@dharma-ai-labs/agent-fabric 0.2.208 → 0.2.210

package/dist/demoWatchControl.d.ts

@@ -27,8 +27,8 @@ export declare function demoWatchStatus(input: Input, deps: DemoWatchControlDepe
     stage: string;
     key: string;
     registered: boolean;
-    supervisor: "stopped" | "running" | "unknown" | "legacy" | "version_mismatch";
-    autostart: "enabled" | "disabled" | "unavailable" | "unsupported";
+    supervisor: "running" | "stopped" | "unknown" | "legacy" | "version_mismatch";
+    autostart: "unavailable" | "enabled" | "disabled" | "unsupported";
     observation: DemoWatchHealth | null;
     fullWorkflowReady: false;
 }>;
@@ -39,8 +39,8 @@ export declare function enableDemoWatch(input: Input, deps: DemoWatchControlDepe
     stage: string;
     key: string;
     registered: boolean;
-    supervisor: "stopped" | "running" | "unknown" | "legacy" | "version_mismatch";
-    autostart: "enabled" | "disabled" | "unavailable" | "unsupported";
+    supervisor: "running" | "stopped" | "unknown" | "legacy" | "version_mismatch";
+    autostart: "unavailable" | "enabled" | "disabled" | "unsupported";
     observation: DemoWatchHealth | null;
     fullWorkflowReady: false;
 }>;
@@ -51,8 +51,8 @@ export declare function disableDemoWatch(input: Input, deps: DemoWatchControlDep
     stage: string;
     key: string;
     registered: boolean;
-    supervisor: "stopped" | "running" | "unknown" | "legacy" | "version_mismatch";
-    autostart: "enabled" | "disabled" | "unavailable" | "unsupported";
+    supervisor: "running" | "stopped" | "unknown" | "legacy" | "version_mismatch";
+    autostart: "unavailable" | "enabled" | "disabled" | "unsupported";
     observation: DemoWatchHealth | null;
     fullWorkflowReady: false;
 }>;

package/dist/deviceSigningMaintenanceController.d.ts

@@ -0,0 +1,35 @@
+import type { LocalVault, ScopedLocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
+import type { LegacySigningMaintenanceBoundary } from './legacySigningMaintenanceBoundary.js';
+interface Workspace {
+    organizationId: string;
+    workspaceId: string;
+    repositoryBindingId: string;
+    repositoryRemoteHash: string;
+    path: string;
+}
+interface Input {
+    home: string;
+    configPath: string;
+    name: string;
+    workspaceId: string;
+    operationId?: string;
+    apply: boolean;
+    readWorkspace(): Promise<Workspace | null>;
+    processState(): Promise<'running' | 'stopped' | 'unknown'>;
+    openVault(): Promise<LocalVault | ScopedLocalVault>;
+    signal: AbortSignal;
+    frames: AsyncIterable<Uint8Array>;
+    emit(value: Record<string, unknown>): void;
+    store?: SecureSecretStore;
+    fetcher?: typeof fetch;
+    now?: () => number;
+    legacyBoundary?: LegacySigningMaintenanceBoundary;
+}
+/** Connected CLI owner. No provider transport, model turn, enrollment, password
+ * input or service control is available here. The disabled original session is
+ * an audit locator; a device-specific control lease, original encrypted binding
+ * and durable operation claim fence this separate maintenance capability. */
+export declare function runDeviceSigningMaintenanceController(input: Input): Promise<Record<string, unknown>>;
+export {};
+//# sourceMappingURL=deviceSigningMaintenanceController.d.ts.map

package/dist/deviceSigningMaintenanceController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceSigningMaintenanceController.d.ts","sourceRoot":"","sources":["../src/deviceSigningMaintenanceController.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,UAAU,EAAC,gBAAgB,EAAC,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAG2B,KAAK,iBAAiB,EAAmB,MAAM,2CAA2C,CAAC;AAE7H,OAAO,KAAK,EAAC,gCAAgC,EAAC,MAAM,uCAAuC,CAAC;AAE5F,UAAU,SAAS;IAAE,cAAc,EAAC,MAAM,CAAC;IAAA,WAAW,EAAC,MAAM,CAAC;IAAA,mBAAmB,EAAC,MAAM,CAAC;IAAA,oBAAoB,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;CAAC;AAClI,UAAU,KAAK;IACb,IAAI,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,IAAI,EAAC,MAAM,CAAC;IAAA,WAAW,EAAC,MAAM,CAAC;IAAA,WAAW,CAAC,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,OAAO,CAAC;IAC/F,aAAa,IAAG,OAAO,CAAC,SAAS,GAAC,IAAI,CAAC,CAAC;IACxC,YAAY,IAAG,OAAO,CAAC,SAAS,GAAC,SAAS,GAAC,SAAS,CAAC,CAAC;IACtD,SAAS,IAAG,OAAO,CAAC,UAAU,GAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,EAAC,WAAW,CAAC;IAAA,MAAM,EAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAAA,IAAI,CAAC,KAAK,EAAC,MAAM,CAAC,MAAM,EAAC,OAAO,CAAC,GAAE,IAAI,CAAC;IAC5F,KAAK,CAAC,EAAC,iBAAiB,CAAC;IAAA,OAAO,CAAC,EAAC,OAAO,KAAK,CAAC;IAAA,GAAG,CAAC,EAAC,MAAI,MAAM,CAAC;IAC/D,cAAc,CAAC,EAAC,gCAAgC,CAAC;CAClD;AAsCD;;;6EAG6E;AAC7E,wBAAsB,qCAAqC,CAAC,KAAK,EAAC,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAC,OAAO,CAAC,CAAC,CAyFvG"}

package/dist/deviceSigningMaintenanceController.js

@@ -0,0 +1,197 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+import { canonicalize } from '@dharma-ai-labs/agent-fabric-contracts';
+import { loadDeviceConfig, loadDeviceEnrollmentAnchor, withDeviceSigningControl, readOwnedSigningMaintenanceContext, prepareOwnedSigningMaintenance, submitOwnedSigningRecoveryPreparation, progressOwnedSigningRecoveryOffer, completeOwnedSigningRecovery, inspectOwnedSigningRecovery, disposeOwnedSigningRecovery, OwnedSigningRecoveryError } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { readNamedSession } from './namedSessionService.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\s\S])/;
+const hash = (v) => 'sha256:' + createHash('sha256').update(canonicalize(v)).digest('hex');
+const unavailable = (phase) => { throw Error('device_signing_maintenance_' + phase); };
+const immutableDevice = (config) => ({ hqUrl: config.hqUrl, organizationId: config.organizationId, deviceId: config.deviceId,
+    installationId: config.installationId, publicKeyEd25519: config.publicKeyEd25519, setupClaimReference: config.setupClaimReference,
+    setupClaimRepositoryFingerprint: config.setupClaimRepositoryFingerprint, relayUrl: config.relayUrl, enrolledAt: config.enrolledAt,
+    connectionMode: config.connectionMode ?? 'manual' });
+async function next(iterator, signal) {
+    if (signal.aborted)
+        return unavailable('cancelled');
+    let stop;
+    const aborted = new Promise((_, reject) => {
+        stop = () => reject(Error('device_signing_maintenance_cancelled'));
+        signal.addEventListener('abort', stop, { once: true });
+    });
+    try {
+        return await Promise.race([iterator.next(), aborted]);
+    }
+    finally {
+        signal.removeEventListener('abort', stop);
+    }
+}
+async function* frames(input, signal) {
+    const iterator = input[Symbol.asyncIterator]();
+    let buffered = Buffer.alloc(0), count = 0;
+    try {
+        for (;;) {
+            const item = await next(iterator, signal);
+            if (item.done) {
+                if (buffered.length)
+                    return unavailable('input_invalid');
+                return;
+            }
+            if (!(item.value instanceof Uint8Array) || item.value.byteLength > 8192)
+                return unavailable('input_invalid');
+            buffered = Buffer.concat([buffered, item.value]);
+            let end;
+            while ((end = buffered.indexOf(10)) >= 0) {
+                const line = buffered.subarray(0, end);
+                buffered = buffered.subarray(end + 1);
+                if (!line.length)
+                    continue;
+                if (line.length > 512 || ++count > 64)
+                    return unavailable('input_invalid');
+                let value;
+                try {
+                    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(line));
+                }
+                catch {
+                    return unavailable('input_invalid');
+                }
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    return unavailable('input_invalid');
+                const body = value;
+                if (Object.keys(body).sort().join(',') !== 'action,operationId,schema' || body.schema !== 'dharma.device-signing-maintenance-control/v1'
+                    || typeof body.operationId !== 'string' || !UUID.test(body.operationId)
+                    || !['progress', 'complete', 'status', 'cancel'].includes(String(body.action)))
+                    return unavailable('input_invalid');
+                yield body;
+            }
+            if (buffered.length > 512)
+                return unavailable('input_invalid');
+        }
+    }
+    finally {
+        void iterator.return?.().catch(() => { });
+    }
+}
+/** Connected CLI owner. No provider transport, model turn, enrollment, password
+ * input or service control is available here. The disabled original session is
+ * an audit locator; a device-specific control lease, original encrypted binding
+ * and durable operation claim fence this separate maintenance capability. */
+export async function runDeviceSigningMaintenanceController(input) {
+    const clock = input.now ?? Date.now, config = await loadDeviceConfig(input.configPath);
+    const registration = await readNamedSession(input.home, input.name), workspace = await input.readWorkspace();
+    if (!registration || !workspace || !UUID.test(input.workspaceId) || registration.identity.workspaceId !== input.workspaceId
+        || ![config.deviceId, config.installationId, config.setupClaimReference, workspace.repositoryBindingId].every(value => typeof value === 'string' && UUID.test(value))
+        || !/^sha256:[a-f0-9]{64}$(?![\s\S])/.test(workspace.repositoryRemoteHash)
+        || workspace.workspaceId !== input.workspaceId || workspace.organizationId !== config.organizationId
+        || registration.identity.organizationId !== config.organizationId || registration.identity.deviceId !== config.deviceId
+        || registration.identity.repositoryBindingId !== workspace.repositoryBindingId || workspace.repositoryRemoteHash !== config.setupClaimRepositoryFingerprint
+        || !isAbsolute(workspace.path) || resolve(workspace.path) !== workspace.path)
+        return unavailable('scope_unavailable');
+    const state = await input.processState(), operationId = input.operationId ?? randomUUID();
+    const trustExpiry = Date.parse(config.serverSigningKeyset?.expiresAt ?? '');
+    const trustState = !Number.isFinite(trustExpiry) ? 'unavailable' : trustExpiry <= clock() ? 'expired' : 'current';
+    if (!UUID.test(operationId))
+        return unavailable('operation_invalid');
+    const summary = { schema: 'dharma.device-signing-maintenance-controller-progress/v1', operationId,
+        organizationId: config.organizationId, deviceId: config.deviceId, workspaceId: input.workspaceId, bindingId: registration.bindingId,
+        authorityKind: 'device_trust_maintenance', nativeContinuationAuthorized: false, ready: false };
+    if (!input.apply)
+        return { ...summary, ok: true, planned: true, protectedStoreQualified: false, currentSourceVerified: false,
+            registrationDisabled: !registration.enabled, processState: state, trustState, clientTrustInstalled: false };
+    if (!input.operationId || registration.enabled || state !== 'stopped')
+        return unavailable('quiescence_required');
+    if (!input.legacyBoundary || !/^sha256:[a-f0-9]{64}$/.test(input.legacyBoundary.leaseDigest))
+        return unavailable('exclusive_legacy_boundary_required');
+    await input.legacyBoundary.assertHeld();
+    if (trustState !== 'expired')
+        return unavailable('expired_trust_required');
+    const abort = new AbortController(), started = clock(), deadline = started + 900000;
+    const signal = AbortSignal.any([input.signal, abort.signal]), timer = setTimeout(() => abort.abort(), 900000);
+    timer.unref();
+    let vault;
+    try {
+        return await withDeviceSigningControl({ config, hostScope: { signal, current: async () => !signal.aborted } }, async (control) => {
+            vault = await input.openVault();
+            const original = await vault.getProviderSessionBinding(registration.bindingId, registration.identity);
+            if (!original || original.owner !== 'dharma_bridge' || original.provider !== 'codex' || original.workspaceRoot !== workspace.path
+                || !UUID.test(original.bindingId))
+                return unavailable('binding_unavailable');
+            const lease = await vault.tryAcquireProviderSessionLease(registration.bindingId, registration.identity);
+            if (!lease)
+                return unavailable('owner_busy');
+            let handle;
+            const valid = async () => {
+                if (signal.aborted || clock() < started || clock() >= deadline || !await lease.assertHeld())
+                    return false;
+                await input.legacyBoundary.assertHeld();
+                await control.assertHeld();
+                const current = await readNamedSession(input.home, input.name), selected = await input.readWorkspace();
+                const fresh = await loadDeviceConfig(input.configPath), binding = await vault.getProviderSessionBinding(registration.bindingId, registration.identity);
+                return !signal.aborted && canonicalize(current) === canonicalize(registration) && canonicalize(selected) === canonicalize(workspace)
+                    && canonicalize(immutableDevice(fresh)) === canonicalize(immutableDevice(config)) && canonicalize(binding) === canonicalize(original)
+                    && await input.processState() === 'stopped' && await lease.assertHeld();
+            };
+            const hostScope = { signal, current: valid };
+            const assert = async () => { if (!await valid())
+                return unavailable('scope_changed'); };
+            try {
+                await assert();
+                await loadDeviceEnrollmentAnchor({ config, store: input.store, hostScope, readOnly: true });
+                await assert();
+                const claimed = await vault.claimCodexSetupOperation(operationId, hash({ purpose: 'dharma.device-trust-maintenance/v1', operationId,
+                    device: immutableDevice(config), registration, workspace, originalBinding: original }));
+                if (claimed.state !== 'acquired')
+                    return unavailable('operation_consumed');
+                await assert();
+                const context = await readOwnedSigningMaintenanceContext({ configPath: input.configPath, workspaceId: input.workspaceId,
+                    repositoryBindingId: workspace.repositoryBindingId, membershipId: registration.identity.membershipId, operationId, hostScope,
+                    store: input.store, fetcher: input.fetcher, now: clock });
+                await assert();
+                handle = await prepareOwnedSigningMaintenance({ configPath: input.configPath, source: context.source, hostScope,
+                    store: input.store, fetcher: input.fetcher, now: clock, controller: { schema: 'dharma.device-trust-maintenance-owner/v1', operationId,
+                        controllerInstanceId: control.controllerInstanceId, processIdentityDigest: control.processIdentityDigest,
+                        leaseDigest: hash({ deviceSigningControl: control.leaseDigest, legacyRuntimeBoundary: input.legacyBoundary.leaseDigest }),
+                        registrationDigest: hash({ registration, originalBinding: original }), deviceId: config.deviceId, recipientMembershipId: registration.identity.membershipId,
+                        originalBindingId: registration.bindingId, originalSessionId: original.sessionId, expiresAt: new Date(deadline).toISOString() } });
+                const progress = await submitOwnedSigningRecoveryPreparation(handle);
+                input.emit({ ...summary, ok: true, progress, recipientUrl: config.hqUrl + '/agent-fabric/signing-maintenance?orgId='
+                        + encodeURIComponent(config.organizationId) + '&preparationId=' + encodeURIComponent(handle.preparationId) + '&kind=recipient' });
+                for await (const request of frames(input.frames, signal)) {
+                    await assert();
+                    if (request.operationId !== operationId)
+                        return unavailable('input_invalid');
+                    if (request.action === 'cancel')
+                        return { ...summary, ok: false, state: 'cancelled', clientTrustInstalled: false };
+                    const current = request.action === 'status' ? await inspectOwnedSigningRecovery(handle)
+                        : request.action === 'progress' ? await progressOwnedSigningRecoveryOffer(handle) : await completeOwnedSigningRecovery(handle);
+                    await assert();
+                    const selectedUrl = config.hqUrl + '/agent-fabric/signing-maintenance?orgId=' + encodeURIComponent(config.organizationId)
+                        + '&preparationId=' + encodeURIComponent(handle.preparationId) + '&recoveryId=' + encodeURIComponent(current.recoveryId ?? '')
+                        + '&approvalId=' + encodeURIComponent(current.approvalId ?? '');
+                    const view = { ...summary, ok: true, progress: current, ...('recoveryId' in current ? { ownerUrl: selectedUrl + '&kind=owner',
+                            recipientUrl: selectedUrl + '&kind=recipient' } : {}) };
+                    if (current.state === 'trust_installed')
+                        return view;
+                    input.emit(view);
+                }
+                return { ...summary, ok: false, state: 'closed_before_completion', reconcileBeforeRetry: true };
+            }
+            catch (error) {
+                const phase = error instanceof OwnedSigningRecoveryError ? error.phase : 'controller';
+                const httpStatus = error instanceof OwnedSigningRecoveryError ? error.httpStatus : null;
+                return { ...summary, ok: false, state: 'unconfirmed', phase, httpStatus, reconcileBeforeRetry: true,
+                    ...(handle ? { progress: await inspectOwnedSigningRecovery(handle).catch(() => null) } : {}) };
+            }
+            finally {
+                if (handle)
+                    disposeOwnedSigningRecovery(handle);
+                await lease.release();
+            }
+        });
+    }
+    finally {
+        abort.abort();
+        clearTimeout(timer);
+        await vault?.close();
+    }
+}
+//# sourceMappingURL=deviceSigningMaintenanceController.js.map

package/dist/deviceSigningMaintenanceController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceSigningMaintenanceController.js","sourceRoot":"","sources":["../src/deviceSigningMaintenanceController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAClD,OAAO,EAAC,UAAU,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAC,YAAY,EAAC,MAAM,wCAAwC,CAAC;AAEpE,OAAO,EAAC,gBAAgB,EAAC,0BAA0B,EAAC,wBAAwB,EAAC,kCAAkC,EAAC,8BAA8B,EAC5I,qCAAqC,EAAC,iCAAiC,EAAC,4BAA4B,EACpG,2BAA2B,EAAC,2BAA2B,EAAC,yBAAyB,EACR,MAAM,2CAA2C,CAAC;AAC7H,OAAO,EAAC,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AAa1D,MAAM,IAAI,GAAC,qFAAqF,CAAC;AACjG,MAAM,IAAI,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,SAAS,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,MAAM,WAAW,GAAC,CAAC,KAAY,EAAO,EAAE,GAAC,MAAM,KAAK,CAAC,6BAA6B,GAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;AAC5F,MAAM,eAAe,GAAC,CAAC,MAAmB,EAAC,EAAE,CAAA,CAAC,EAAC,KAAK,EAAC,MAAM,CAAC,KAAK,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ;IAC7H,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,gBAAgB,EAAC,MAAM,CAAC,gBAAgB,EAAC,mBAAmB,EAAC,MAAM,CAAC,mBAAmB;IAC5H,+BAA+B,EAAC,MAAM,CAAC,+BAA+B,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU;IAC5H,cAAc,EAAC,MAAM,CAAC,cAAc,IAAE,QAAQ,EAAC,CAAC,CAAC;AAEnD,KAAK,UAAU,IAAI,CAAI,QAAyB,EAAC,MAAkB;IACjE,IAAG,MAAM,CAAC,OAAO;QAAC,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC;IAAA,IAAI,IAAc,CAAC;IACrE,MAAM,OAAO,GAAC,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAC,MAAM,EAAC,EAAE;QAAC,IAAI,GAAC,GAAE,EAAE,CAAA,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC3G,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,CAAC,CAAC,CAAC;IACvD,IAAG,CAAC;QAAA,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAAC;YAAO,CAAC;QAAA,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;IAAA,CAAC;AAC9G,CAAC;AACD,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,KAA+B,EAAC,MAAkB;IACvE,MAAM,QAAQ,GAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAAA,IAAI,QAAQ,GAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,GAAC,CAAC,CAAC;IAClF,IAAG,CAAC;QACF,SAAO,CAAC;YAAA,MAAM,IAAI,GAAC,MAAM,IAAI,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;YAAA,IAAG,IAAI,CAAC,IAAI,EAAC,CAAC;gBAAA,IAAG,QAAQ,CAAC,MAAM;oBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC;YAC1H,IAAG,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,IAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAC,IAAI;gBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;YACvG,QAAQ,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAA,IAAI,GAAU,CAAC;YAC7D,OAAM,CAAC,GAAG,GAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAE,CAAC,EAAC,CAAC;gBACnC,MAAM,IAAI,GAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC;gBAAA,QAAQ,GAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAC,CAAC,CAAC,CAAC;gBACtE,IAAG,CAAC,IAAI,CAAC,MAAM;oBAAC,SAAS;gBAAA,IAAG,IAAI,CAAC,MAAM,GAAC,GAAG,IAAE,EAAE,KAAK,GAAC,EAAE;oBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;gBAC5F,IAAI,KAAa,CAAC;gBAClB,IAAG,CAAC;oBAAA,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAA,CAAC;gBAAA,MAAK,CAAC;oBAAA,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;gBAAA,CAAC;gBACrH,IAAG,CAAC,KAAK,IAAE,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;gBAC7F,MAAM,IAAI,GAAC,KAA+B,CAAC;gBAC3C,IAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAG,2BAA2B,IAAE,IAAI,CAAC,MAAM,KAAG,8CAA8C;uBAC7H,OAAO,IAAI,CAAC,WAAW,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;uBAChE,CAAC,CAAC,UAAU,EAAC,UAAU,EAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;gBACjH,MAAM,IAA2E,CAAC;YACpF,CAAC;YACD,IAAG,QAAQ,CAAC,MAAM,GAAC,GAAG;gBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;YAAO,CAAC;QAAA,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;IAAA,CAAC;AACnD,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAAW;IACrE,MAAM,KAAK,GAAC,KAAK,CAAC,GAAG,IAAE,IAAI,CAAC,GAAG,EAAC,MAAM,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,YAAY,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAI,CAAC,EAAC,SAAS,GAAC,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IACvG,IAAG,CAAC,YAAY,IAAE,CAAC,SAAS,IAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAE,YAAY,CAAC,QAAQ,CAAC,WAAW,KAAG,KAAK,CAAC,WAAW;WAC9G,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAC,MAAM,CAAC,cAAc,EAAC,MAAM,CAAC,mBAAmB,EAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA,EAAE,CAAA,OAAO,KAAK,KAAG,QAAQ,IAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACzJ,CAAC,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;WACvE,SAAS,CAAC,WAAW,KAAG,KAAK,CAAC,WAAW,IAAE,SAAS,CAAC,cAAc,KAAG,MAAM,CAAC,cAAc;WAC3F,YAAY,CAAC,QAAQ,CAAC,cAAc,KAAG,MAAM,CAAC,cAAc,IAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,KAAG,MAAM,CAAC,QAAQ;WAC9G,YAAY,CAAC,QAAQ,CAAC,mBAAmB,KAAG,SAAS,CAAC,mBAAmB,IAAE,SAAS,CAAC,oBAAoB,KAAG,MAAM,CAAC,+BAA+B;WAClJ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAG,SAAS,CAAC,IAAI;QAAC,OAAO,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAClH,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,YAAY,EAAE,EAAC,WAAW,GAAC,KAAK,CAAC,WAAW,IAAE,UAAU,EAAE,CAAC;IACnF,MAAM,WAAW,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,IAAE,EAAE,CAAC,CAAC;IACxE,MAAM,UAAU,GAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA,CAAC,CAAA,aAAa,CAAA,CAAC,CAAA,WAAW,IAAE,KAAK,EAAE,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,SAAS,CAAC;IACtG,IAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAAC,OAAO,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAC,EAAC,MAAM,EAAC,0DAA0D,EAAC,WAAW;QAC1F,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,WAAW,EAAC,KAAK,CAAC,WAAW,EAAC,SAAS,EAAC,YAAY,CAAC,SAAS;QAC5H,aAAa,EAAC,0BAA0B,EAAC,4BAA4B,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC;IAC3F,IAAG,CAAC,KAAK,CAAC,KAAK;QAAC,OAAO,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,uBAAuB,EAAC,KAAK,EAAC,qBAAqB,EAAC,KAAK;YAC/G,oBAAoB,EAAC,CAAC,YAAY,CAAC,OAAO,EAAC,YAAY,EAAC,KAAK,EAAC,UAAU,EAAC,oBAAoB,EAAC,KAAK,EAAC,CAAC;IACvG,IAAG,CAAC,KAAK,CAAC,WAAW,IAAE,YAAY,CAAC,OAAO,IAAE,KAAK,KAAG,SAAS;QAAC,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACzG,IAAG,CAAC,KAAK,CAAC,cAAc,IAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;QAAC,OAAO,WAAW,CAAC,oCAAoC,CAAC,CAAC;IACnJ,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;IACxC,IAAG,UAAU,KAAG,SAAS;QAAC,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAC,IAAI,eAAe,EAAE,EAAC,OAAO,GAAC,KAAK,EAAE,EAAC,QAAQ,GAAC,OAAO,GAAC,MAAM,CAAC;IAC1E,MAAM,MAAM,GAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAC,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,KAAK,CAAC,KAAK,EAAE,EAAC,MAAM,CAAC,CAAC;IAAA,KAAK,CAAC,KAAK,EAAE,CAAC;IACnH,IAAI,KAA2C,CAAC;IAChD,IAAG,CAAC;QAAA,OAAO,MAAM,wBAAwB,CAAC,EAAC,MAAM,EAAC,SAAS,EAAC,EAAC,MAAM,EAAC,OAAO,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,MAAM,CAAC,OAAO,EAAC,EAAC,EAAC,KAAK,EAAC,OAAO,EAAA,EAAE;YACpH,KAAK,GAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,YAAY,CAAC,SAAS,EAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnG,IAAG,CAAC,QAAQ,IAAE,QAAQ,CAAC,KAAK,KAAG,eAAe,IAAE,QAAQ,CAAC,QAAQ,KAAG,OAAO,IAAE,QAAQ,CAAC,aAAa,KAAG,SAAS,CAAC,IAAI;mBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAC,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,YAAY,CAAC,SAAS,EAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrG,IAAG,CAAC,KAAK;gBAAC,OAAO,WAAW,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,MAA2C,CAAC;YAChD,MAAM,KAAK,GAAC,KAAK,IAAE,EAAE;gBACnB,IAAG,MAAM,CAAC,OAAO,IAAE,KAAK,EAAE,GAAC,OAAO,IAAE,KAAK,EAAE,IAAE,QAAQ,IAAE,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE;oBAAC,OAAO,KAAK,CAAC;gBAC9F,MAAM,KAAK,CAAC,cAAe,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAI,CAAC,EAAC,QAAQ,GAAC,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;gBACjG,MAAM,KAAK,GAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAC,OAAO,GAAC,MAAM,KAAM,CAAC,yBAAyB,CAAC,YAAY,CAAC,SAAS,EAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAClJ,OAAO,CAAC,MAAM,CAAC,OAAO,IAAE,YAAY,CAAC,OAAO,CAAC,KAAG,YAAY,CAAC,YAAY,CAAC,IAAE,YAAY,CAAC,QAAQ,CAAC,KAAG,YAAY,CAAC,SAAS,CAAC;uBACxH,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAE,YAAY,CAAC,OAAO,CAAC,KAAG,YAAY,CAAC,QAAQ,CAAC;uBAC5H,MAAM,KAAK,CAAC,YAAY,EAAE,KAAG,SAAS,IAAE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;YACvE,CAAC,CAAC;YACF,MAAM,SAAS,GAAC,EAAC,MAAM,EAAC,OAAO,EAAC,KAAK,EAAC,CAAC;YACvC,MAAM,MAAM,GAAC,KAAK,IAAE,EAAE,GAAC,IAAG,CAAC,MAAM,KAAK,EAAE;gBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC,CAAA,CAAC,CAAC;YAC/E,IAAG,CAAC;gBACF,MAAM,MAAM,EAAE,CAAC;gBACf,MAAM,0BAA0B,CAAC,EAAC,MAAM,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,SAAS,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,CAAC;gBACrF,MAAM,MAAM,EAAE,CAAC;gBACf,MAAM,OAAO,GAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,WAAW,EAAC,IAAI,CAAC,EAAC,OAAO,EAAC,oCAAoC,EAAC,WAAW;oBAC3H,MAAM,EAAC,eAAe,CAAC,MAAM,CAAC,EAAC,YAAY,EAAC,SAAS,EAAC,eAAe,EAAC,QAAQ,EAAC,CAAC,CAAC,CAAC;gBACpF,IAAG,OAAO,CAAC,KAAK,KAAG,UAAU;oBAAC,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;gBACvE,MAAM,MAAM,EAAE,CAAC;gBACf,MAAM,OAAO,GAAC,MAAM,kCAAkC,CAAC,EAAC,UAAU,EAAC,KAAK,CAAC,UAAU,EAAC,WAAW,EAAC,KAAK,CAAC,WAAW;oBAC/G,mBAAmB,EAAC,SAAS,CAAC,mBAAmB,EAAC,YAAY,EAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,EAAC,WAAW,EAAC,SAAS;oBACvH,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO,EAAC,GAAG,EAAC,KAAK,EAAC,CAAC,CAAC;gBACtD,MAAM,MAAM,EAAE,CAAC;gBACf,MAAM,GAAC,MAAM,8BAA8B,CAAC,EAAC,UAAU,EAAC,KAAK,CAAC,UAAU,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,SAAS;oBACtG,KAAK,EAAC,KAAK,CAAC,KAAK,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO,EAAC,GAAG,EAAC,KAAK,EAAC,UAAU,EAAC,EAAC,MAAM,EAAC,0CAA0C,EAAC,WAAW;wBACzH,oBAAoB,EAAC,OAAO,CAAC,oBAAoB,EAAC,qBAAqB,EAAC,OAAO,CAAC,qBAAqB;wBACrG,WAAW,EAAC,IAAI,CAAC,EAAC,oBAAoB,EAAC,OAAO,CAAC,WAAW,EAAC,qBAAqB,EAAC,KAAK,CAAC,cAAe,CAAC,WAAW,EAAC,CAAC;wBACpH,kBAAkB,EAAC,IAAI,CAAC,EAAC,YAAY,EAAC,eAAe,EAAC,QAAQ,EAAC,CAAC,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,qBAAqB,EAAC,YAAY,CAAC,QAAQ,CAAC,YAAY;wBAClJ,iBAAiB,EAAC,YAAY,CAAC,SAAS,EAAC,iBAAiB,EAAC,QAAQ,CAAC,SAAS,EAAC,SAAS,EAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAC,EAAC,CAAC,CAAC;gBAChI,MAAM,QAAQ,GAAC,MAAM,qCAAqC,CAAC,MAAM,CAAC,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,YAAY,EAAC,MAAM,CAAC,KAAK,GAAC,0CAA0C;0BACzG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,GAAC,iBAAiB,GAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,GAAC,iBAAiB,EAAC,CAAC,CAAC;gBAC5H,IAAI,KAAK,EAAC,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAC,MAAM,CAAC,EAAC,CAAC;oBACtD,MAAM,MAAM,EAAE,CAAC;oBAAA,IAAG,OAAO,CAAC,WAAW,KAAG,WAAW;wBAAC,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;oBACxF,IAAG,OAAO,CAAC,MAAM,KAAG,QAAQ;wBAAC,OAAO,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,WAAW,EAAC,oBAAoB,EAAC,KAAK,EAAC,CAAC;oBACvG,MAAM,OAAO,GAAC,OAAO,CAAC,MAAM,KAAG,QAAQ,CAAA,CAAC,CAAA,MAAM,2BAA2B,CAAC,MAAM,CAAC;wBAC/E,CAAC,CAAA,OAAO,CAAC,MAAM,KAAG,UAAU,CAAA,CAAC,CAAA,MAAM,iCAAiC,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,MAAM,4BAA4B,CAAC,MAAM,CAAC,CAAC;oBAC1H,MAAM,MAAM,EAAE,CAAC;oBACf,MAAM,WAAW,GAAC,MAAM,CAAC,KAAK,GAAC,0CAA0C,GAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;0BAChH,iBAAiB,GAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,GAAC,cAAc,GAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,IAAE,EAAE,CAAC;0BACpH,cAAc,GAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,IAAE,EAAE,CAAC,CAAC;oBAC7D,MAAM,IAAI,GAAC,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,GAAG,CAAC,YAAY,IAAG,OAAO,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,WAAW,GAAC,aAAa;4BAC5G,YAAY,EAAC,WAAW,GAAC,iBAAiB,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC;oBACnD,IAAG,OAAO,CAAC,KAAK,KAAG,iBAAiB;wBAAC,OAAO,IAAI,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;gBACD,OAAO,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,0BAA0B,EAAC,oBAAoB,EAAC,IAAI,EAAC,CAAC;YAC1F,CAAC;YAAA,OAAM,KAAK,EAAC,CAAC;gBACZ,MAAM,KAAK,GAAC,KAAK,YAAY,yBAAyB,CAAA,CAAC,CAAA,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,YAAY,CAAC;gBAChF,MAAM,UAAU,GAAC,KAAK,YAAY,yBAAyB,CAAA,CAAC,CAAA,KAAK,CAAC,UAAU,CAAA,CAAC,CAAA,IAAI,CAAC;gBAClF,OAAO,EAAC,GAAG,OAAO,EAAC,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,aAAa,EAAC,KAAK,EAAC,UAAU,EAAC,oBAAoB,EAAC,IAAI;oBACxF,GAAG,CAAC,MAAM,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC;YACzF,CAAC;oBAAO,CAAC;gBAAA,IAAG,MAAM;oBAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YAAA,CAAC;QAChF,CAAC,CAAC,CAAC;IAAA,CAAC;YAAO,CAAC;QAAA,KAAK,CAAC,KAAK,EAAE,CAAC;QAAA,YAAY,CAAC,KAAK,CAAC,CAAC;QAAA,MAAM,KAAK,EAAE,KAAK,EAAE,CAAC;IAAA,CAAC;AACtE,CAAC"}

package/dist/deviceSigningMaintenanceController.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deviceSigningMaintenanceController.test.d.ts.map

package/dist/deviceSigningMaintenanceController.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceSigningMaintenanceController.test.d.ts","sourceRoot":"","sources":["../src/deviceSigningMaintenanceController.test.ts"],"names":[],"mappings":""}

package/dist/deviceSigningMaintenanceController.test.js

@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { commandExitCode, run, relayProcessState, formatCommandOutput, deviceTrustMaintenanceProcessState } from './index.js';
+const id = (n) => `dc000000-0000-4000-8000-${String(n).padStart(12, '0')}`;
+test('maintenance completion signaling cannot turn an unfinished component or native readiness into success', () => {
+    const base = { schema: 'dharma.device-signing-maintenance-controller-progress/v1', nativeContinuationAuthorized: false, ready: false };
+    assert.equal(commandExitCode(['signing-recovery', '--apply'], { ...base, ok: false, state: 'unconfirmed' }), 2);
+    assert.equal(commandExitCode(['signing-recovery', '--apply'], { ...base, ok: true, planned: true }), 2);
+    assert.equal(commandExitCode(['signing-recovery', '--apply'], { ...base, ok: true, progress: { state: 'trust_installed', clientTrustInstalled: true } }), 0);
+    assert.equal(commandExitCode(['signing-recovery'], { ...base, ok: true, planned: true }), 0);
+    const text = formatCommandOutput({ ...base, ok: true, planned: true });
+    assert.equal(text.trim().split('\n').length, 1);
+    assert.equal(JSON.parse(text).nativeContinuationAuthorized, false);
+});
+test('official maintenance plan is grant-free and needs no protected-store, provider or active native session', async () => {
+    const root = await realpath(await mkdtemp(resolve(tmpdir(), 'mc-'))), prior = process.env.DHARMA_HOME;
+    try {
+        process.env.DHARMA_HOME = root;
+        const workspace = { organizationId: 'org_fixture', workspaceId: id(1), repositoryBindingId: id(2), repositoryRemoteHash: 'sha256:' + 'a'.repeat(64), path: resolve(root, 'checkout') };
+        const identity = { organizationId: 'org_fixture', workspaceId: id(1), repositoryBindingId: id(2), deviceId: id(3), membershipId: id(4), endpointId: id(5), provider: 'codex' };
+        await mkdir(resolve(root, 'sessions', 'codex-reviewer'), { recursive: true });
+        await writeFile(resolve(root, 'device.json'), JSON.stringify({ schema: 'dharma.device-config/v1', hqUrl: 'https://www.dharma-ai.io',
+            organizationId: 'org_fixture', deviceId: id(3), deviceName: 'Synthetic maintenance fixture', installationId: id(7), setupClaimReference: id(8), setupClaimRepositoryFingerprint: workspace.repositoryRemoteHash,
+            platform: 'linux', publicKeyEd25519: Buffer.alloc(32, 7).toString('base64url'), serverPublicKeyEd25519: Buffer.alloc(32, 8).toString('base64url'),
+            relayUrl: 'wss://relay.fixture.invalid', enrolledAt: '2026-10-01T00:00:00.000Z' }));
+        await mkdir(resolve(root, 'registry'));
+        await writeFile(resolve(root, 'registry', 'workspaces.json'), JSON.stringify([workspace]));
+        await writeFile(resolve(root, 'sessions', 'codex-reviewer', 'registration.json'), JSON.stringify({ schema: 'dharma.named-session/v1', name: 'codex-reviewer',
+            bindingId: id(6), identity, maximumCostCents: 1000, maximumTurnCostCents: 25, enabled: false }));
+        const result = await run(['signing-recovery', '--name', 'codex-reviewer', '--workspace-id', id(1)]);
+        assert.equal(result.planned, true);
+        assert.equal(result.protectedStoreQualified, false);
+        assert.equal(result.currentSourceVerified, false);
+        assert.equal(result.nativeContinuationAuthorized, false);
+        assert.equal(result.ready, false);
+        await mkdir(resolve(root, 'relay'));
+        await writeFile(resolve(root, 'relay', 'relay.pid'), String(process.pid));
+        assert.equal(await deviceTrustMaintenanceProcessState(root, 'codex-reviewer'), 'running');
+        await writeFile(resolve(root, 'relay', 'relay.pid'), 'invalid');
+        assert.equal(await deviceTrustMaintenanceProcessState(root, 'codex-reviewer'), 'unknown');
+        await assert.rejects(run(['signing-recovery', '--name', 'codex-reviewer', '--workspace-id', id(1), '--grant', 'SYNTHETIC_NOT_SECRET']), /maintenance_options_invalid/);
+    }
+    finally {
+        if (prior === undefined)
+            delete process.env.DHARMA_HOME;
+        else
+            process.env.DHARMA_HOME = prior;
+        await rm(root, { recursive: true, force: true });
+    }
+});
+test('unknown PID-inspection errors cannot establish stopped runtime custody', async (t) => {
+    const root = await mkdtemp(resolve(tmpdir(), 'fabric-maintenance-pid-'));
+    try {
+        await mkdir(resolve(root, 'relay'));
+        await writeFile(resolve(root, 'relay', 'relay.pid'), '12345\n');
+        t.mock.method(process, 'kill', () => { throw Object.assign(Error('synthetic inspection failure'), { code: 'EACCES' }); });
+        assert.equal(await relayProcessState(root), 'unknown');
+    }
+    finally {
+        t.mock.restoreAll();
+        await rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=deviceSigningMaintenanceController.test.js.map

package/dist/deviceSigningMaintenanceController.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceSigningMaintenanceController.test.js","sourceRoot":"","sources":["../src/deviceSigningMaintenanceController.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAC,KAAK,EAAC,OAAO,EAAC,QAAQ,EAAC,EAAE,EAAC,SAAS,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,MAAM,EAAC,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,eAAe,EAAC,GAAG,EAAC,iBAAiB,EAAC,mBAAmB,EAAC,kCAAkC,EAAC,MAAM,YAAY,CAAC;AAExH,MAAM,EAAE,GAAC,CAAC,CAAQ,EAAC,EAAE,CAAA,2BAA2B,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAC,GAAG,CAAC,EAAE,CAAC;AAC7E,IAAI,CAAC,uGAAuG,EAAC,GAAE,EAAE;IAC/G,MAAM,IAAI,GAAC,EAAC,MAAM,EAAC,0DAA0D,EAAC,4BAA4B,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC;IAC9H,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,kBAAkB,EAAC,SAAS,CAAC,EAAC,EAAC,GAAG,IAAI,EAAC,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,aAAa,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,kBAAkB,EAAC,SAAS,CAAC,EAAC,EAAC,GAAG,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,kBAAkB,EAAC,SAAS,CAAC,EAAC,EAAC,GAAG,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,oBAAoB,EAAC,IAAI,EAAC,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAC/I,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,EAAC,EAAC,GAAG,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAC,mBAAmB,CAAC,EAAC,GAAG,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,4BAA4B,EAAC,KAAK,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yGAAyG,EAAC,KAAK,IAAE,EAAE;IACtH,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,GAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAChG,IAAG,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAC,IAAI,CAAC;QAC7B,MAAM,SAAS,GAAC,EAAC,cAAc,EAAC,aAAa,EAAC,WAAW,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,mBAAmB,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,oBAAoB,EAAC,SAAS,GAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,EAAC,UAAU,CAAC,EAAC,CAAC;QACvK,MAAM,QAAQ,GAAC,EAAC,cAAc,EAAC,aAAa,EAAC,WAAW,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,mBAAmB,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,YAAY,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,CAAC;QAC9J,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAC,UAAU,EAAC,gBAAgB,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,aAAa,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,yBAAyB,EAAC,KAAK,EAAC,0BAA0B;YAC3H,cAAc,EAAC,aAAa,EAAC,QAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,+BAA+B,EAAC,cAAc,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,mBAAmB,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,+BAA+B,EAAC,SAAS,CAAC,oBAAoB;YACpM,QAAQ,EAAC,OAAO,EAAC,gBAAgB,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC,sBAAsB,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1I,QAAQ,EAAC,6BAA6B,EAAC,UAAU,EAAC,0BAA0B,EAAC,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAC,UAAU,CAAC,CAAC,CAAC;QAAA,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,UAAU,EAAC,iBAAiB,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9H,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,UAAU,EAAC,gBAAgB,EAAC,mBAAmB,CAAC,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,yBAAyB,EAAC,IAAI,EAAC,gBAAgB;YAClJ,SAAS,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAC,gBAAgB,EAAC,IAAI,EAAC,oBAAoB,EAAC,EAAE,EAAC,OAAO,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAC,MAAM,GAAG,CAAC,CAAC,kBAAkB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,gBAAgB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAA2B,CAAC;QACxH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;QAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAC,KAAK,CAAC,CAAC;QAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAC,KAAK,CAAC,CAAC;QACtI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAC,KAAK,CAAC,CAAC;QAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC,CAAC;QAAA,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,EAAC,WAAW,CAAC,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1G,MAAM,CAAC,KAAK,CAAC,MAAM,kCAAkC,CAAC,IAAI,EAAC,gBAAgB,CAAC,EAAC,SAAS,CAAC,CAAC;QACxF,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,EAAC,WAAW,CAAC,EAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,kCAAkC,CAAC,IAAI,EAAC,gBAAgB,CAAC,EAAC,SAAS,CAAC,CAAC;QACxF,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,gBAAgB,EAAC,EAAE,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,sBAAsB,CAAC,CAAC,EAAC,6BAA6B,CAAC,CAAC;IAClK,CAAC;YAAO,CAAC;QAAA,IAAG,KAAK,KAAG,SAAS;YAAC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;YAAK,OAAO,CAAC,GAAG,CAAC,WAAW,GAAC,KAAK,CAAC;QAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,CAAC;AAC9I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAC,KAAK,EAAC,CAAC,EAAA,EAAE;IACrF,MAAM,IAAI,GAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAC,yBAAyB,CAAC,CAAC,CAAC;IACtE,IAAG,CAAC;QACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAC,CAAC;QAAA,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAC,OAAO,EAAC,WAAW,CAAC,EAAC,SAAS,CAAC,CAAC;QAChG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAC,MAAM,EAAC,GAAE,EAAE,GAAC,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QAChH,MAAM,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAC,SAAS,CAAC,CAAC;IACxD,CAAC;YAAO,CAAC;QAAA,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,CAAC;AAC3E,CAAC,CAAC,CAAC"}

package/dist/deviceSigningMaintenanceFlow.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deviceSigningMaintenanceFlow.test.d.ts.map

package/dist/deviceSigningMaintenanceFlow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceSigningMaintenanceFlow.test.d.ts","sourceRoot":"","sources":["../src/deviceSigningMaintenanceFlow.test.ts"],"names":[],"mappings":""}

package/dist/deviceSigningMaintenanceFlow.test.js

@@ -0,0 +1,196 @@
+import assert from 'node:assert/strict';
+import { createHash, generateKeyPairSync, randomBytes, verify } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { canonicalize, deviceSigningRecoveryPreparationSigningPayload, deviceSigningRecoverySigningPayload, parseDeviceSigningRecoveryPreparation, sealDeviceSigningRecoveryDelivery, signCanonicalObject, validateContract } from '@dharma-ai-labs/agent-fabric-contracts';
+import { runDeviceSigningMaintenanceController } from './deviceSigningMaintenanceController.js';
+import { saveNamedSession } from './namedSessionService.js';
+import { withLegacySigningMaintenanceBoundary } from './legacySigningMaintenanceBoundary.js';
+const id = (n) => `de000000-0000-4000-8000-${String(n).padStart(12, '0')}`;
+const hash = (value) => 'sha256:' + createHash('sha256').update(value).digest('hex');
+const digest = (c) => 'sha256:' + c.repeat(64);
+const controlled = (input) => withLegacySigningMaintenanceBoundary({
+    ...input, assertManagedCohort: async () => digest('f')
+}, legacyBoundary => runDeviceSigningMaintenanceController({ ...input, legacyBoundary }));
+async function fixture() {
+    const root = await realpath(await mkdtemp(resolve(tmpdir(), 'mf-'))), now = Date.now(), masterKey = randomBytes(32);
+    const old = generateKeyPairSync('ed25519'), next = generateKeyPairSync('ed25519'), device = generateKeyPairSync('ed25519');
+    const pub = (key) => key.publicKey.export({ format: 'jwk' }).x;
+    const keyset = (key, generation, issued, expiry) => {
+        const body = { schema: 'dharma.server-signing-keyset/v1', organizationId: 'org_fixture', generation,
+            keys: [{ keyVersion: 'fixture-' + generation, publicKeyEd25519: pub(key), status: 'active', notBefore: new Date(issued).toISOString(), notAfter: new Date(expiry).toISOString() }],
+            signedByKeyVersion: 'fixture-' + generation, issuedAt: new Date(issued).toISOString(), expiresAt: new Date(expiry).toISOString() };
+        return { ...body, signature: signCanonicalObject(body, key.privateKey) };
+    };
+    const config = { schema: 'dharma.device-config/v1', hqUrl: 'https://www.dharma-ai.io', organizationId: 'org_fixture',
+        installationId: id(1), deviceId: id(2), deviceName: 'Synthetic controller fixture', platform: 'linux', publicKeyEd25519: pub(device),
+        serverPublicKeyEd25519: pub(old), serverSigningKeyset: keyset(old, 2, now - 86400000, now - 1000),
+        setupClaimReference: id(3), setupClaimRepositoryFingerprint: digest('a'), relayUrl: 'wss://relay.fixture.invalid',
+        enrolledAt: new Date(now - 86400000).toISOString(), connectionMode: 'manual' };
+    const workspace = { organizationId: config.organizationId, workspaceId: id(4), repositoryBindingId: id(5), repositoryRemoteHash: digest('a'), path: resolve(root, 'checkout') };
+    const identity = { organizationId: config.organizationId, workspaceId: id(4), repositoryBindingId: id(5), deviceId: id(2), membershipId: id(6), endpointId: id(7), provider: 'codex' };
+    const binding = { schema: 'dharma.local-provider-session-binding/v1', ...identity, bindingId: id(8), owner: 'dharma_bridge',
+        sessionId: 'original-disabled-fixture-session', workspaceRoot: workspace.path, createdAt: new Date(now - 10000).toISOString(),
+        expiresAt: new Date(now + 3600000).toISOString(), maximumProviderCostCents: 25 };
+    const registration = { schema: 'dharma.named-session/v1', name: 'reviewer', bindingId: binding.bindingId, identity, maximumCostCents: 100, maximumTurnCostCents: 25, enabled: false };
+    await mkdir(workspace.path);
+    await saveNamedSession(root, registration);
+    const vaultRoot = resolve(root, 'vault'), vault = await LocalVault.open({ root: vaultRoot, masterKey });
+    vault.saveProviderSessionBinding(binding);
+    vault.close();
+    const configPath = resolve(root, 'device.json');
+    await writeFile(configPath, JSON.stringify(config));
+    const anchorAccount = 'device-enrollment-' + hash(`${config.hqUrl}:${config.organizationId}:${config.deviceId}`).slice(7, 39);
+    const keyAccount = 'device-key-' + hash(`${config.hqUrl}:${config.organizationId}:${config.installationId}`).slice(7, 39);
+    const privateIdentity = JSON.stringify(device.privateKey.export({ format: 'jwk' }));
+    const values = new Map([[keyAccount, privateIdentity], [anchorAccount, JSON.stringify({ schema: 'dharma.device-enrollment-anchor/v1', hqUrl: config.hqUrl,
+                organizationId: config.organizationId, deviceId: config.deviceId, devicePublicKeyEd25519: config.publicKeyEd25519,
+                serverPublicKeyEd25519: config.serverPublicKeyEd25519, serverSigningKeyset: config.serverSigningKeyset, enrolledAt: config.enrolledAt })]]);
+    const writes = [], emitted = [], requests = [];
+    const store = { backend: 'linux-secret-service', get: async (key) => values.get(key) ?? null, getFresh: async (key) => values.get(key) ?? null,
+        put: async (key, value) => { writes.push(key); values.set(key, value); }, delete: async () => { throw Error('FORBIDDEN_DELETE'); } };
+    const source = { organizationId: config.organizationId, workspaceId: id(4), repositoryBindingId: id(5), repositoryFingerprint: digest('a'),
+        policyRevision: 'agent-fabric-local-analysis-v1', scopeDigest: digest('b'), contractDigest: digest('c'), sourceGenerationId: id(9),
+        sourceReceiptId: 'repo_consent_' + id(9), sourceRevision: 1, sourcePolicyRevision: 'repository-source-' + id(9), sourcePolicyHash: digest('d') };
+    let preparation, challenge, proofRegistered = false;
+    const successor = keyset(next, 3, now, now + 86400000), abort = new AbortController();
+    const fetcher = (async (url, init) => {
+        assert.ok(init);
+        const address = new URL(String(url)), body = JSON.parse(String(init.body)), headers = new Headers(init.headers);
+        assert.equal(address.origin, config.hqUrl);
+        assert.equal(init.redirect, 'error');
+        assert.equal(init.credentials, 'omit');
+        assert.equal(headers.has('authorization'), false);
+        assert.equal(headers.has('cookie'), false);
+        const transport = Buffer.from(JSON.stringify({ bodyHash: hash(String(init.body)), deviceId: config.deviceId, messageId: headers.get('x-dharma-message-id'),
+            method: 'POST', nonce: headers.get('x-dharma-nonce'), organizationId: config.organizationId, pathname: address.pathname, sequence: 1,
+            sessionId: headers.get('x-dharma-session-id'), timestamp: headers.get('x-dharma-timestamp') }));
+        assert.equal(verify(null, transport, device.publicKey, Buffer.from(headers.get('x-dharma-signature') ?? '', 'base64url')), true);
+        requests.push(body.schema);
+        if (body.schema === 'dharma.device-signing-maintenance-context-request/v1') {
+            const { schema, issuedAt, repositoryFingerprint, ...selection } = body;
+            void [schema, issuedAt, repositoryFingerprint];
+            return Response.json({ ...selection, schema: 'dharma.device-signing-maintenance-context/v1', recipientMembershipId: identity.membershipId,
+                source, authority: 'current_source_context_only_not_consent' });
+        }
+        if (body.schema === 'dharma.device-signing-maintenance-preparation-request/v1') {
+            preparation = parseDeviceSigningRecoveryPreparation(body.preparation, body.preparation.plan, now);
+            assert.equal(verify(null, deviceSigningRecoveryPreparationSigningPayload(preparation), device.publicKey, Buffer.from(body.signature, 'base64url')), true);
+            const { schema, planId, authority, preparedAt, expiresAt, ...scope } = preparation.plan;
+            void [schema, planId, authority, preparedAt];
+            challenge = { ...scope, schema: 'dharma.device-signing-maintenance-challenge/v1', purpose: 'expired_signing_trust_reapproval', recoveryId: id(11), approvalId: id(12),
+                credentialEncryptionPublicKey: preparation.credentialEncryptionPublicKey, candidateGeneration: 3, candidateKeysetHash: hash(canonicalize(successor)),
+                candidateRootFingerprint: hash(Buffer.from(pub(next), 'base64url')), candidateKeyVersionFingerprint: hash(successor.signedByKeyVersion),
+                method: 'POST', path: '/api/v1/agent-fabric/signing-recovery', nonce: Buffer.alloc(32, 7).toString('base64url'),
+                authenticator: Buffer.alloc(32, 8).toString('base64url'), issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + 600000).toISOString() };
+            return Response.json({ schema: 'dharma.signing-recovery-preparation-receipt/v1', organizationId: config.organizationId, deviceId: config.deviceId,
+                recipientMembershipId: identity.membershipId, preparationId: preparation.plan.planId, expiresAt, state: 'pending_browser_review',
+                controllerBinding: 'device_attested_not_native_authority', nativeContinuationAuthorized: false, clientTrustInstalled: false });
+        }
+        assert.ok(preparation && challenge);
+        const common = { organizationId: config.organizationId, deviceId: config.deviceId, preparationId: preparation.plan.planId,
+            expiresAt: challenge.expiresAt, clientTrustInstalled: false, ready: false };
+        if (address.pathname.endsWith('/offers/read'))
+            return Response.json({ ...common, schema: 'dharma.device-signing-recovery-offer-response/v1',
+                state: proofRegistered ? 'pending_approval' : 'awaiting_device_proof', deviceProofRegistered: proofRegistered, challenge });
+        assert.equal(verify(null, deviceSigningRecoverySigningPayload(challenge), device.publicKey, Buffer.from(body.signature, 'base64url')), true);
+        if (address.pathname.endsWith('/offers/register')) {
+            proofRegistered = true;
+            return Response.json({ ...common,
+                schema: 'dharma.device-signing-recovery-offer-registration-receipt/v1', recoveryId: challenge.recoveryId, approvalId: challenge.approvalId,
+                state: 'pending_approval', deviceProofRegistered: true });
+        }
+        assert.equal(body.schema, 'dharma.device-signing-maintenance-delivery-request/v1');
+        assert.equal(proofRegistered, true);
+        // Synthetic server fixture stands in for separately recorded dual browser
+        // consents/publication; this is not a live browser or OS-store receipt.
+        const candidate = { schema: 'dharma.device-signing-recovery-candidate/v1', organizationId: config.organizationId,
+            recoveryId: challenge.recoveryId, approvalId: challenge.approvalId, keysetCanonical: canonicalize(successor), rootPublicKey: pub(next),
+            publication: { schema: 'dharma.signing-recovery-publication/v1', organizationId: config.organizationId, recoveryId: challenge.recoveryId,
+                generation: 3, artifactHash: digest('e'), publishedAt: new Date(now).toISOString() } };
+        return Response.json({ ok: true, delivery: sealDeviceSigningRecoveryDelivery(challenge, candidate, now), clientTrustInstalled: false,
+            controllerBinding: 'device_attested_not_native_authority', nativeContinuationAuthorized: false });
+    });
+    const input = { home: root, configPath, name: 'reviewer', workspaceId: workspace.workspaceId, operationId: id(10), apply: true,
+        readWorkspace: async () => workspace, processState: async () => 'stopped', openVault: () => LocalVault.open({ root: vaultRoot, masterKey }),
+        signal: abort.signal, frames: (async function* () { for (const action of ['progress', 'status', 'complete'])
+            yield Buffer.from(JSON.stringify({ schema: 'dharma.device-signing-maintenance-control/v1', operationId: id(10), action }) + '\n'); })(),
+        emit: (value) => emitted.push(value), store, fetcher, now: () => now };
+    return { root, input, config, configPath, registration, requests, writes, emitted, values, keyAccount, anchorAccount, privateIdentity, abort,
+        cleanup: () => rm(root, { recursive: true, force: true }) };
+}
+test('connected owning controller qualifies source, device proofs and encrypted installation without a native turn', async () => {
+    const f = await fixture();
+    try {
+        const result = await controlled(f.input);
+        assert.equal(result.ok, true);
+        assert.equal(result.ready, false);
+        assert.equal(result.nativeContinuationAuthorized, false);
+        assert.equal(result.progress.state, 'trust_installed');
+        assert.equal(JSON.parse(await readFile(f.configPath, 'utf8')).serverSigningKeyset.generation, 3);
+        assert.equal(f.values.get(f.keyAccount), f.privateIdentity);
+        assert.ok(f.writes.every(key => key === f.anchorAccount));
+        assert.equal(f.requests.length, 5);
+        assert.equal(f.emitted.length, 3);
+        assert.deepEqual(JSON.parse(await readFile(resolve(f.root, 'sessions', 'reviewer', 'registration.json'), 'utf8')), f.registration);
+        for (const value of [...f.emitted, result]) {
+            const checked = await validateContract(resolve(import.meta.dirname, '../../../schemas'), 'https://schemas.dharma-ai.io/device-signing-maintenance-controller-progress/v1', value);
+            assert.equal(checked.ok, true, JSON.stringify(checked));
+            assert.doesNotMatch(JSON.stringify(value), /signature|authenticator|privateJwk|keysetCanonical|PRIVATE_/);
+        }
+    }
+    finally {
+        await f.cleanup();
+    }
+});
+test('sampled stopped state without the exclusive legacy boundary cannot open the vault or dispatch', async () => {
+    const f = await fixture();
+    try {
+        let opened = 0;
+        await assert.rejects(runDeviceSigningMaintenanceController({ ...f.input, openVault: async () => { opened++; throw Error('FORBIDDEN_VAULT'); } }), /exclusive_legacy_boundary_required/);
+        assert.equal(opened, 0);
+        assert.deepEqual(f.requests, []);
+        assert.deepEqual(f.writes, []);
+    }
+    finally {
+        await f.cleanup();
+    }
+});
+test('cancelled operation is consumed and cannot replay its source or private-key requests', async () => {
+    const f = await fixture();
+    try {
+        const frames = async function* () { yield Buffer.from(JSON.stringify({ schema: 'dharma.device-signing-maintenance-control/v1', operationId: id(10), action: 'cancel' }) + '\n'); };
+        const result = await controlled({ ...f.input, frames: frames() });
+        assert.equal(result.state, 'cancelled');
+        const count = f.requests.length;
+        assert.equal(count, 2);
+        assert.deepEqual(f.writes, []);
+        const repeated = await controlled({ ...f.input, frames: frames() });
+        assert.equal(repeated.state, 'unconfirmed');
+        assert.equal(f.requests.length, count);
+        assert.deepEqual(f.writes, []);
+    }
+    finally {
+        await f.cleanup();
+    }
+});
+for (const action of ['arbitrary-shell', 'complete-with-extra', 'foreign-operation', 'oversized', 'truncated'])
+    test('fixed controller rejects ' + action + ' without delivery', async () => {
+        const f = await fixture();
+        try {
+            const value = { schema: 'dharma.device-signing-maintenance-control/v1', operationId: action === 'foreign-operation' ? id(99) : id(10), action: action === 'complete-with-extra' ? 'complete' : action };
+            const bytes = action === 'oversized' ? 'x'.repeat(513) : JSON.stringify({ ...value, ...(action === 'complete-with-extra' ? { command: 'forbidden' } : {}) });
+            const frames = (async function* () { yield Buffer.from(bytes + (action === 'truncated' ? '' : '\n')); })();
+            const result = await controlled({ ...f.input, frames });
+            assert.equal(result.state, 'unconfirmed');
+            assert.equal(f.requests.length, 2);
+            assert.deepEqual(f.writes, []);
+        }
+        finally {
+            await f.cleanup();
+        }
+    });
+//# sourceMappingURL=deviceSigningMaintenanceFlow.test.js.map