@ashlr/hub 3.2.7 → 3.3.0

package/dist/core/daemon/runtime-activation-resident-start-protocol.d.ts

@@ -0,0 +1,141 @@
+/**
+ * M521 resident-start permit and exact-release acknowledgement protocol.
+ *
+ * This module is deliberately pure. It verifies signed intent and canonical
+ * evidence shapes, but it cannot authenticate a process, contact launchd,
+ * mutate a service, or grant activation/dispatch authority. A future native
+ * broker must own those effects and the acknowledgement transport.
+ */
+import { type KeyObject } from 'node:crypto';
+export declare const RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL: "runtime-activation-resident-start-v1";
+export declare const RUNTIME_ACTIVATION_RESIDENT_START_PERMIT_DOMAIN: "ashlr:runtime-activation-resident-start:permit:v1";
+export declare const RUNTIME_ACTIVATION_RESIDENT_START_ACK_DOMAIN: "ashlr:runtime-activation-resident-start:ack:v1";
+export declare const RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY: Readonly<{
+    readonly activationPermitted: false;
+    readonly deployPermitted: false;
+    readonly dispatchPermitted: false;
+    readonly effectPermitted: false;
+    readonly installPermitted: false;
+    readonly launchPermitted: false;
+    readonly rollbackPermitted: false;
+    readonly serviceMutationPermitted: false;
+    readonly startPermitted: false;
+}>;
+export interface RuntimeActivationResidentStartTrustRootV1 {
+    algorithm: 'ed25519';
+    keyId: string;
+    publicKeySpki: string;
+    validFrom: string;
+    validUntil: string;
+}
+export interface RuntimeActivationResidentStartReleaseBindingsV1 {
+    candidateRevision: string;
+    candidateExpectedTree: string;
+    candidateVersion: string;
+    candidateReleaseTag: string;
+    candidateRuntimeTreeSha256: string;
+    candidateManifestDigest: string;
+    candidateLaunchReceiptSha256: string;
+    candidateServiceDescriptorSha256: string;
+    candidateServiceInvocationDigest: string;
+    configSha256: string;
+    currentTarget: string;
+}
+export interface RuntimeActivationResidentStartBindingsV1 extends RuntimeActivationResidentStartReleaseBindingsV1 {
+    activationId: string;
+    admissionDigest: string;
+    planDigest: string;
+    canonicalRequestSha256: string;
+    trustRootCanonicalSha256: string;
+    stoppedPermitId: string;
+    stoppedReceiptDigest: string;
+    priorServiceLoaded: false;
+    priorServiceDisabled: boolean;
+    hostUid: number;
+    serviceLabel: 'ai.ashlr.daemon';
+    serviceTarget: string;
+    brokerChallenge: string;
+    acknowledgementDeadlineMs: number;
+}
+export interface RuntimeActivationResidentStartPermitPayloadV1 {
+    schemaVersion: 1;
+    protocol: typeof RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL;
+    permitId: string;
+    keyId: string;
+    issuedAt: string;
+    expiresAt: string;
+    scope: {
+        action: 'start-exact-selected-resident-release';
+        platform: 'darwin';
+        nativeBrokerRequired: true;
+        killSwitch: 'healthy-engaged';
+        providerEffectsBlocked: true;
+        serviceStartRequested: true;
+        serviceEnable: false;
+        serviceInstall: false;
+        pointerMutation: false;
+        residentAcknowledgement: 'required-pre-dispatch';
+        dispatchAuthorized: false;
+    };
+    bindings: RuntimeActivationResidentStartBindingsV1;
+}
+export interface RuntimeActivationResidentStartPermitEnvelopeV1 {
+    payload: RuntimeActivationResidentStartPermitPayloadV1;
+    signature: string;
+}
+export interface RuntimeActivationResidentNativeObservationV1 {
+    pid: number;
+    processStartIdentitySha256: string;
+    auditTokenSha256: string;
+    executableVnodeSha256: string;
+    codeIdentitySha256: string;
+    launchdJobGenerationSha256: string;
+}
+export interface RuntimeActivationResidentStartAcknowledgementV1 {
+    schemaVersion: 1;
+    protocol: typeof RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL;
+    acknowledgement: 'resident-start-pre-dispatch';
+    permitId: string;
+    permitPayloadDigest: string;
+    activationId: string;
+    brokerChallenge: string;
+    acknowledgedAt: string;
+    bindings: RuntimeActivationResidentStartBindingsV1;
+    nativeObservation: RuntimeActivationResidentNativeObservationV1;
+    channel: {
+        transport: 'broker-owned-inherited-fd';
+        peerCredentialsVerified: true;
+        challengeVerified: true;
+        framing: 'canonical-json-single-lf-eof';
+    };
+    state: {
+        killSwitch: 'healthy-engaged';
+        phase: 'pre-dispatch';
+        dispatchAuthorized: false;
+        providerEffectsBlocked: true;
+    };
+    authority: typeof RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY;
+}
+export interface RuntimeActivationResidentStartEvidenceResultV1 {
+    ok: boolean;
+    reason: string;
+    authority: typeof RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY;
+    acknowledgementDigest: string | null;
+}
+export declare function parseRuntimeActivationResidentStartPermit(value: unknown): RuntimeActivationResidentStartPermitEnvelopeV1 | null;
+export declare function parseRuntimeActivationResidentStartPermitFrame(input: string | Buffer): RuntimeActivationResidentStartPermitEnvelopeV1 | null;
+export declare function runtimeActivationResidentStartPermitPayloadDigest(payload: RuntimeActivationResidentStartPermitPayloadV1): string;
+export declare function runtimeActivationResidentStartKeyId(publicKey: KeyObject): string;
+export declare function signRuntimeActivationResidentStartPermit(payload: RuntimeActivationResidentStartPermitPayloadV1, privateKey: KeyObject): RuntimeActivationResidentStartPermitEnvelopeV1;
+export declare function verifyRuntimeActivationResidentStartPermit(envelope: RuntimeActivationResidentStartPermitEnvelopeV1, roots: readonly RuntimeActivationResidentStartTrustRootV1[], nowMs: number): string | null;
+export declare function parseRuntimeActivationResidentStartAcknowledgement(value: unknown): RuntimeActivationResidentStartAcknowledgementV1 | null;
+export declare function parseRuntimeActivationResidentStartAcknowledgementFrame(input: string | Buffer): RuntimeActivationResidentStartAcknowledgementV1 | null;
+export declare function runtimeActivationResidentStartPermitFrame(envelope: RuntimeActivationResidentStartPermitEnvelopeV1): string;
+export declare function runtimeActivationResidentStartAcknowledgementFrame(acknowledgement: RuntimeActivationResidentStartAcknowledgementV1): string;
+/**
+ * Validate that a broker-authenticated frame is exactly release-bound.
+ *
+ * Even a successful result is evidence only. This function cannot establish
+ * that the caller supplied evidence from a native broker-owned channel.
+ */
+export declare function evaluateRuntimeActivationResidentStartAcknowledgement(acknowledgement: RuntimeActivationResidentStartAcknowledgementV1, permit: RuntimeActivationResidentStartPermitPayloadV1, expectedNativeObservation: RuntimeActivationResidentNativeObservationV1): RuntimeActivationResidentStartEvidenceResultV1;

package/dist/core/daemon/runtime-activation-resident-start-protocol.js

@@ -0,0 +1,462 @@
+/**
+ * M521 resident-start permit and exact-release acknowledgement protocol.
+ *
+ * This module is deliberately pure. It verifies signed intent and canonical
+ * evidence shapes, but it cannot authenticate a process, contact launchd,
+ * mutate a service, or grant activation/dispatch authority. A future native
+ * broker must own those effects and the acknowledgement transport.
+ */
+import { createHash, createPublicKey, sign, timingSafeEqual, verify, } from 'node:crypto';
+import { canonicalizeDaemonActivationValue } from './activation-permit.js';
+export const RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL = 'runtime-activation-resident-start-v1';
+export const RUNTIME_ACTIVATION_RESIDENT_START_PERMIT_DOMAIN = 'ashlr:runtime-activation-resident-start:permit:v1';
+export const RUNTIME_ACTIVATION_RESIDENT_START_ACK_DOMAIN = 'ashlr:runtime-activation-resident-start:ack:v1';
+const PERMIT_SIGNATURE_DOMAIN = `${RUNTIME_ACTIVATION_RESIDENT_START_PERMIT_DOMAIN}\0`;
+const MAX_PERMIT_FRAME_BYTES = 64 * 1024;
+const MAX_ACK_FRAME_BYTES = 64 * 1024;
+const MAX_PERMIT_VALIDITY_MS = 120_000;
+const MAX_FUTURE_SKEW_MS = 30_000;
+const MAX_ACK_DEADLINE_MS = 30_000;
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const SHA1_RE = /^[a-f0-9]{40}$/u;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+const KEY_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const PACKAGE_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+export const RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY = Object.freeze({
+    activationPermitted: false,
+    deployPermitted: false,
+    dispatchPermitted: false,
+    effectPermitted: false,
+    installPermitted: false,
+    launchPermitted: false,
+    rollbackPermitted: false,
+    serviceMutationPermitted: false,
+    startPermitted: false,
+});
+function dataRecord(value, expectedKeys) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    let prototype;
+    let descriptors;
+    let keys;
+    try {
+        prototype = Object.getPrototypeOf(value);
+        descriptors = Object.getOwnPropertyDescriptors(value);
+        keys = Reflect.ownKeys(value);
+    }
+    catch {
+        return null;
+    }
+    if (prototype !== Object.prototype && prototype !== null)
+        return null;
+    if (keys.some((key) => typeof key !== 'string'))
+        return null;
+    const actual = keys.sort();
+    const expected = [...expectedKeys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        return null;
+    for (const key of actual) {
+        const descriptor = descriptors[key];
+        if (!descriptor || descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value'))
+            return null;
+    }
+    return value;
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function sameDigest(left, right) {
+    return SHA256_RE.test(left) && SHA256_RE.test(right)
+        && timingSafeEqual(Buffer.from(left, 'hex'), Buffer.from(right, 'hex'));
+}
+function canonicalTimestamp(value) {
+    if (typeof value !== 'string')
+        return false;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
+function canonicalBase64url(value, bytes) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/u.test(value))
+        return null;
+    try {
+        const decoded = Buffer.from(value, 'base64url');
+        return decoded.length > 0
+            && (bytes === undefined || decoded.length === bytes)
+            && decoded.toString('base64url') === value
+            ? decoded
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseBindings(value) {
+    const record = dataRecord(value, [
+        'activationId',
+        'admissionDigest',
+        'planDigest',
+        'canonicalRequestSha256',
+        'trustRootCanonicalSha256',
+        'stoppedPermitId',
+        'stoppedReceiptDigest',
+        'candidateRevision',
+        'candidateExpectedTree',
+        'candidateVersion',
+        'candidateReleaseTag',
+        'candidateRuntimeTreeSha256',
+        'candidateManifestDigest',
+        'candidateLaunchReceiptSha256',
+        'candidateServiceDescriptorSha256',
+        'candidateServiceInvocationDigest',
+        'configSha256',
+        'currentTarget',
+        'priorServiceLoaded',
+        'priorServiceDisabled',
+        'hostUid',
+        'serviceLabel',
+        'serviceTarget',
+        'brokerChallenge',
+        'acknowledgementDeadlineMs',
+    ]);
+    if (!record)
+        return null;
+    const digestFields = [
+        record['admissionDigest'],
+        record['planDigest'],
+        record['canonicalRequestSha256'],
+        record['trustRootCanonicalSha256'],
+        record['stoppedReceiptDigest'],
+        record['candidateRuntimeTreeSha256'],
+        record['candidateManifestDigest'],
+        record['candidateLaunchReceiptSha256'],
+        record['candidateServiceDescriptorSha256'],
+        record['candidateServiceInvocationDigest'],
+        record['configSha256'],
+    ];
+    if (!digestFields.every((entry) => typeof entry === 'string' && SHA256_RE.test(entry)))
+        return null;
+    if (typeof record['activationId'] !== 'string' || !UUID_RE.test(record['activationId'])
+        || typeof record['stoppedPermitId'] !== 'string' || !UUID_RE.test(record['stoppedPermitId'])
+        || typeof record['candidateRevision'] !== 'string' || !SHA1_RE.test(record['candidateRevision'])
+        || typeof record['candidateExpectedTree'] !== 'string' || !SHA1_RE.test(record['candidateExpectedTree'])
+        || typeof record['candidateVersion'] !== 'string' || !PACKAGE_VERSION_RE.test(record['candidateVersion'])
+        || record['candidateReleaseTag'] !== `v${record['candidateVersion']}`
+        || record['currentTarget'] !== `releases/${record['candidateRevision']}`
+        || record['priorServiceLoaded'] !== false
+        || typeof record['priorServiceDisabled'] !== 'boolean'
+        || !Number.isSafeInteger(record['hostUid']) || Number(record['hostUid']) < 0
+        || record['serviceLabel'] !== 'ai.ashlr.daemon'
+        || record['serviceTarget'] !== `gui/${record['hostUid']}/ai.ashlr.daemon`
+        || canonicalBase64url(record['brokerChallenge'], 32) === null
+        || !Number.isSafeInteger(record['acknowledgementDeadlineMs'])
+        || Number(record['acknowledgementDeadlineMs']) < 1
+        || Number(record['acknowledgementDeadlineMs']) > MAX_ACK_DEADLINE_MS)
+        return null;
+    return record;
+}
+function parseScope(value) {
+    const record = dataRecord(value, [
+        'action',
+        'platform',
+        'nativeBrokerRequired',
+        'killSwitch',
+        'providerEffectsBlocked',
+        'serviceStartRequested',
+        'serviceEnable',
+        'serviceInstall',
+        'pointerMutation',
+        'residentAcknowledgement',
+        'dispatchAuthorized',
+    ]);
+    if (!record
+        || record['action'] !== 'start-exact-selected-resident-release'
+        || record['platform'] !== 'darwin'
+        || record['nativeBrokerRequired'] !== true
+        || record['killSwitch'] !== 'healthy-engaged'
+        || record['providerEffectsBlocked'] !== true
+        || record['serviceStartRequested'] !== true
+        || record['serviceEnable'] !== false
+        || record['serviceInstall'] !== false
+        || record['pointerMutation'] !== false
+        || record['residentAcknowledgement'] !== 'required-pre-dispatch'
+        || record['dispatchAuthorized'] !== false)
+        return null;
+    return record;
+}
+export function parseRuntimeActivationResidentStartPermit(value) {
+    try {
+        const envelope = dataRecord(value, ['payload', 'signature']);
+        if (!envelope || canonicalBase64url(envelope['signature'], 64) === null)
+            return null;
+        if (!parsePermitPayload(envelope['payload']))
+            return null;
+        return envelope;
+    }
+    catch {
+        return null;
+    }
+}
+function parsePermitPayload(value) {
+    const payload = dataRecord(value, [
+        'schemaVersion', 'protocol', 'permitId', 'keyId', 'issuedAt', 'expiresAt', 'scope', 'bindings',
+    ]);
+    if (!payload
+        || payload['schemaVersion'] !== 1
+        || payload['protocol'] !== RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL
+        || typeof payload['permitId'] !== 'string' || !UUID_RE.test(payload['permitId'])
+        || typeof payload['keyId'] !== 'string' || !KEY_ID_RE.test(payload['keyId'])
+        || !canonicalTimestamp(payload['issuedAt'])
+        || !canonicalTimestamp(payload['expiresAt'])
+        || !parseScope(payload['scope'])
+        || !parseBindings(payload['bindings']))
+        return null;
+    return payload;
+}
+function decodeCanonicalFrame(input, maxBytes) {
+    const bytes = Buffer.isBuffer(input) ? input : Buffer.from(input, 'utf8');
+    if (bytes.length === 0 || bytes.length > maxBytes || bytes.at(-1) !== 0x0a)
+        return null;
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+    if (Buffer.byteLength(text, 'utf8') !== bytes.length || !text.endsWith('\n'))
+        return null;
+    let value;
+    try {
+        value = JSON.parse(text.slice(0, -1));
+    }
+    catch {
+        return null;
+    }
+    try {
+        return `${canonicalizeDaemonActivationValue(value)}\n` === text ? { text, value } : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseRuntimeActivationResidentStartPermitFrame(input) {
+    const decoded = decodeCanonicalFrame(input, MAX_PERMIT_FRAME_BYTES);
+    return decoded ? parseRuntimeActivationResidentStartPermit(decoded.value) : null;
+}
+function permitSigningBytes(payload) {
+    return Buffer.from(`${PERMIT_SIGNATURE_DOMAIN}${canonicalizeDaemonActivationValue(payload)}`, 'utf8');
+}
+export function runtimeActivationResidentStartPermitPayloadDigest(payload) {
+    return sha256(`${RUNTIME_ACTIVATION_RESIDENT_START_PERMIT_DOMAIN}\n${canonicalizeDaemonActivationValue(payload)}`);
+}
+export function runtimeActivationResidentStartKeyId(publicKey) {
+    const spki = publicKey.export({ format: 'der', type: 'spki' });
+    return sha256(Buffer.concat([
+        Buffer.from(`${RUNTIME_ACTIVATION_RESIDENT_START_PERMIT_DOMAIN}:key\0`, 'utf8'),
+        spki,
+    ]));
+}
+export function signRuntimeActivationResidentStartPermit(payload, privateKey) {
+    return {
+        payload: structuredClone(payload),
+        signature: sign(null, permitSigningBytes(payload), privateKey).toString('base64url'),
+    };
+}
+export function verifyRuntimeActivationResidentStartPermit(envelope, roots, nowMs) {
+    const parsed = parseRuntimeActivationResidentStartPermit(envelope);
+    if (!parsed)
+        return 'runtime activation resident-start permit is invalid';
+    const issued = Date.parse(parsed.payload.issuedAt);
+    const expires = Date.parse(parsed.payload.expiresAt);
+    if (!Number.isFinite(nowMs)
+        || expires <= issued
+        || expires - issued > MAX_PERMIT_VALIDITY_MS
+        || nowMs < issued - MAX_FUTURE_SKEW_MS
+        || nowMs >= expires) {
+        return 'runtime activation resident-start permit is outside its validity window';
+    }
+    const parsedRoots = [];
+    const seenKeyIds = new Set();
+    for (const candidate of roots) {
+        const record = dataRecord(candidate, ['algorithm', 'keyId', 'publicKeySpki', 'validFrom', 'validUntil']);
+        if (!record
+            || record['algorithm'] !== 'ed25519'
+            || typeof record['keyId'] !== 'string' || !KEY_ID_RE.test(record['keyId'])
+            || canonicalBase64url(record['publicKeySpki']) === null
+            || !canonicalTimestamp(record['validFrom'])
+            || !canonicalTimestamp(record['validUntil'])
+            || seenKeyIds.has(record['keyId'])) {
+            return 'runtime activation resident-start signing root is unavailable';
+        }
+        seenKeyIds.add(record['keyId']);
+        parsedRoots.push(record);
+    }
+    const root = parsedRoots.find((entry) => entry.keyId === parsed.payload.keyId) ?? null;
+    if (!root
+        || Date.parse(root.validFrom) > issued
+        || Date.parse(root.validUntil) < expires
+        || nowMs < Date.parse(root.validFrom)
+        || nowMs >= Date.parse(root.validUntil)) {
+        return 'runtime activation resident-start signing root is unavailable';
+    }
+    const spki = canonicalBase64url(root.publicKeySpki);
+    const signature = canonicalBase64url(parsed.signature, 64);
+    if (!spki || !signature)
+        return 'runtime activation resident-start permit signature is invalid';
+    try {
+        const key = createPublicKey({ key: spki, format: 'der', type: 'spki' });
+        if (key.asymmetricKeyType !== 'ed25519'
+            || runtimeActivationResidentStartKeyId(key) !== root.keyId
+            || !verify(null, permitSigningBytes(parsed.payload), key, signature)) {
+            return 'runtime activation resident-start permit signature is invalid';
+        }
+    }
+    catch {
+        return 'runtime activation resident-start permit signature is invalid';
+    }
+    return null;
+}
+function parseAuthority(value) {
+    const record = dataRecord(value, Object.keys(RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY));
+    if (!record || Object.values(record).some((entry) => entry !== false))
+        return null;
+    return record;
+}
+function parseNativeObservation(value) {
+    const record = dataRecord(value, [
+        'pid',
+        'processStartIdentitySha256',
+        'auditTokenSha256',
+        'executableVnodeSha256',
+        'codeIdentitySha256',
+        'launchdJobGenerationSha256',
+    ]);
+    if (!record
+        || !Number.isSafeInteger(record['pid']) || Number(record['pid']) <= 0
+        || [
+            record['processStartIdentitySha256'],
+            record['auditTokenSha256'],
+            record['executableVnodeSha256'],
+            record['codeIdentitySha256'],
+            record['launchdJobGenerationSha256'],
+        ].some((entry) => typeof entry !== 'string' || !SHA256_RE.test(entry)))
+        return null;
+    return record;
+}
+export function parseRuntimeActivationResidentStartAcknowledgement(value) {
+    try {
+        const ack = dataRecord(value, [
+            'schemaVersion',
+            'protocol',
+            'acknowledgement',
+            'permitId',
+            'permitPayloadDigest',
+            'activationId',
+            'brokerChallenge',
+            'acknowledgedAt',
+            'bindings',
+            'nativeObservation',
+            'channel',
+            'state',
+            'authority',
+        ]);
+        if (!ack
+            || ack['schemaVersion'] !== 1
+            || ack['protocol'] !== RUNTIME_ACTIVATION_RESIDENT_START_PROTOCOL
+            || ack['acknowledgement'] !== 'resident-start-pre-dispatch'
+            || typeof ack['permitId'] !== 'string' || !UUID_RE.test(ack['permitId'])
+            || typeof ack['permitPayloadDigest'] !== 'string' || !SHA256_RE.test(ack['permitPayloadDigest'])
+            || typeof ack['activationId'] !== 'string' || !UUID_RE.test(ack['activationId'])
+            || canonicalBase64url(ack['brokerChallenge'], 32) === null
+            || !canonicalTimestamp(ack['acknowledgedAt'])
+            || !parseBindings(ack['bindings'])
+            || !parseNativeObservation(ack['nativeObservation'])
+            || !parseAuthority(ack['authority']))
+            return null;
+        const channel = dataRecord(ack['channel'], [
+            'transport', 'peerCredentialsVerified', 'challengeVerified', 'framing',
+        ]);
+        if (!channel
+            || channel['transport'] !== 'broker-owned-inherited-fd'
+            || channel['peerCredentialsVerified'] !== true
+            || channel['challengeVerified'] !== true
+            || channel['framing'] !== 'canonical-json-single-lf-eof')
+            return null;
+        const state = dataRecord(ack['state'], [
+            'killSwitch', 'phase', 'dispatchAuthorized', 'providerEffectsBlocked',
+        ]);
+        if (!state
+            || state['killSwitch'] !== 'healthy-engaged'
+            || state['phase'] !== 'pre-dispatch'
+            || state['dispatchAuthorized'] !== false
+            || state['providerEffectsBlocked'] !== true)
+            return null;
+        return ack;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseRuntimeActivationResidentStartAcknowledgementFrame(input) {
+    const decoded = decodeCanonicalFrame(input, MAX_ACK_FRAME_BYTES);
+    return decoded ? parseRuntimeActivationResidentStartAcknowledgement(decoded.value) : null;
+}
+export function runtimeActivationResidentStartPermitFrame(envelope) {
+    return `${canonicalizeDaemonActivationValue(envelope)}\n`;
+}
+export function runtimeActivationResidentStartAcknowledgementFrame(acknowledgement) {
+    return `${canonicalizeDaemonActivationValue(acknowledgement)}\n`;
+}
+function canonicalEqual(left, right) {
+    try {
+        const leftDigest = sha256(canonicalizeDaemonActivationValue(left));
+        const rightDigest = sha256(canonicalizeDaemonActivationValue(right));
+        return sameDigest(leftDigest, rightDigest);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate that a broker-authenticated frame is exactly release-bound.
+ *
+ * Even a successful result is evidence only. This function cannot establish
+ * that the caller supplied evidence from a native broker-owned channel.
+ */
+export function evaluateRuntimeActivationResidentStartAcknowledgement(acknowledgement, permit, expectedNativeObservation) {
+    const ack = parseRuntimeActivationResidentStartAcknowledgement(acknowledgement);
+    const parsedPermit = parsePermitPayload(permit);
+    const failure = (reason) => ({
+        ok: false,
+        reason,
+        authority: RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY,
+        acknowledgementDigest: null,
+    });
+    if (!ack || !parsedPermit)
+        return failure('runtime activation resident-start acknowledgement or permit is invalid');
+    if (ack.permitId !== permit.permitId
+        || !sameDigest(ack.permitPayloadDigest, runtimeActivationResidentStartPermitPayloadDigest(permit))
+        || ack.activationId !== permit.bindings.activationId
+        || ack.brokerChallenge !== permit.bindings.brokerChallenge
+        || !canonicalEqual(ack.bindings, permit.bindings)) {
+        return failure('runtime activation resident-start acknowledgement binding mismatch');
+    }
+    const acknowledged = Date.parse(ack.acknowledgedAt);
+    const issued = Date.parse(permit.issuedAt);
+    const expires = Date.parse(permit.expiresAt);
+    if (acknowledged < issued
+        || acknowledged >= expires
+        || acknowledged - issued > permit.bindings.acknowledgementDeadlineMs) {
+        return failure('runtime activation resident-start acknowledgement missed its bound deadline');
+    }
+    if (!canonicalEqual(ack.nativeObservation, expectedNativeObservation)) {
+        return failure('runtime activation resident-start native observation mismatch');
+    }
+    return {
+        ok: true,
+        reason: 'canonical exact-release pre-dispatch acknowledgement matched; native authority remains external',
+        authority: RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY,
+        acknowledgementDigest: sha256(`${RUNTIME_ACTIVATION_RESIDENT_START_ACK_DOMAIN}\n${canonicalizeDaemonActivationValue(ack)}`),
+    };
+}
+//# sourceMappingURL=runtime-activation-resident-start-protocol.js.map

package/dist/core/daemon/runtime-activation-resident-start-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-activation-resident-start-protocol.js","sourceRoot":"","sources":["../../../src/core/daemon/runtime-activation-resident-start-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,UAAU,EACV,eAAe,EACf,IAAI,EACJ,eAAe,EACf,MAAM,GAEP,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAE3E,MAAM,CAAC,MAAM,0CAA0C,GACrD,sCAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,+CAA+C,GAC1D,mDAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,4CAA4C,GACvD,gDAAyD,CAAC;AAE5D,MAAM,uBAAuB,GAAG,GAAG,+CAA+C,IAAI,CAAC;AACvF,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAClC,MAAM,OAAO,GAAG,yEAAyE,CAAC;AAC1F,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,MAAM,kBAAkB,GAAG,2DAA2D,CAAC;AAEvF,MAAM,CAAC,MAAM,2CAA2C,GAAG,MAAM,CAAC,MAAM,CAAC;IACvE,mBAAmB,EAAE,KAAK;IAC1B,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,KAAK;IACxB,eAAe,EAAE,KAAK;IACtB,gBAAgB,EAAE,KAAK;IACvB,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,KAAK;IACxB,wBAAwB,EAAE,KAAK;IAC/B,cAAc,EAAE,KAAK;CACb,CAAC,CAAC;AAgHZ,SAAS,UAAU,CACjB,KAAc,EACd,YAA+B;IAE/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,SAAwB,CAAC;IAC7B,IAAI,WAA+C,CAAC;IACpD,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAkB,CAAC;QAC1D,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAI,IAAiB,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3G,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACxG,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;WAC/C,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAc;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;eACpB,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;eACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;YAC1C,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE;QAC/B,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,wBAAwB;QACxB,0BAA0B;QAC1B,iBAAiB;QACjB,sBAAsB;QACtB,mBAAmB;QACnB,uBAAuB;QACvB,kBAAkB;QAClB,qBAAqB;QACrB,4BAA4B;QAC5B,yBAAyB;QACzB,8BAA8B;QAC9B,kCAAkC;QAClC,kCAAkC;QAClC,cAAc;QACd,eAAe;QACf,oBAAoB;QACpB,sBAAsB;QACtB,SAAS;QACT,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,2BAA2B;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG;QACnB,MAAM,CAAC,iBAAiB,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC;QACpB,MAAM,CAAC,wBAAwB,CAAC;QAChC,MAAM,CAAC,0BAA0B,CAAC;QAClC,MAAM,CAAC,sBAAsB,CAAC;QAC9B,MAAM,CAAC,4BAA4B,CAAC;QACpC,MAAM,CAAC,yBAAyB,CAAC;QACjC,MAAM,CAAC,8BAA8B,CAAC;QACtC,MAAM,CAAC,kCAAkC,CAAC;QAC1C,MAAM,CAAC,kCAAkC,CAAC;QAC1C,MAAM,CAAC,cAAc,CAAC;KACvB,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,IAAI,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;WAClF,OAAO,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;WACzF,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;WAC7F,OAAO,MAAM,CAAC,uBAAuB,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;WACrG,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;WACtG,MAAM,CAAC,qBAAqB,CAAC,KAAK,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAAE;WAClE,MAAM,CAAC,eAAe,CAAC,KAAK,YAAY,MAAM,CAAC,mBAAmB,CAAC,EAAE;WACrE,MAAM,CAAC,oBAAoB,CAAC,KAAK,KAAK;WACtC,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,SAAS;WACnD,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC;WACzE,MAAM,CAAC,cAAc,CAAC,KAAK,iBAAiB;WAC5C,MAAM,CAAC,eAAe,CAAC,KAAK,OAAO,MAAM,CAAC,SAAS,CAAC,kBAAkB;WACtE,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI;WAC1D,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;WAC1D,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC;WAC/C,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,MAA6D,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE;QAC/B,QAAQ;QACR,UAAU;QACV,sBAAsB;QACtB,YAAY;QACZ,wBAAwB;QACxB,uBAAuB;QACvB,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,yBAAyB;QACzB,oBAAoB;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;WACN,MAAM,CAAC,QAAQ,CAAC,KAAK,uCAAuC;WAC5D,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;WAC/B,MAAM,CAAC,sBAAsB,CAAC,KAAK,IAAI;WACvC,MAAM,CAAC,YAAY,CAAC,KAAK,iBAAiB;WAC1C,MAAM,CAAC,wBAAwB,CAAC,KAAK,IAAI;WACzC,MAAM,CAAC,uBAAuB,CAAC,KAAK,IAAI;WACxC,MAAM,CAAC,eAAe,CAAC,KAAK,KAAK;WACjC,MAAM,CAAC,gBAAgB,CAAC,KAAK,KAAK;WAClC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK;WACnC,MAAM,CAAC,yBAAyB,CAAC,KAAK,uBAAuB;WAC7D,MAAM,CAAC,oBAAoB,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,MAA2E,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,QAAqE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE;QAChC,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU;KAC/F,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;WACP,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;WAC9B,OAAO,CAAC,UAAU,CAAC,KAAK,0CAA0C;WAClE,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;WAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;WACzE,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;WACxC,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;WACzC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;WAC7B,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,OAAmE,CAAC;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAsB,EACtB,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,KAAsB;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,CAAC,CAAC,yCAAyC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsD;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,GAAG,iCAAiC,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,iDAAiD,CAC/D,OAAsD;IAEtD,OAAO,MAAM,CACX,GAAG,+CAA+C,KAAK,iCAAiC,CAAC,OAAO,CAAC,EAAE,CACpG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,SAAoB;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,+CAA+C,QAAQ,EAAE,MAAM,CAAC;QAC/E,IAAI;KACL,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAsD,EACtD,UAAqB;IAErB,OAAO;QACL,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,QAAwD,EACxD,KAA2D,EAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,yCAAyC,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,qDAAqD,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;WACtB,OAAO,IAAI,MAAM;WACjB,OAAO,GAAG,MAAM,GAAG,sBAAsB;WACzC,KAAK,GAAG,MAAM,GAAG,kBAAkB;WACnC,KAAK,IAAI,OAAO,EAAE,CAAC;QACtB,OAAO,yEAAyE,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAgD,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM;eACN,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS;eACjC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;eACvE,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,IAAI;eACpD,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;eACxC,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;eACzC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrC,OAAO,+DAA+D,CAAC;QACzE,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,MAA8D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACvF,IAAI,CAAC,IAAI;WACJ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM;WACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO;WACrC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;WAClC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,+DAA+D,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;eAClC,mCAAmC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK;eACvD,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACvE,OAAO,+DAA+D,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,MAAuE,CAAC;AACjF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE;QAC/B,KAAK;QACL,4BAA4B;QAC5B,kBAAkB;QAClB,uBAAuB;QACvB,oBAAoB;QACpB,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;WACN,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;WAClE;YACD,MAAM,CAAC,4BAA4B,CAAC;YACpC,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,uBAAuB,CAAC;YAC/B,MAAM,CAAC,oBAAoB,CAAC;YAC5B,MAAM,CAAC,4BAA4B,CAAC;SACrC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,MAAiE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kDAAkD,CAChE,KAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE;YAC5B,eAAe;YACf,UAAU;YACV,iBAAiB;YACjB,UAAU;YACV,qBAAqB;YACrB,cAAc;YACd,iBAAiB;YACjB,gBAAgB;YAChB,UAAU;YACV,mBAAmB;YACnB,SAAS;YACT,OAAO;YACP,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;eACH,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;eAC1B,GAAG,CAAC,UAAU,CAAC,KAAK,0CAA0C;eAC9D,GAAG,CAAC,iBAAiB,CAAC,KAAK,6BAA6B;eACxD,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;eACrE,OAAO,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;eAC7F,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;eAC7E,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI;eACvD,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;eAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;eAC/B,CAAC,sBAAsB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;eACjD,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;YACzC,WAAW,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,SAAS;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;eACP,OAAO,CAAC,WAAW,CAAC,KAAK,2BAA2B;eACpD,OAAO,CAAC,yBAAyB,CAAC,KAAK,IAAI;eAC3C,OAAO,CAAC,mBAAmB,CAAC,KAAK,IAAI;eACrC,OAAO,CAAC,SAAS,CAAC,KAAK,8BAA8B;YAAE,OAAO,IAAI,CAAC;QACxE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACrC,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;eACL,KAAK,CAAC,YAAY,CAAC,KAAK,iBAAiB;eACzC,KAAK,CAAC,OAAO,CAAC,KAAK,cAAc;eACjC,KAAK,CAAC,oBAAoB,CAAC,KAAK,KAAK;eACrC,KAAK,CAAC,wBAAwB,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,GAAiE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uDAAuD,CACrE,KAAsB;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,CAAC,CAAC,kDAAkD,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,QAAwD;IAExD,OAAO,GAAG,iCAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,kDAAkD,CAChE,eAAgE;IAEhE,OAAO,GAAG,iCAAiC,CAAC,eAAe,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,KAAc;IACnD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qDAAqD,CACnE,eAAgE,EAChE,MAAqD,EACrD,yBAAuE;IAEvE,MAAM,GAAG,GAAG,kDAAkD,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAkD,EAAE,CAAC,CAAC;QACnF,EAAE,EAAE,KAAK;QACT,MAAM;QACN,SAAS,EAAE,2CAA2C;QACtD,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,wEAAwE,CAAC,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WAC/B,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,MAAM,CAAC,CAAC;WAC/F,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,YAAY;WACjD,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC,eAAe;WACvD,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,GAAG,MAAM;WACpB,YAAY,IAAI,OAAO;WACvB,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC,6EAA6E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,iGAAiG;QACzG,SAAS,EAAE,2CAA2C;QACtD,qBAAqB,EAAE,MAAM,CAC3B,GAAG,4CAA4C,KAAK,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAC7F;KACF,CAAC;AACJ,CAAC"}

package/dist/core/daemon/runtime-activation-resident-start-runtime.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Frozen production adapter for M521.
+ *
+ * The privileged broker does not exist in this release. Runtime input cannot
+ * register roots, replace this adapter, or turn canonical acknowledgement
+ * evidence into start authority.
+ */
+import { RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY, type RuntimeActivationResidentStartTrustRootV1 } from './runtime-activation-resident-start-protocol.js';
+export declare const RUNTIME_ACTIVATION_RESIDENT_START_TRUST_ROOTS: readonly Readonly<RuntimeActivationResidentStartTrustRootV1>[];
+export declare const NATIVE_HOSTILE_PROCESS_CAS_UNAVAILABLE: "native-hostile-process-cas-unavailable";
+export interface RuntimeActivationResidentStartUnavailableResultV1 {
+    ok: false;
+    reason: typeof NATIVE_HOSTILE_PROCESS_CAS_UNAVAILABLE;
+    authority: typeof RUNTIME_ACTIVATION_RESIDENT_START_AUTHORITY;
+    trustRootCount: 0;
+    acknowledgementAccepted: false;
+    serviceStarted: false;
+    serviceEnabledChanged: false;
+    pointerChanged: false;
+    providerEffectsUnblocked: false;
+}
+declare function unavailable(): RuntimeActivationResidentStartUnavailableResultV1;
+export declare const runtimeActivationResidentStartRuntime: Readonly<{
+    roots: readonly Readonly<RuntimeActivationResidentStartTrustRootV1>[];
+    requestNativeResidentStart: typeof unavailable;
+}>;
+export {};