationReason)
+            return { ok: false, state: 'blocked', reason: keyLocationReason };
+        privateBytes = readPinnedPrivateFile(input.privateKeyPath);
+        testControl()?.observePrivateKeyBuffer?.(privateBytes);
+        let privateKey;
+        try {
+            privateKey = createPrivateKey({ key: privateBytes, format: 'der', type: 'pkcs8' });
+        }
+        catch {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-private-key-invalid' };
+        }
+        finally {
+            privateBytes.fill(0);
+        }
+        if (privateKey.asymmetricKeyType !== 'ed25519') {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-private-key-not-ed25519' };
+        }
+        const publicDer = keySpki(privateKey);
+        let root;
+        for (const candidate of request.trustRoots) {
+            let trusted;
+            try {
+                trusted = Buffer.from(createPublicKey(candidate.publicKeyPem).export({ format: 'der', type: 'spki' }));
+                if (trusted.equals(publicDer)) {
+                    root = candidate;
+                    break;
+                }
+            }
+            catch {
+                // The canonical request parser already rejects invalid roots.
+            }
+            finally {
+                trusted?.fill(0);
+            }
+        }
+        publicDer.fill(0);
+        if (!root) {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-private-key-not-request-trusted' };
+        }
+        const issuedAtMs = input.nowMs ?? Date.now();
+        const payload = buildGoalConductorActivationPermitPayload({
+            permitId: randomBytes(16).toString('hex'),
+            nonce: randomBytes(32).toString('hex'),
+            keyId: root.keyId,
+            issuedAt: new Date(issuedAtMs).toISOString(),
+            expiresAt: new Date(issuedAtMs + PERMIT_LIFETIME_MS).toISOString(),
+            context: request.context,
+        });
+        const envelope = signGoalConductorActivationPermit(payload, privateKey);
+        return {
+            ok: true,
+            state: 'ready',
+            reason: 'goal-conductor-permit-minted-offline',
+            permitId: payload.permitId,
+            value: envelope,
+        };
+    }
+    catch {
+        return { ok: false, state: 'degraded', reason: 'goal-conductor-offline-mint-failed' };
+    }
+    finally {
+        requestBytes?.fill(0);
+        privateBytes?.fill(0);
+    }
+}
+function receiptPresent(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+export function inspectGoalConductorPermit(cfg, envelope, dependencies = {}) {
+    const roots = dependencies.trustRoots ?? GOAL_CONDUCTOR_ACTIVATION_TRUST_ROOTS;
+    if (roots.length === 0) {
+        return { ok: false, state: 'blocked', reason: 'no-trusted-goal-conductor-activation-roots' };
+    }
+    const goalId = envelope?.payload?.bindings?.target?.goalId;
+    const resolution = (dependencies.resolveTarget ?? resolveLiveGoalConductorTarget)(goalId ?? '');
+    if (!resolution.ok || !resolution.target) {
+        return { ok: false, state: 'blocked', reason: resolution.reason };
+    }
+    let context;
+    try {
+        context = (dependencies.collectContext ?? collectGoalConductorActivationContext)(cfg, resolution.target);
+    }
+    catch {
+        return { ok: false, state: 'degraded', reason: 'goal-conductor-runtime-context-unavailable' };
+    }
+    const checked = verifyGoalConductorActivationPermit(envelope, context, roots);
+    if (!checked.ok || !checked.permitId) {
+        return { ok: false, state: 'blocked', reason: checked.reason };
+    }
+    const revision = envelope.payload.bindings.buildIdentity.revision;
+    if (typeof revision !== 'string' || !SHA40_RE.test(revision)) {
+        return { ok: false, state: 'blocked', reason: 'goal-conductor-release-revision-invalid' };
+    }
+    let releaseReason;
+    try {
+        releaseReason = (dependencies.verifyInstalledRelease ?? immutableReleaseReason)(context, revision);
+    }
+    catch {
+        releaseReason = 'goal-conductor-installed-release-inspection-failed';
+    }
+    if (releaseReason)
+        return { ok: false, state: 'blocked', reason: releaseReason };
+    const nonceDigest = sha256(envelope.payload.nonce);
+    try {
+        if (receiptPresent(goalConductorActivationReceiptPath(checked.permitId))
+            || receiptPresent(goalConductorActivationNonceReceiptPath(nonceDigest))) {
+            return { ok: false, state: 'blocked', reason: 'goal-conductor-permit-already-consumed' };
+        }
+    }
+    catch {
+        return { ok: false, state: 'degraded', reason: 'goal-conductor-replay-state-unavailable' };
+    }
+    return {
+        ok: true,
+        state: 'ready',
+        reason: 'goal-conductor-permit-ready-to-stage',
+        permitId: checked.permitId,
+        value: envelope,
+        command: Object.freeze(['ashlr', 'loop', '--goal', resolution.target.goalId]),
+    };
+}
+function writeExclusivePrivate(path, text, anchorPath) {
+    const noFollow = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, PRIVATE_FILE_MODE);
+    try {
+        fchmodSync(fd, PRIVATE_FILE_MODE);
+        const initial = fstatSync(fd, { bigint: true });
+        if (!initial.isFile() || initial.nlink !== 1n || !ownedByCurrent(initial)
+            || (initial.mode & 511n) !== 384n || initial.size !== 0n) {
+            throw new Error('unsafe-created-private-file');
+        }
+        const bytes = Buffer.from(text, 'utf8');
+        let offset = 0;
+        while (offset < bytes.length) {
+            const count = writeSync(fd, bytes, offset, bytes.length - offset, offset);
+            if (count <= 0)
+                throw new Error('private-file-write-made-no-progress');
+            offset += count;
+        }
+        fsyncSync(fd);
+        const after = fstatSync(fd, { bigint: true });
+        if (after.dev !== initial.dev || after.ino !== initial.ino
+            || after.size !== BigInt(bytes.length) || after.nlink !== 1n) {
+            throw new Error('private-file-changed-during-write');
+        }
+        const assurance = assurePrivateStoragePath(path, 'file', 'secure-created', { anchorPath });
+        if (!assurance.ok)
+            throw new Error('unsafe-created-private-file-acl');
+    }
+    finally {
+        closeSync(fd);
+    }
+    fsyncDirectory(dirname(path));
+}
+export function writeGoalConductorOperatorArtifact(path, value) {
+    if (!isAbsolute(path) || resolve(path) !== path)
+        throw new Error('operator-output-path-not-canonical');
+    const parent = dirname(path);
+    const canonicalParent = realpathSync(parent);
+    if (canonicalParent !== parent || !exactPrivateDirectory(parent)) {
+        throw new Error('operator-output-parent-not-exact-private');
+    }
+    const request = parseRequest(value);
+    const envelope = parseGoalConductorActivationPermitEnvelope(value);
+    const artifactContext = request?.context ?? (envelope ? contextFromEnvelope(envelope) : null);
+    if (!artifactContext)
+        throw new Error('operator-output-artifact-invalid');
+    const pathReason = externalArtifactPathReason(path, artifactContext);
+    if (pathReason)
+        throw new Error(pathReason);
+    const custodyAnchor = inspectCustodyAncestors(path);
+    writeExclusivePrivate(path, `${canonicalizeDaemonActivationValue(value)}\n`, custodyAnchor);
+}
+function contextFromEnvelope(value) {
+    const bindings = value.payload.bindings;
+    return {
+        nowMs: 0,
+        configDigest: bindings.configDigest,
+        buildIdentity: bindings.buildIdentity,
+        executable: bindings.executable,
+        entrypoint: bindings.entrypoint,
+        releaseTree: bindings.releaseTree,
+        authorityStateDigest: bindings.authorityStateDigest,
+        killSwitchOff: true,
+        guardHealthHealthy: true,
+        target: bindings.target,
+    };
+}
+const permitPublicationCodec = {
+    parse: parseGoalConductorActivationPermitEnvelope,
+    serialize: (envelope) => `${canonicalizeDaemonActivationValue(envelope)}\n`,
+    recordId: (envelope) => envelope.payload.permitId,
+    recordFileName: () => PERMIT_FILE_NAME,
+    isRecordFileName: (fileName) => fileName === PERMIT_FILE_NAME,
+    stageToken: (envelope) => sha256(canonicalizeDaemonActivationValue(envelope)).slice(0, 32),
+    equivalent: (left, right) => (canonicalizeDaemonActivationValue(left) === canonicalizeDaemonActivationValue(right)),
+};
+export function goalConductorPermitPublicationRootPath() {
+    return join(homedir(), '.ashlr', 'control', PUBLICATION_ROOT_NAME);
+}
+function permitPublicationConfig(control) {
+    return {
+        label: 'goal conductor activation permit',
+        anchorPath: control,
+        rootPath: join(control, PUBLICATION_ROOT_NAME),
+        lockFileName: '.goal-conductor-permit-publication.lock',
+        maxRecordBytes: MAX_OPERATOR_FILE_BYTES,
+        defaultMaxFiles: 1,
+        hardMaxFiles: 1,
+        defaultMaxBytes: MAX_OPERATOR_FILE_BYTES,
+        hardMaxBytes: MAX_OPERATOR_FILE_BYTES,
+        codecForWrite: () => permitPublicationCodec,
+        codecForRead: () => permitPublicationCodec,
+    };
+}
+export function stageGoalConductorPermit(cfg, envelope, dependencies = {}) {
+    const inspection = inspectGoalConductorPermit(cfg, envelope, dependencies);
+    if (!inspection.ok || !inspection.command)
+        return inspection;
+    const privateControl = inspectExistingPrivateControl();
+    if (!privateControl) {
+        return { ok: false, state: 'blocked', reason: 'goal-conductor-preexisting-private-control-required' };
+    }
+    const disposition = writeImmutablePrivateRecord(permitPublicationConfig(privateControl.control), envelope);
+    if (disposition !== 'recorded') {
+        return {
+            ok: false,
+            state: 'blocked',
+            reason: disposition === 'replayed' || disposition === 'conflicted'
+                ? 'goal-conductor-staged-permit-already-exists'
+                : 'goal-conductor-permit-stage-failed',
+        };
+    }
+    return {
+        ok: true,
+        state: 'staged',
+        reason: 'goal-conductor-permit-staged',
+        permitId: inspection.permitId,
+        command: inspection.command,
+    };
+}
+export function readGoalConductorOperatorEnvelope(path) {
+    const bytes = readPinnedPrivateFile(path);
+    try {
+        const text = bytes.toString('utf8');
+        const value = JSON.parse(text);
+        if (`${canonicalizeDaemonActivationValue(value)}\n` !== text) {
+            throw new Error('goal-conductor-permit-not-canonical');
+        }
+        const pathReason = externalExistingArtifactReason(path, contextFromEnvelope(value));
+        if (pathReason)
+            throw new Error(pathReason);
+        return value;
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+//# sourceMappingURL=goal-conductor-permit-operator.js.map