@dsh-enhanced/assistant-actions 0.1.30

package/lib/broker-ledger.js

@@ -0,0 +1,925 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, openSync, realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, normalize } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { brokerGrantAuthorityDigest, brokerRequestDigest, canonicalBrokerJson, createBrokerGrantProjection, normalizeBrokerGrantAuthority, } from './broker-protocol.js';
+const SCHEMA_VERSION = 2;
+const MAX_RECORDS = 10_000;
+const MAX_GRANTS = 1_000;
+const DIGEST = /^[0-9a-f]{64}$/u;
+export class BrokerLedgerError extends Error {
+    code;
+    constructor(code) {
+        super('assistant-actions external broker ledger rejected: ' + code);
+        this.code = code;
+        this.name = 'BrokerLedgerError';
+    }
+}
+function fail(code) { throw new BrokerLedgerError(code); }
+function plain(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype && Object.getOwnPropertySymbols(value).length === 0; }
+function exact(value, keys) {
+    if (!plain(value) || Object.keys(value).length !== keys.length || Object.keys(value).some(key => !keys.includes(key)) || keys.some(key => !Object.hasOwn(value, key)))
+        fail('invalid-input');
+    for (const descriptor of Object.values(Object.getOwnPropertyDescriptors(value)))
+        if (!('value' in descriptor) || !descriptor.enumerable)
+            fail('invalid-input');
+    return value;
+}
+function text(value, maximum = 4_096) { if (typeof value !== 'string' || value.length < 1 || value.length > maximum || /[\p{Cc}]/u.test(value))
+    fail('invalid-input'); return value; }
+function integer(value, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) { if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+    fail('invalid-input'); return value; }
+function digest(value) { const output = text(value, 64); if (!DIGEST.test(output))
+    fail('invalid-input'); return output; }
+function json(value) { try {
+    return JSON.parse(value);
+}
+catch {
+    return fail('schema');
+} }
+function equal(left, right) { return canonicalBrokerJson(left) === canonicalBrokerJson(right); }
+function owner(value) {
+    const input = exact(value, ['principalDigest', 'principalRecordId', 'principalVersion', 'workspace', 'preset', 'bindingId', 'bindingVersion', 'bindingGeneration']);
+    const workspace = text(input.workspace);
+    if (!isAbsolute(workspace) || normalize(workspace) !== workspace)
+        fail('invalid-input');
+    return Object.freeze({ principalDigest: digest(input.principalDigest), principalRecordId: text(input.principalRecordId), principalVersion: integer(input.principalVersion, 1), workspace, preset: text(input.preset), bindingId: text(input.bindingId), bindingVersion: integer(input.bindingVersion, 1), bindingGeneration: integer(input.bindingGeneration, 1) });
+}
+function normalizeGrantUnsigned(value) {
+    try {
+        const grant = normalizeBrokerGrantAuthority(value);
+        return grant;
+    }
+    catch {
+        return fail('invalid-input');
+    }
+}
+export function externalGrantMirror(grant) {
+    return createBrokerGrantProjection(normalizeGrantUnsigned(grant));
+}
+export function brokerGrantDigest(grant) { return brokerGrantAuthorityDigest(normalizeGrantUnsigned(grant)); }
+export function withBrokerGrantDigest(grant) { const normalized = normalizeGrantUnsigned(grant); return Object.freeze({ ...normalized, digest: brokerGrantDigest(normalized) }); }
+export function normalizeBrokerGrant(value) {
+    const input = exact(value, ['protocol', 'id', 'revision', 'digest', 'clientKeyId', 'owner', 'sessionId', 'destination', 'credentialId', 'expiresAt', 'maxActions', 'maxTotalBytes', 'maxCostUnits', 'allowedOperations', 'allowedInspectKinds', 'client', 'source', 'policyEpoch', 'emergencyEpoch', ...(plain(value) && Object.hasOwn(value, 'verifiedDelivery') ? ['verifiedDelivery'] : [])]);
+    const { digest: claimed, ...unsigned } = input;
+    const normalized = normalizeGrantUnsigned(unsigned);
+    const expected = brokerGrantDigest(normalized);
+    if (digest(claimed) !== expected)
+        fail('invalid-input');
+    return Object.freeze({ ...normalized, digest: expected });
+}
+function sameNode(left, right) { return left.dev === right.dev && left.ino === right.ino && left.uid === right.uid && left.gid === right.gid && left.mode === right.mode && left.nlink === right.nlink; }
+function safeAncestorChain(value, uid, gid) {
+    let cursor = value, leaf = true;
+    for (;;) {
+        const stat = lstatSync(cursor, { bigint: true }), mode = Number(stat.mode & 4095n), owner = Number(stat.uid), group = Number(stat.gid);
+        const stickyRoot = owner === 0 && (mode & 0o1000) !== 0 && (mode & 0o022) !== 0;
+        if (realpathSync(cursor) !== cursor || stat.isSymbolicLink() || !stat.isDirectory() || !stickyRoot && (mode & 0o022) !== 0
+            || leaf && (owner !== uid || group !== gid || mode !== 0o700))
+            fail('unsafe-file');
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            return;
+        cursor = parent;
+        leaf = false;
+    }
+}
+function privateFile(value) { const stat = lstatSync(value, { bigint: true }); if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n || Number(stat.mode & 4095n) !== 0o600 || (process.geteuid?.() !== undefined && stat.uid !== BigInt(process.geteuid())))
+    fail('unsafe-file'); }
+function exists(value) { try {
+    lstatSync(value);
+    return true;
+}
+catch (error) {
+    if (error.code === 'ENOENT')
+        return false;
+    throw error;
+} }
+function prepareDatabasePath(value) {
+    if (!isAbsolute(value) || normalize(value) !== value)
+        fail('unsafe-file');
+    const uid = process.geteuid?.(), gid = process.getegid?.();
+    if (process.platform !== 'linux' || uid === undefined || gid === undefined)
+        fail('unsafe-file');
+    const parentPath = dirname(value);
+    safeAncestorChain(parentPath, uid, gid);
+    let parentDescriptor, fileDescriptor;
+    try {
+        parentDescriptor = openSync(parentPath, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        const parent = fstatSync(parentDescriptor, { bigint: true }), visibleParent = lstatSync(parentPath, { bigint: true });
+        if (!parent.isDirectory() || !sameNode(parent, visibleParent))
+            fail('unsafe-file');
+        const anchored = "/proc/self/fd/" + parentDescriptor + "/" + basename(value);
+        if (!exists(value)) {
+            const created = openSync(anchored, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+            closeSync(created);
+        }
+        fileDescriptor = openSync(anchored, constants.O_RDWR | constants.O_NOFOLLOW);
+        const file = fstatSync(fileDescriptor, { bigint: true }), visibleFile = lstatSync(value, { bigint: true });
+        if (!file.isFile() || file.nlink !== 1n || Number(file.mode & 4095n) !== 0o600 || file.uid !== BigInt(uid) || !sameNode(file, visibleFile))
+            fail('unsafe-file');
+        return { sqlitePath: anchored, parentDescriptor, fileDescriptor, parent, file };
+    }
+    catch (error) {
+        if (fileDescriptor !== undefined)
+            closeSync(fileDescriptor);
+        if (parentDescriptor !== undefined)
+            closeSync(parentDescriptor);
+        throw error;
+    }
+}
+function pinnedPathMatches(databasePath, pinned) {
+    try {
+        const parent = fstatSync(pinned.parentDescriptor, { bigint: true }), visibleParent = lstatSync(dirname(databasePath), { bigint: true });
+        const file = fstatSync(pinned.fileDescriptor, { bigint: true }), visibleFile = lstatSync(databasePath, { bigint: true });
+        return sameNode(parent, pinned.parent) && sameNode(parent, visibleParent) && sameNode(file, pinned.file) && sameNode(file, visibleFile);
+    }
+    catch {
+        return false;
+    }
+}
+function openDatabase(databasePath, instanceId, beforeOpen) {
+    const pinned = databasePath === ':memory:' ? undefined : prepareDatabasePath(databasePath);
+    let database;
+    try {
+        beforeOpen?.();
+        database = new DatabaseSync(pinned?.sqlitePath ?? databasePath, { enableForeignKeyConstraints: true });
+        if (pinned && !pinnedPathMatches(databasePath, pinned))
+            fail('unsafe-file');
+        database.exec('PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;');
+        const version = database.prepare('PRAGMA user_version').get().user_version;
+        if (version === 0) {
+            database.exec([
+                'BEGIN IMMEDIATE',
+                'CREATE TABLE meta (singleton INTEGER PRIMARY KEY CHECK(singleton=1), instance_id TEXT NOT NULL, generation INTEGER NOT NULL CHECK(generation>=0), controller_fence INTEGER NOT NULL CHECK(controller_fence>=0), control_version INTEGER NOT NULL CHECK(control_version>=0), policy_epoch INTEGER NOT NULL CHECK(policy_epoch>=0), emergency_epoch INTEGER NOT NULL CHECK(emergency_epoch>=0), stopped INTEGER NOT NULL CHECK(stopped IN (0,1)), draining INTEGER NOT NULL CHECK(draining IN (0,1))) STRICT',
+                'CREATE TABLE controller (singleton INTEGER PRIMARY KEY CHECK(singleton=1), owner_id TEXT NOT NULL, fence INTEGER NOT NULL CHECK(fence>=1), generation INTEGER NOT NULL CHECK(generation>=1), expires_at INTEGER NOT NULL CHECK(expires_at>=0)) STRICT',
+                'CREATE TABLE grants (id TEXT NOT NULL, revision INTEGER NOT NULL CHECK(revision>=1), digest TEXT NOT NULL, grant_json TEXT NOT NULL, revoked INTEGER NOT NULL CHECK(revoked IN (0,1)), created_at INTEGER NOT NULL CHECK(created_at>=0), PRIMARY KEY(id,revision), UNIQUE(digest)) STRICT, WITHOUT ROWID',
+                'CREATE TABLE grant_heads (id TEXT PRIMARY KEY, revision INTEGER NOT NULL, revoked INTEGER NOT NULL CHECK(revoked IN (0,1)), FOREIGN KEY(id,revision) REFERENCES grants(id,revision)) STRICT',
+                "CREATE TABLE requests (action_id TEXT PRIMARY KEY, request_id TEXT NOT NULL, client_key_id TEXT NOT NULL, owner_json TEXT NOT NULL, session_id TEXT NOT NULL, agent_id TEXT NOT NULL, root_call_id TEXT NOT NULL, call_id TEXT NOT NULL, grant_id TEXT NOT NULL, grant_revision INTEGER NOT NULL, grant_digest TEXT NOT NULL, request_digest TEXT NOT NULL, operation TEXT NOT NULL CHECK(operation IN ('commit','pull-request','inspect')), repository TEXT NOT NULL, branch TEXT NOT NULL, expected_head_oid TEXT, payload_digest TEXT NOT NULL, budget_reservation_id TEXT NOT NULL, bytes INTEGER NOT NULL CHECK(bytes>=0), cost_units INTEGER NOT NULL CHECK(cost_units>=0), deadline INTEGER NOT NULL CHECK(deadline>=1), policy_epoch INTEGER NOT NULL CHECK(policy_epoch>=0), emergency_epoch INTEGER NOT NULL CHECK(emergency_epoch>=0), generation INTEGER NOT NULL CHECK(generation>=1), status TEXT NOT NULL CHECK(status IN ('prepared','dispatched','succeeded','failed','unknown')), version INTEGER NOT NULL CHECK(version>=1), dispatched_at INTEGER, result_json TEXT, UNIQUE(client_key_id,request_id), UNIQUE(client_key_id,action_id), UNIQUE(client_key_id,budget_reservation_id), FOREIGN KEY(grant_id,grant_revision) REFERENCES grants(id,revision), CHECK((status IN ('prepared','dispatched') AND result_json IS NULL) OR (status IN ('succeeded','failed','unknown') AND result_json IS NOT NULL)), CHECK((status='prepared' AND dispatched_at IS NULL) OR status!='prepared'), CHECK((operation IN ('commit','pull-request'))=(expected_head_oid IS NOT NULL))) STRICT",
+                "CREATE TABLE credential_leases (action_id TEXT PRIMARY KEY, credential_id TEXT NOT NULL, purpose TEXT NOT NULL CHECK(purpose IN ('github.commit','github.pull-request','github.inspect')), status TEXT NOT NULL CHECK(status IN ('active','completed','failed','revoked')), issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, settled_at INTEGER, version INTEGER NOT NULL, FOREIGN KEY(action_id) REFERENCES requests(action_id), CHECK((status='active' AND settled_at IS NULL) OR (status!='active' AND settled_at IS NOT NULL))) STRICT",
+                'CREATE TABLE admin_nonces (admin_key_id TEXT NOT NULL, nonce_digest TEXT NOT NULL, request_digest TEXT NOT NULL, expires_at INTEGER NOT NULL CHECK(expires_at>=1), PRIMARY KEY(admin_key_id,nonce_digest)) STRICT, WITHOUT ROWID',
+                'CREATE TABLE audit (sequence INTEGER PRIMARY KEY, kind TEXT NOT NULL, subject_id TEXT NOT NULL, revision INTEGER, recorded_at INTEGER NOT NULL, previous_digest TEXT NOT NULL, digest TEXT NOT NULL UNIQUE) STRICT',
+                'CREATE INDEX requests_grant_budget ON requests(grant_id,dispatched_at,status)',
+                'CREATE INDEX requests_status ON requests(status)',
+                "CREATE INDEX requests_pr_occupancy ON requests(repository,branch,expected_head_oid,operation,status)",
+            ].join(';'));
+            database.prepare('INSERT INTO meta VALUES(1,?,0,0,0,0,0,0,0)').run(instanceId);
+            database.exec('PRAGMA user_version=2; COMMIT');
+        }
+        if (version === 1) {
+            try {
+                database.exec("BEGIN IMMEDIATE; ALTER TABLE credential_leases RENAME TO credential_leases_v1; ALTER TABLE requests RENAME TO requests_v1; CREATE TABLE requests (action_id TEXT PRIMARY KEY, request_id TEXT NOT NULL, client_key_id TEXT NOT NULL, owner_json TEXT NOT NULL, session_id TEXT NOT NULL, agent_id TEXT NOT NULL, root_call_id TEXT NOT NULL, call_id TEXT NOT NULL, grant_id TEXT NOT NULL, grant_revision INTEGER NOT NULL, grant_digest TEXT NOT NULL, request_digest TEXT NOT NULL, operation TEXT NOT NULL CHECK(operation IN ('commit','pull-request','inspect')), repository TEXT NOT NULL, branch TEXT NOT NULL, expected_head_oid TEXT, payload_digest TEXT NOT NULL, budget_reservation_id TEXT NOT NULL, bytes INTEGER NOT NULL CHECK(bytes>=0), cost_units INTEGER NOT NULL CHECK(cost_units>=0), deadline INTEGER NOT NULL CHECK(deadline>=1), policy_epoch INTEGER NOT NULL CHECK(policy_epoch>=0), emergency_epoch INTEGER NOT NULL CHECK(emergency_epoch>=0), generation INTEGER NOT NULL CHECK(generation>=1), status TEXT NOT NULL CHECK(status IN ('prepared','dispatched','succeeded','failed','unknown')), version INTEGER NOT NULL CHECK(version>=1), dispatched_at INTEGER, result_json TEXT, UNIQUE(client_key_id,request_id), UNIQUE(client_key_id,action_id), UNIQUE(client_key_id,budget_reservation_id), FOREIGN KEY(grant_id,grant_revision) REFERENCES grants(id,revision), CHECK((status IN ('prepared','dispatched') AND result_json IS NULL) OR (status IN ('succeeded','failed','unknown') AND result_json IS NOT NULL)), CHECK((status='prepared' AND dispatched_at IS NULL) OR status!='prepared'), CHECK((operation IN ('commit','pull-request'))=(expected_head_oid IS NOT NULL))) STRICT; INSERT INTO requests SELECT * FROM requests_v1; CREATE TABLE credential_leases (action_id TEXT PRIMARY KEY, credential_id TEXT NOT NULL, purpose TEXT NOT NULL CHECK(purpose IN ('github.commit','github.pull-request','github.inspect')), status TEXT NOT NULL CHECK(status IN ('active','completed','failed','revoked')), issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, settled_at INTEGER, version INTEGER NOT NULL, FOREIGN KEY(action_id) REFERENCES requests(action_id), CHECK((status='active' AND settled_at IS NULL) OR (status!='active' AND settled_at IS NOT NULL))) STRICT; INSERT INTO credential_leases SELECT * FROM credential_leases_v1; DROP TABLE credential_leases_v1; DROP TABLE requests_v1; CREATE INDEX requests_grant_budget ON requests(grant_id,dispatched_at,status); CREATE INDEX requests_status ON requests(status); CREATE INDEX requests_pr_occupancy ON requests(repository,branch,expected_head_oid,operation,status); PRAGMA user_version=2; COMMIT");
+            }
+            catch {
+                try {
+                    database.exec('ROLLBACK');
+                }
+                catch { }
+                fail('schema');
+            }
+        }
+        if (version !== 0 && version !== 1 && version !== SCHEMA_VERSION)
+            fail('schema');
+        const tables = database.prepare("SELECT name FROM sqlite_schema WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all().map(row => row.name);
+        if (!equal(tables, ['admin_nonces', 'audit', 'controller', 'credential_leases', 'grant_heads', 'grants', 'meta', 'requests']))
+            fail('schema');
+        const schemas = database.prepare("SELECT sql FROM sqlite_schema WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+        if (!schemas.every(row => /\bSTRICT\b/u.test(row.sql)))
+            fail('schema');
+        const expectedColumns = {
+            admin_nonces: ['admin_key_id', 'nonce_digest', 'request_digest', 'expires_at'],
+            audit: ['sequence', 'kind', 'subject_id', 'revision', 'recorded_at', 'previous_digest', 'digest'],
+            controller: ['singleton', 'owner_id', 'fence', 'generation', 'expires_at'],
+            credential_leases: ['action_id', 'credential_id', 'purpose', 'status', 'issued_at', 'expires_at', 'settled_at', 'version'],
+            grant_heads: ['id', 'revision', 'revoked'], grants: ['id', 'revision', 'digest', 'grant_json', 'revoked', 'created_at'],
+            meta: ['singleton', 'instance_id', 'generation', 'controller_fence', 'control_version', 'policy_epoch', 'emergency_epoch', 'stopped', 'draining'],
+            requests: ['action_id', 'request_id', 'client_key_id', 'owner_json', 'session_id', 'agent_id', 'root_call_id', 'call_id', 'grant_id', 'grant_revision', 'grant_digest', 'request_digest', 'operation', 'repository', 'branch', 'expected_head_oid', 'payload_digest', 'budget_reservation_id', 'bytes', 'cost_units', 'deadline', 'policy_epoch', 'emergency_epoch', 'generation', 'status', 'version', 'dispatched_at', 'result_json'],
+        };
+        for (const [table, expected] of Object.entries(expectedColumns)) {
+            const columns = database.prepare("SELECT name FROM pragma_table_info(?) ORDER BY cid").all(table).map(row => row.name);
+            if (!equal(columns, expected))
+                fail('schema');
+        }
+        const indexes = database.prepare("SELECT name FROM sqlite_schema WHERE type='index' AND name NOT LIKE 'sqlite_%' ORDER BY name").all().map(row => row.name);
+        if (!indexes.includes('requests_grant_budget') || !indexes.includes('requests_status') || !indexes.includes('requests_pr_occupancy'))
+            fail('schema');
+        if (database.prepare('PRAGMA quick_check').get().quick_check !== 'ok')
+            fail('schema');
+        if (databasePath !== ':memory:') {
+            if (!pinned || !pinnedPathMatches(databasePath, pinned))
+                fail('unsafe-file');
+            privateFile(databasePath);
+            for (const suffix of ['-wal', '-shm'])
+                if (exists(databasePath + suffix)) {
+                    const anchored = pinned.sqlitePath + suffix;
+                    chmodSync(anchored, 0o600);
+                    privateFile(databasePath + suffix);
+                    const anchoredStat = lstatSync(anchored, { bigint: true }), visibleStat = lstatSync(databasePath + suffix, { bigint: true });
+                    if (!sameNode(anchoredStat, visibleStat))
+                        fail('unsafe-file');
+                }
+            safeAncestorChain(dirname(databasePath), Number(pinned.parent.uid), Number(pinned.parent.gid));
+            if (!pinnedPathMatches(databasePath, pinned))
+                fail('unsafe-file');
+            closeSync(pinned.fileDescriptor);
+        }
+        return { database, ...(pinned ? { parentDescriptor: pinned.parentDescriptor } : {}) };
+    }
+    catch (error) {
+        database?.close();
+        if (pinned) {
+            try {
+                closeSync(pinned.fileDescriptor);
+            }
+            catch { }
+            ;
+            try {
+                closeSync(pinned.parentDescriptor);
+            }
+            catch { }
+        }
+        throw error;
+    }
+}
+export function brokerPayloadBytes(request) { return Buffer.byteLength(canonicalBrokerJson(request.payload), 'utf8'); }
+export const brokerLedgerRequestDigest = brokerRequestDigest;
+function outcome(value, record) {
+    const input = exact(value, ['status', 'dispatched', 'result', 'error', 'completedAt']);
+    if (!['succeeded', 'failed', 'unknown'].includes(String(input.status)) || typeof input.dispatched !== 'boolean')
+        fail('invalid-input');
+    const status = input.status;
+    if (status === 'succeeded') {
+        if (!input.dispatched || input.error !== null || !plain(input.result))
+            fail('invalid-input');
+        if (record && (input.result.operation !== record.operation || input.result.repository !== record.repository || input.result.branch !== record.branch || record.operation === 'commit' && input.result.parentOid !== record.expectedHeadOid || record.operation === 'pull-request' && input.result.expectedHeadOid !== record.expectedHeadOid))
+            fail('state');
+    }
+    else {
+        if (input.result !== null || !plain(input.error) || Object.keys(input.error).length !== 1 || typeof input.error.code !== 'string' || !/^[a-z0-9][a-z0-9-]{0,127}$/u.test(input.error.code))
+            fail('invalid-input');
+        if (status === 'unknown' && !input.dispatched)
+            fail('invalid-input');
+    }
+    return Object.freeze({ status, dispatched: input.dispatched, result: input.result, error: input.error, completedAt: integer(input.completedAt, 1) });
+}
+export class ExternalBrokerLedger {
+    #database;
+    #parentDescriptor;
+    #now;
+    #closed = false;
+    constructor(databasePath, instanceId, options = {}) {
+        text(instanceId, 128);
+        if (!plain(options) || Object.keys(options).some(key => !['now', 'beforeDatabaseOpen'].includes(key)) || options.now !== undefined && typeof options.now !== 'function' || options.beforeDatabaseOpen !== undefined && typeof options.beforeDatabaseOpen !== 'function')
+            fail('invalid-input');
+        this.#now = options.now ?? Date.now;
+        const opened = openDatabase(databasePath, instanceId, options.beforeDatabaseOpen);
+        this.#database = opened.database;
+        this.#parentDescriptor = opened.parentDescriptor;
+        try {
+            this.#validateStored(instanceId);
+        }
+        catch (error) {
+            this.#database.close();
+            if (this.#parentDescriptor !== undefined)
+                closeSync(this.#parentDescriptor);
+            throw error;
+        }
+    }
+    #time() { return integer(this.#now()); }
+    #meta() { const row = this.#database.prepare('SELECT * FROM meta WHERE singleton=1').get(); if (!row)
+        fail('schema'); this.#validateMeta(row); return row; }
+    #validateMeta(row) { text(row.instance_id, 128); integer(row.generation); integer(row.controller_fence); integer(row.control_version); integer(row.policy_epoch); integer(row.emergency_epoch); if (![0, 1].includes(row.stopped) || ![0, 1].includes(row.draining))
+        fail('schema'); }
+    #authority(value, now = this.#time()) {
+        if (!plain(value) || Object.keys(value).length !== 3)
+            fail('invalid-input');
+        const ownerId = text(value.ownerId);
+        const fence = integer(value.fence, 1);
+        const generation = integer(value.generation, 1);
+        const row = this.#database.prepare('SELECT owner_id,fence,generation,expires_at FROM controller WHERE singleton=1').get();
+        if (!row || row.owner_id !== ownerId || row.fence !== fence || row.generation !== generation || row.expires_at <= now || this.#meta().generation !== generation)
+            fail('controller');
+        return Object.freeze({ ownerId, fence, generation });
+    }
+    #grant(row) { try {
+        const grant = normalizeBrokerGrant(json(row.grant_json));
+        if (grant.id !== row.id || grant.revision !== row.revision || grant.digest !== row.digest || ![0, 1].includes(row.revoked) || !Number.isSafeInteger(row.created_at))
+            fail('schema');
+        return grant;
+    }
+    catch {
+        return fail('schema');
+    } }
+    #head(id) { const row = this.#database.prepare('SELECT g.*,h.revoked AS head_revoked FROM grant_heads h JOIN grants g ON g.id=h.id AND g.revision=h.revision WHERE h.id=?').get(id); if (row && row.revoked !== row.head_revoked)
+        fail('schema'); return row; }
+    #row(row) {
+        try {
+            const status = row.status;
+            if (!['prepared', 'dispatched', 'succeeded', 'failed', 'unknown'].includes(status))
+                fail('schema');
+            const terminal = ['succeeded', 'failed', 'unknown'].includes(status);
+            if (terminal !== (row.result_json !== null) || status === 'prepared' && row.dispatched_at !== null || status === 'dispatched' && row.dispatched_at === null)
+                fail('schema');
+            const record = { actionId: text(row.action_id), requestId: text(row.request_id), clientKeyId: text(row.client_key_id), owner: owner(json(row.owner_json)), sessionId: text(row.session_id), agentId: text(row.agent_id), rootCallId: text(row.root_call_id), callId: text(row.call_id), grantId: text(row.grant_id), grantRevision: integer(row.grant_revision, 1), grantDigest: digest(row.grant_digest), requestDigest: digest(row.request_digest), operation: row.operation, repository: text(row.repository), branch: text(row.branch), expectedHeadOid: row.expected_head_oid, payloadDigest: digest(row.payload_digest), budgetReservationId: text(row.budget_reservation_id), bytes: integer(row.bytes), costUnits: integer(row.cost_units), deadline: integer(row.deadline, 1), policyEpoch: integer(row.policy_epoch), emergencyEpoch: integer(row.emergency_epoch), generation: integer(row.generation, 1), status, version: integer(row.version, 1) };
+            if (!['commit', 'pull-request', 'inspect'].includes(record.operation) || (['commit', 'pull-request'].includes(record.operation)) !== (record.expectedHeadOid !== null) || record.expectedHeadOid !== null && !/^[0-9a-f]{40,128}$/u.test(record.expectedHeadOid))
+                fail('schema');
+            const grantRow = this.#database.prepare('SELECT * FROM grants WHERE id=? AND revision=?').get(record.grantId, record.grantRevision);
+            if (!grantRow)
+                fail('schema');
+            const grant = this.#grant(grantRow);
+            if (grant.digest !== record.grantDigest || grant.clientKeyId !== record.clientKeyId || !equal(grant.owner, record.owner) || grant.sessionId !== record.sessionId || grant.destination.repository !== record.repository || grant.destination.branch !== record.branch || grant.policyEpoch !== record.policyEpoch || grant.emergencyEpoch !== record.emergencyEpoch)
+                fail('schema');
+            if (terminal) {
+                record.outcome = outcome(json(row.result_json), record);
+                if (record.outcome.dispatched !== (row.dispatched_at !== null))
+                    fail('schema');
+            }
+            return Object.freeze(record);
+        }
+        catch {
+            return fail('schema');
+        }
+    }
+    #audit(kind, subjectId, revision, now) {
+        const previous = this.#database.prepare('SELECT digest FROM audit ORDER BY sequence DESC LIMIT 1').get()?.digest ?? '0'.repeat(64);
+        const sequence = this.#database.prepare('SELECT COALESCE(MAX(sequence),0)+1 AS value FROM audit').get().value;
+        const next = createHash('sha256').update(canonicalBrokerJson({ sequence, kind, subjectId, revision, recordedAt: now, previous })).digest('hex');
+        this.#database.prepare('INSERT INTO audit(sequence,kind,subject_id,revision,recorded_at,previous_digest,digest) VALUES(?,?,?,?,?,?,?)').run(sequence, kind, subjectId, revision, now, previous, next);
+    }
+    #validateStored(instanceId) {
+        try {
+            const meta = this.#meta();
+            if (meta.instance_id !== instanceId)
+                fail('schema');
+            const grants = this.#database.prepare('SELECT * FROM grants').all();
+            if (grants.length > MAX_GRANTS)
+                fail('schema');
+            for (const grant of grants)
+                this.#grant(grant);
+            const heads = this.#database.prepare('SELECT COUNT(*) AS count FROM grant_heads').get().count;
+            const joined = this.#database.prepare('SELECT g.*,h.revoked AS head_revoked FROM grant_heads h JOIN grants g ON g.id=h.id AND g.revision=h.revision').all();
+            if (heads !== joined.length || joined.some(row => row.revoked !== row.head_revoked))
+                fail('schema');
+            const rows = this.#database.prepare('SELECT * FROM requests LIMIT 10001').all();
+            if (rows.length > MAX_RECORDS)
+                fail('schema');
+            for (const row of rows)
+                this.#row(row);
+            const controllers = this.#database.prepare('SELECT owner_id,fence,generation,expires_at FROM controller').all();
+            if (controllers.length > 1)
+                fail('schema');
+            for (const controller of controllers) {
+                text(controller.owner_id);
+                integer(controller.fence, 1);
+                integer(controller.generation, 1);
+                integer(controller.expires_at);
+            }
+            const leases = this.#database.prepare('SELECT * FROM credential_leases').all();
+            for (const lease of leases) {
+                const action = rows.find(row => row.action_id === text(lease.action_id));
+                if (!action || text(lease.credential_id, 128) !== this.#grant(this.#database.prepare('SELECT * FROM grants WHERE id=? AND revision=?').get(action.grant_id, action.grant_revision)).credentialId)
+                    fail('schema');
+                if (!['github.commit', 'github.pull-request', 'github.inspect'].includes(lease.purpose) || lease.purpose !== (action.operation === 'commit' ? 'github.commit' : action.operation === 'pull-request' ? 'github.pull-request' : 'github.inspect') || !['active', 'completed', 'failed', 'revoked'].includes(lease.status))
+                    fail('schema');
+                const issuedAt = integer(lease.issued_at);
+                const expiresAt = integer(lease.expires_at, 1);
+                integer(lease.version, 1);
+                if (expiresAt <= issuedAt || (lease.status === 'active') !== (lease.settled_at === null) || lease.status === 'active' && action.status !== 'dispatched' || lease.status === 'completed' && action.status !== 'succeeded')
+                    fail('schema');
+                if (lease.settled_at !== null)
+                    integer(lease.settled_at);
+            }
+            const nonces = this.#database.prepare('SELECT * FROM admin_nonces').all();
+            for (const nonce of nonces) {
+                text(nonce.admin_key_id, 128);
+                digest(nonce.nonce_digest);
+                digest(nonce.request_digest);
+                integer(nonce.expires_at, 1);
+            }
+            const audits = this.#database.prepare('SELECT * FROM audit ORDER BY sequence').all();
+            let previous = '0'.repeat(64);
+            for (let index = 0; index < audits.length; index++) {
+                const item = audits[index];
+                const expected = createHash('sha256').update(canonicalBrokerJson({ sequence: item.sequence, kind: item.kind, subjectId: item.subject_id, revision: item.revision, recordedAt: item.recorded_at, previous })).digest('hex');
+                if (item.sequence !== index + 1 || item.previous_digest !== previous || item.digest !== expected)
+                    fail('schema');
+                previous = item.digest;
+            }
+        }
+        catch {
+            fail('schema');
+        }
+    }
+    #snapshot(meta = this.#meta()) { return Object.freeze({ instanceId: meta.instance_id, generation: meta.generation, controlVersion: meta.control_version, policyEpoch: meta.policy_epoch, emergencyEpoch: meta.emergency_epoch, stopped: meta.stopped === 1, draining: meta.draining === 1 }); }
+    claimController(ownerId, ttlMs = 30_000) {
+        const ownerIdValue = text(ownerId);
+        const ttl = integer(ttlMs, 1, 300_000);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const current = this.#database.prepare('SELECT * FROM controller WHERE singleton=1').get();
+            if (current && current.expires_at > now)
+                fail('controller');
+            const meta = this.#meta();
+            const fence = integer(meta.controller_fence + 1, 1);
+            const generation = integer(meta.generation + 1, 1);
+            this.#database.prepare('UPDATE meta SET generation=?,controller_fence=?,draining=0 WHERE singleton=1').run(generation, fence);
+            this.#database.prepare('INSERT INTO controller VALUES(1,?,?,?,?) ON CONFLICT(singleton) DO UPDATE SET owner_id=excluded.owner_id,fence=excluded.fence,generation=excluded.generation,expires_at=excluded.expires_at').run(ownerIdValue, fence, generation, now + ttl);
+            this.#recoverRows(now);
+            this.#audit('controller-claimed', ownerIdValue, fence, now);
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ownerId: ownerIdValue, fence, generation });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    renewController(authority, ttlMs = 30_000) { const now = this.#time(); const current = this.#authority(authority, now); const changed = this.#database.prepare('UPDATE controller SET expires_at=? WHERE singleton=1 AND owner_id=? AND fence=? AND generation=? AND expires_at>?').run(now + integer(ttlMs, 1, 300_000), current.ownerId, current.fence, current.generation, now); if (changed.changes !== 1)
+        fail('controller'); }
+    hasController(authority) { try {
+        this.#authority(authority);
+        return true;
+    }
+    catch {
+        return false;
+    } }
+    releaseController(authority) { const current = this.#authority(authority); this.#database.prepare('DELETE FROM controller WHERE singleton=1 AND owner_id=? AND fence=? AND generation=?').run(current.ownerId, current.fence, current.generation); }
+    #recoverRows(now) {
+        const rows = this.#database.prepare("SELECT * FROM requests WHERE status IN ('prepared','dispatched')").all();
+        for (const row of rows)
+            this.#terminalize(row, now, row.status === 'dispatched' ? 'restart-after-dispatch' : 'restart-before-dispatch');
+        this.#database.prepare("UPDATE credential_leases SET status='revoked',settled_at=?,version=version+1 WHERE status='active'").run(now);
+    }
+    syncGrants(values, policyEpoch, authority) {
+        if (!Array.isArray(values) || values.length > MAX_GRANTS)
+            fail('invalid-input');
+        const grants = values.map(normalizeBrokerGrant);
+        if (new Set(grants.map(grant => grant.id)).size !== grants.length)
+            fail('invalid-input');
+        const nextEpoch = integer(policyEpoch);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            if (nextEpoch < meta.policy_epoch || grants.some(grant => grant.policyEpoch !== nextEpoch || grant.emergencyEpoch !== meta.emergency_epoch))
+                fail('grant');
+            const supplied = new Set(grants.map(grant => grant.id));
+            let changed = nextEpoch !== meta.policy_epoch;
+            const abort = new Set();
+            for (const grant of grants) {
+                const head = this.#head(grant.id);
+                if (head && grant.revision < head.revision)
+                    fail('conflict');
+                if (head && grant.revision === head.revision) {
+                    if (head.digest !== grant.digest || head.revoked || head.head_revoked)
+                        fail('conflict');
+                    continue;
+                }
+                this.#database.prepare('INSERT INTO grants VALUES(?,?,?,?,0,?)').run(grant.id, grant.revision, grant.digest, canonicalBrokerJson(grant), now);
+                this.#database.prepare('INSERT INTO grant_heads VALUES(?,?,0) ON CONFLICT(id) DO UPDATE SET revision=excluded.revision,revoked=0').run(grant.id, grant.revision);
+                changed = true;
+                this.#audit('grant-synced', grant.id, grant.revision, now);
+                for (const row of this.#terminalizeGrant(grant.id, now, 'grant-replaced'))
+                    if (row.status === 'unknown')
+                        abort.add(row.actionId);
+            }
+            const heads = this.#database.prepare('SELECT id,revision,revoked FROM grant_heads').all();
+            for (const head of heads)
+                if (!supplied.has(head.id) && head.revoked === 0) {
+                    this.#database.prepare('UPDATE grant_heads SET revoked=1 WHERE id=? AND revision=?').run(head.id, head.revision);
+                    this.#database.prepare('UPDATE grants SET revoked=1 WHERE id=? AND revision=?').run(head.id, head.revision);
+                    changed = true;
+                    this.#audit('grant-removed', head.id, head.revision, now);
+                    for (const row of this.#terminalizeGrant(head.id, now, 'grant-removed'))
+                        if (row.status === 'unknown')
+                            abort.add(row.actionId);
+                }
+            if (changed)
+                this.#database.prepare('UPDATE meta SET policy_epoch=?,control_version=control_version+1 WHERE singleton=1').run(nextEpoch);
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze([...abort]) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    grant(id) { const row = this.#head(text(id)); return row && !row.head_revoked ? this.#grant(row) : undefined; }
+    #checkRequest(request, grant, meta, now) {
+        if (meta.stopped || meta.draining)
+            fail('stopped');
+        if (request.clientKeyId !== grant.clientKeyId || request.grantRevision !== grant.revision || request.grantDigest !== grant.digest || !equal(request.owner, grant.owner) || request.sessionId !== grant.sessionId || !equal(request.source, grant.source)
+            || !equal(request.client, grant.client)
+            || request.broker.kind !== 'github-broker' || request.broker.instanceId !== meta.instance_id || request.broker.generation !== meta.generation
+            || request.destination.classification !== 'github-repository' || request.destination.repository !== grant.destination.repository || request.destination.branch !== grant.destination.branch || request.destination.baseBranch !== grant.destination.baseBranch
+            || request.policyEpoch !== grant.policyEpoch || request.policyEpoch !== meta.policy_epoch || request.emergencyEpoch !== grant.emergencyEpoch || request.emergencyEpoch !== meta.emergency_epoch
+            || request.deadline <= now || request.deadline > grant.expiresAt || grant.expiresAt <= now || !grant.allowedOperations.includes(request.operation))
+            fail('grant');
+        if (request.operation === 'commit') {
+            if (!('files' in request.payload) || request.payload.files.some(file => !grant.destination.paths.includes(file.path)))
+                fail('grant');
+        }
+        else if (request.operation === 'pull-request') {
+            if (!grant.destination.baseBranch || grant.destination.baseBranch === grant.destination.branch || !('expectedHeadOid' in request.payload))
+                fail('grant');
+        }
+        else if (!('kind' in request.payload) || !grant.allowedInspectKinds.includes(request.payload.kind) || request.payload.kind === 'file' && (!request.payload.path || !grant.destination.paths.includes(request.payload.path)))
+            fail('grant');
+        const bytes = brokerPayloadBytes(request);
+        const costUnits = request.operation === 'inspect' && 'kind' in request.payload && ['checks', 'reviews'].includes(request.payload.kind) ? 2 : 1;
+        if (request.budget.actions !== 1 || request.budget.bytes !== bytes || request.budget.costMetric !== 'github-api-units' || request.budget.maxCostUnits !== costUnits || bytes > grant.maxTotalBytes || costUnits > grant.maxCostUnits)
+            fail('limit');
+        return bytes;
+    }
+    prepare(request, authority) {
+        const now = this.#time();
+        const requestDigest = brokerLedgerRequestDigest(request);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const existing = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(request.actionId);
+            if (existing) {
+                const record = this.#row(existing);
+                if (record.requestDigest !== requestDigest || record.clientKeyId !== request.clientKeyId)
+                    fail('conflict');
+                // Exact terminal history is immutable readback and remains available
+                // after grant expiry/revocation or controller handover. A nonterminal
+                // row can still advance, so it must pass the current fence and grant.
+                if (!record.outcome) {
+                    this.#authority(authority, now);
+                    const current = this.#head(request.grantId);
+                    if (!current || current.revoked || current.head_revoked)
+                        fail('grant');
+                    this.#checkRequest(request, this.#grant(current), this.#meta(), now);
+                }
+                this.#database.exec('COMMIT');
+                return { record, created: false };
+            }
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            const head = this.#head(request.grantId);
+            if (!head || head.revoked || head.head_revoked)
+                fail('grant');
+            const grant = this.#grant(head);
+            const bytes = this.#checkRequest(request, grant, meta, now);
+            const collision = this.#database.prepare('SELECT request_digest FROM requests WHERE client_key_id=? AND (request_id=? OR budget_reservation_id=?)').get(request.clientKeyId, request.requestId, request.budget.reservationId);
+            if (collision)
+                fail('conflict');
+            const count = this.#database.prepare('SELECT COUNT(*) AS count FROM requests').get().count;
+            if (count >= MAX_RECORDS)
+                fail('limit');
+            if (request.operation === 'pull-request') {
+                const occupied = this.#database.prepare("SELECT 1 FROM requests r JOIN grants g ON g.id=r.grant_id AND g.revision=r.grant_revision WHERE r.repository=? AND r.branch=? AND r.operation='pull-request' AND json_extract(g.grant_json,'$.destination.baseBranch')=? AND (r.status IN ('prepared','dispatched','unknown') OR (r.status='succeeded' AND r.expected_head_oid=?)) LIMIT 1").get(grant.destination.repository, grant.destination.branch, grant.destination.baseBranch, 'expectedHeadOid' in request.payload ? request.payload.expectedHeadOid : '');
+                if (occupied)
+                    fail('conflict');
+            }
+            if (request.operation === 'commit' && 'expectedHeadOid' in request.payload
+                && this.#database.prepare("SELECT 1 FROM requests WHERE operation='commit' AND repository=? AND branch=? AND expected_head_oid=? AND status IN ('dispatched','unknown') LIMIT 1").get(grant.destination.repository, grant.destination.branch, request.payload.expectedHeadOid))
+                fail('conflict');
+            const used = this.#database.prepare("SELECT COUNT(*) AS actions,COALESCE(SUM(bytes),0) AS bytes,COALESCE(SUM(cost_units),0) AS cost FROM requests WHERE grant_id=? AND (status='prepared' OR dispatched_at IS NOT NULL)").get(grant.id);
+            const costUnits = request.budget.maxCostUnits;
+            if (used.actions + 1 > grant.maxActions || used.bytes + bytes > grant.maxTotalBytes || used.cost + costUnits > grant.maxCostUnits)
+                fail('limit');
+            this.#database.prepare('INSERT INTO requests(action_id,request_id,client_key_id,owner_json,session_id,agent_id,root_call_id,call_id,grant_id,grant_revision,grant_digest,request_digest,operation,repository,branch,expected_head_oid,payload_digest,budget_reservation_id,bytes,cost_units,deadline,policy_epoch,emergency_epoch,generation,status,version,dispatched_at,result_json) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,NULL,NULL)').run(request.actionId, request.requestId, request.clientKeyId, canonicalBrokerJson(request.owner), request.sessionId, request.agentId, request.rootCallId, request.callId, grant.id, grant.revision, grant.digest, requestDigest, request.operation, grant.destination.repository, grant.destination.branch, (request.operation === 'commit' || request.operation === 'pull-request') && 'expectedHeadOid' in request.payload ? request.payload.expectedHeadOid : null, request.payloadDigest, request.budget.reservationId, bytes, costUnits, request.deadline, request.policyEpoch, request.emergencyEpoch, meta.generation, 'prepared');
+            this.#audit('request-prepared', request.actionId, 1, now);
+            const row = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(request.actionId);
+            this.#database.exec('COMMIT');
+            return { record: this.#row(row), created: true };
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    dispatch(actionId, version, requestDigestValue, credentialId, leaseExpiresAt, authority) {
+        const id = text(actionId);
+        const expected = integer(version, 1);
+        const expectedDigest = digest(requestDigestValue);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            if (meta.stopped || meta.draining)
+                fail('stopped');
+            const row = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(id);
+            if (!row)
+                fail('state');
+            const record = this.#row(row);
+            if (record.status !== 'prepared' || record.version !== expected || record.requestDigest !== expectedDigest || record.deadline <= now || record.generation !== meta.generation || record.policyEpoch !== meta.policy_epoch || record.emergencyEpoch !== meta.emergency_epoch)
+                fail('state');
+            const head = this.#head(record.grantId);
+            if (!head || head.revoked || head.head_revoked || head.revision !== record.grantRevision || head.digest !== record.grantDigest)
+                fail('grant');
+            const grant = this.#grant(head);
+            if (grant.expiresAt <= now || grant.credentialId !== credentialId || leaseExpiresAt <= now || leaseExpiresAt > record.deadline || leaseExpiresAt > grant.expiresAt)
+                fail('grant');
+            if (record.operation === 'commit' && this.#database.prepare("SELECT 1 FROM requests WHERE action_id!=? AND operation='commit' AND repository=? AND branch=? AND expected_head_oid=? AND status IN ('dispatched','unknown') LIMIT 1").get(id, record.repository, record.branch, record.expectedHeadOid))
+                fail('conflict');
+            const changed = this.#database.prepare("UPDATE requests SET status='dispatched',version=version+1,dispatched_at=? WHERE action_id=? AND status='prepared' AND version=? AND request_digest=?").run(now, id, expected, expectedDigest);
+            if (changed.changes !== 1)
+                fail('state');
+            this.#database.prepare("INSERT INTO credential_leases VALUES(?,?,?,'active',?,?,NULL,1)").run(id, credentialId, record.operation === 'commit' ? 'github.commit' : record.operation === 'pull-request' ? 'github.pull-request' : 'github.inspect', now, leaseExpiresAt);
+            this.#audit('request-dispatched', id, expected + 1, now);
+            const updated = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(id);
+            this.#database.exec('COMMIT');
+            return this.#row(updated);
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    settle(actionId, version, requestDigestValue, value, authority) {
+        const id = text(actionId);
+        const expected = integer(version, 1);
+        const expectedDigest = digest(requestDigestValue);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const row = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(id);
+            if (!row)
+                fail('state');
+            const record = this.#row(row);
+            if (record.requestDigest !== expectedDigest)
+                fail('conflict');
+            if (record.outcome) {
+                this.#database.exec('COMMIT');
+                return record;
+            }
+            if (record.version !== expected || !['prepared', 'dispatched'].includes(record.status))
+                fail('state');
+            const normalized = outcome(value, record);
+            if (record.status === 'prepared' && normalized.dispatched || record.status === 'dispatched' && !normalized.dispatched)
+                fail('state');
+            const changed = this.#database.prepare('UPDATE requests SET status=?,version=version+1,result_json=? WHERE action_id=? AND version=? AND status=?').run(normalized.status, canonicalBrokerJson(normalized), id, expected, record.status);
+            if (changed.changes !== 1)
+                fail('state');
+            if (record.status === 'dispatched')
+                this.#database.prepare("UPDATE credential_leases SET status=?,settled_at=?,version=version+1 WHERE action_id=? AND status='active'").run(normalized.status === 'succeeded' ? 'completed' : 'failed', now, id);
+            this.#audit('request-settled', id, expected + 1, now);
+            const updated = this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(id);
+            this.#database.exec('COMMIT');
+            return this.#row(updated);
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    failPrepared(actionId, version, requestDigestValue, code, authority) { return this.settle(actionId, version, requestDigestValue, { status: 'failed', dispatched: false, result: null, error: { code }, completedAt: Math.max(1, this.#time()) }, authority); }
+    status(clientKeyId, actionId, requestDigestValue) { const row = this.#database.prepare('SELECT * FROM requests WHERE client_key_id=? AND action_id=?').get(text(clientKeyId), text(actionId)); if (!row)
+        return undefined; const record = this.#row(row); if (record.requestDigest !== digest(requestDigestValue))
+        fail('conflict'); return record; }
+    terminalizeActive(reason, authority) {
+        const code = text(reason, 128);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const rows = this.#database.prepare("SELECT * FROM requests WHERE status IN ('prepared','dispatched')").all();
+            const abort = [];
+            for (const row of rows) {
+                const result = this.#terminalize(row, now, code);
+                if (result.status === 'unknown')
+                    abort.push(result.actionId);
+            }
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze(abort) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    consumeAdminNonce(adminKeyId, nonce, requestDigestValue, expiresAt, authority) {
+        const key = text(adminKeyId, 128);
+        const nonceDigest = createHash('sha256').update(text(nonce, 128)).digest('hex');
+        const requestDigest = digest(requestDigestValue);
+        const expiry = integer(expiresAt, 1);
+        const now = this.#time();
+        if (expiry <= now)
+            fail('invalid-input');
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            this.#database.prepare('DELETE FROM admin_nonces WHERE expires_at<=?').run(now);
+            const existing = this.#database.prepare('SELECT request_digest FROM admin_nonces WHERE admin_key_id=? AND nonce_digest=?').get(key, nonceDigest);
+            if (existing)
+                fail('conflict');
+            this.#database.prepare('INSERT INTO admin_nonces VALUES(?,?,?,?)').run(key, nonceDigest, requestDigest, expiry);
+            this.#audit('admin-nonce-consumed', key, null, now);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    applyAdminMutation(input) {
+        if (!plain(input) || Object.keys(input).length !== 6 || !plain(input.mutation))
+            fail('invalid-input');
+        const key = text(input.adminKeyId, 128);
+        const nonceDigest = createHash('sha256').update(text(input.nonce, 128)).digest('hex');
+        const requestDigest = digest(input.requestDigest);
+        const expiresAt = integer(input.expiresAt, 1);
+        const now = this.#time();
+        if (expiresAt <= now)
+            fail('invalid-input');
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(input.authority, now);
+            this.#database.prepare('DELETE FROM admin_nonces WHERE expires_at<=?').run(now);
+            if (this.#database.prepare('SELECT 1 FROM admin_nonces WHERE admin_key_id=? AND nonce_digest=?').get(key, nonceDigest))
+                fail('conflict');
+            const meta = this.#meta();
+            const expected = integer(input.mutation.expectedControlVersion);
+            if (meta.control_version !== expected)
+                fail('conflict');
+            const abort = [];
+            if (input.mutation.operation === 'stop' || input.mutation.operation === 'resume') {
+                if (input.mutation.operation === 'resume' && integer(input.mutation.expectedGeneration, 1) !== meta.generation)
+                    fail('controller');
+                text(input.mutation.reason, 256);
+                this.#database.prepare('UPDATE meta SET control_version=control_version+1,emergency_epoch=emergency_epoch+1,stopped=? WHERE singleton=1').run(input.mutation.operation === 'stop' ? 1 : 0);
+                const rows = this.#database.prepare("SELECT * FROM requests WHERE status IN ('prepared','dispatched')").all();
+                for (const row of rows) {
+                    const result = this.#terminalize(row, now, input.mutation.operation === 'stop' ? 'emergency-stop' : 'emergency-epoch-advanced');
+                    if (result.status === 'unknown')
+                        abort.push(result.actionId);
+                }
+                this.#audit(input.mutation.operation === 'stop' ? 'emergency-stopped' : 'emergency-resumed', input.mutation.reason, expected + 1, now);
+            }
+            else {
+                text(input.mutation.reason, 256);
+                const id = text(input.mutation.grantId);
+                const revision = integer(input.mutation.grantRevision, 1);
+                const head = this.#head(id);
+                if (!head || head.revision !== revision || head.digest !== digest(input.mutation.grantDigest) || meta.policy_epoch !== integer(input.mutation.policyEpoch) || meta.emergency_epoch !== integer(input.mutation.emergencyEpoch))
+                    fail('grant');
+                this.#database.prepare('UPDATE grant_heads SET revoked=1 WHERE id=? AND revision=?').run(id, revision);
+                this.#database.prepare('UPDATE grants SET revoked=1 WHERE id=? AND revision=?').run(id, revision);
+                for (const row of this.#terminalizeGrant(id, now, 'grant-revoked'))
+                    if (row.status === 'unknown')
+                        abort.push(row.actionId);
+                this.#database.prepare('UPDATE meta SET control_version=control_version+1 WHERE singleton=1').run();
+                this.#audit('grant-revoked', id, revision, now);
+            }
+            this.#database.prepare('INSERT INTO admin_nonces VALUES(?,?,?,?)').run(key, nonceDigest, requestDigest, expiresAt);
+            this.#audit('admin-nonce-consumed', key, null, now);
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze(abort) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    #terminalize(row, now, code) {
+        const record = this.#row(row);
+        const dispatched = record.status === 'dispatched';
+        const normalized = { status: dispatched ? 'unknown' : 'failed', dispatched, result: null, error: { code }, completedAt: Math.max(1, now) };
+        const changed = this.#database.prepare('UPDATE requests SET status=?,version=version+1,result_json=? WHERE action_id=? AND version=? AND status=?').run(normalized.status, canonicalBrokerJson(normalized), record.actionId, record.version, record.status);
+        if (changed.changes !== 1)
+            fail('state');
+        this.#database.prepare("UPDATE credential_leases SET status='revoked',settled_at=?,version=version+1 WHERE action_id=? AND status='active'").run(now, record.actionId);
+        this.#audit('request-invalidated', record.actionId, record.version + 1, now);
+        return this.#row(this.#database.prepare('SELECT * FROM requests WHERE action_id=?').get(record.actionId));
+    }
+    #terminalizeGrant(grantId, now, code) { const rows = this.#database.prepare("SELECT * FROM requests WHERE grant_id=? AND status IN ('prepared','dispatched')").all(grantId); return rows.map(row => this.#terminalize(row, now, code)); }
+    #control(expectedControlVersion, stopped, reason, authority) {
+        const expected = integer(expectedControlVersion);
+        text(reason, 256);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            if (meta.control_version !== expected)
+                fail('conflict');
+            this.#database.prepare('UPDATE meta SET control_version=control_version+1,emergency_epoch=emergency_epoch+1,stopped=? WHERE singleton=1').run(stopped ? 1 : 0);
+            const rows = this.#database.prepare("SELECT * FROM requests WHERE status IN ('prepared','dispatched')").all();
+            const abort = [];
+            for (const row of rows) {
+                const result = this.#terminalize(row, now, stopped ? 'emergency-stop' : 'emergency-epoch-advanced');
+                if (result.status === 'unknown')
+                    abort.push(result.actionId);
+            }
+            this.#audit(stopped ? 'emergency-stopped' : 'emergency-resumed', reason, expected + 1, now);
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze(abort) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    stop(expectedControlVersion, reason, authority) { return this.#control(expectedControlVersion, true, reason, authority); }
+    resume(expectedControlVersion, reason, authority) { return this.#control(expectedControlVersion, false, reason, authority); }
+    beginDrain(expectedControlVersion, reason, authority) {
+        const expected = integer(expectedControlVersion);
+        text(reason, 256);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            if (meta.draining === 1) {
+                this.#database.exec('COMMIT');
+                return Object.freeze({ ...this.#snapshot(meta), abortActionIds: Object.freeze([]) });
+            }
+            if (meta.control_version !== expected)
+                fail('conflict');
+            this.#database.prepare('UPDATE meta SET control_version=control_version+1,draining=1 WHERE singleton=1').run();
+            this.#audit('drain-started', reason, expected + 1, now);
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze([]) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    revoke(grantId, revision, expectedControlVersion, reason, authority) {
+        const id = text(grantId);
+        const expectedRevision = integer(revision, 1);
+        const expectedControl = integer(expectedControlVersion);
+        text(reason, 256);
+        const now = this.#time();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            this.#authority(authority, now);
+            const meta = this.#meta();
+            if (meta.control_version !== expectedControl)
+                fail('conflict');
+            const head = this.#head(id);
+            if (!head || head.revision !== expectedRevision)
+                fail('grant');
+            this.#database.prepare('UPDATE grant_heads SET revoked=1 WHERE id=? AND revision=?').run(id, expectedRevision);
+            this.#database.prepare('UPDATE grants SET revoked=1 WHERE id=? AND revision=?').run(id, expectedRevision);
+            const abort = [];
+            for (const row of this.#terminalizeGrant(id, now, 'grant-revoked'))
+                if (row.status === 'unknown')
+                    abort.push(row.actionId);
+            this.#database.prepare('UPDATE meta SET control_version=control_version+1 WHERE singleton=1').run();
+            this.#audit('grant-revoked', id, expectedRevision, now);
+            const snapshot = this.#snapshot();
+            this.#database.exec('COMMIT');
+            return Object.freeze({ ...snapshot, abortActionIds: Object.freeze(abort) });
+        }
+        catch (error) {
+            try {
+                this.#database.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+    }
+    snapshot() { return this.#snapshot(); }
+    close() { if (this.#closed)
+        return; this.#closed = true; try {
+        this.#database.close();
+    }
+    finally {
+        if (this.#parentDescriptor !== undefined)
+            closeSync(this.#parentDescriptor);
+    } }
+}
+//# sourceMappingURL=broker-ledger.js.map