@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/rsi-authority-resources.js

@@ -0,0 +1,139 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID } from 'node:crypto';
+import { lstat, mkdir, readdir, realpath, rm } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io } from './rsi-build.js';
+export const rsiAuthorityRoles = ['approval', 'release', 'adoption', 'observation', 'qualification', 'host',
+    'pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+function fail(message) { throw new Error(`rsi authority resources: ${message}`); }
+async function readPrivate(path, maximum) {
+    const item = await lstat(path);
+    if (!item.isFile() || item.nlink !== 1 || await realpath(path) !== path)
+        fail(`unsafe file: ${path}`);
+    return io.readStable(path, maximum, true);
+}
+function locations(home, profile) {
+    const root = join(home, 'rsi-authorities', profile);
+    return { root, keys: join(root, 'identities'), stateRoot: join(root, 'state'), configRoot: join(root, 'config'),
+        registryRoot: join(root, 'registry'), catalogPath: join(root, 'catalog.json'), receiptPath: join(root, 'bootstrap.json') };
+}
+async function inspect(home, profile, signal) {
+    const paths = locations(home, profile);
+    await io.directory(paths.root);
+    if (!isDeepStrictEqual((await readdir(paths.root)).sort(), ['bootstrap.json', 'catalog.json', 'config', 'identities', 'registry', 'state']))
+        fail('existing resources are incomplete');
+    const receipt = JSON.parse((await readPrivate(paths.receiptPath, 65_536)).toString('utf8'));
+    const { receiptDigest, ...content } = receipt;
+    const resources = receipt.resources;
+    if (receipt.schemaVersion !== 1 || receipt.dshHome !== home || receipt.profile !== profile
+        || hash(JSON.stringify(content)) !== receiptDigest || resources?.schemaVersion !== 1
+        || resources.root !== paths.root || !uuid.test(resources.installationId) || !uuid.test(resources.ledgerId)
+        || resources.installationId === resources.ledgerId || resources.registry?.id !== `registry-${resources.installationId}`
+        || resources.registry.root !== paths.registryRoot || resources.registry.locator !== pathToFileURL(paths.registryRoot).href
+        || resources.catalog?.id !== `catalog-${resources.installationId}` || resources.catalog.path !== paths.catalogPath
+        || resources.stateRoot !== paths.stateRoot || resources.configRoot !== paths.configRoot
+        || !resources.identities || !receipt.keyDigests
+        || !isDeepStrictEqual(Object.keys(resources.identities).sort(), [...rsiAuthorityRoles].sort())
+        || !isDeepStrictEqual(Object.keys(receipt.keyDigests).sort(), [...rsiAuthorityRoles].sort()))
+        fail('resource receipt differs from the installation');
+    for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot])
+        await io.directory(directory);
+    if (!isDeepStrictEqual((await readdir(paths.keys)).sort(), rsiAuthorityRoles.map(role => `${role}.pem`).sort()))
+        fail('signing identities changed');
+    const publicKeys = new Set();
+    for (const role of rsiAuthorityRoles) {
+        signal.throwIfAborted();
+        const identity = resources.identities[role], expectedAuthority = `${role}-${resources.installationId}`;
+        if (!isDeepStrictEqual(Object.keys(identity).sort(), ['authority', 'keyId', 'keyPath', 'publicKeyPem'])
+            || identity.authority !== expectedAuthority || identity.keyId !== `${expectedAuthority}-key`
+            || identity.keyPath !== join(paths.keys, `${role}.pem`))
+            fail('signing identity binding changed');
+        const bytes = await readPrivate(identity.keyPath, 16_384);
+        const key = createPrivateKey(bytes), publicKey = createPublicKey(key).export({ format: 'pem', type: 'spki' }).toString();
+        if (key.asymmetricKeyType !== 'ed25519' || hash(bytes) !== receipt.keyDigests[role]
+            || publicKey !== identity.publicKeyPem || publicKeys.has(publicKey))
+            fail('signing identity key changed');
+        publicKeys.add(publicKey);
+    }
+    // These are live release resources: validate them, never reset their contents
+    // or compare them with the initial empty catalog/registry/state snapshots.
+    const { parseCatalog } = await import('@dsh-enhanced/plugin-control-plane');
+    parseCatalog(JSON.parse((await readPrivate(paths.catalogPath, 2_097_152)).toString('utf8')));
+    signal.throwIfAborted();
+    return resources;
+}
+/** Caller holds the DSH_HOME lifecycle lock. This creates identities and local
+ * storage, not grants; owner-bound authorization is configured separately. */
+export async function prepareRsiAuthorityResources(input) {
+    const { dshHome: home, profile } = input;
+    if (!isAbsolute(home) || resolve(home) !== home || home.includes('\0') || /[\r\n]/u.test(home)
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(profile))
+        fail('invalid installation binding');
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(30_000)]);
+    signal.throwIfAborted();
+    await io.directory(home, false);
+    const parent = join(home, 'rsi-authorities'), paths = locations(home, profile);
+    if (input.existingOnly) {
+        await io.directory(parent);
+        return inspect(home, profile, signal);
+    }
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    let existing = false;
+    try {
+        await lstat(paths.root);
+        existing = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (existing)
+        return inspect(home, profile, signal);
+    // An exclusive claim prevents overwriting another installation. Failed work
+    // removes only this exact directory; incomplete crash residue is never reset.
+    await mkdir(paths.root, { mode: 0o700 });
+    const claimed = await lstat(paths.root);
+    try {
+        for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot])
+            await mkdir(directory, { mode: 0o700 });
+        const installationId = randomUUID(), ledgerId = randomUUID();
+        const identities = {}, keyDigests = {};
+        for (const role of rsiAuthorityRoles) {
+            signal.throwIfAborted();
+            const pair = generateKeyPairSync('ed25519'), keyPath = join(paths.keys, `${role}.pem`);
+            const privateKey = pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+            await io.writeExclusive(keyPath, privateKey);
+            const authority = `${role}-${installationId}`;
+            identities[role] = { authority, keyId: `${authority}-key`, keyPath,
+                publicKeyPem: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString() };
+            keyDigests[role] = hash(privateKey);
+        }
+        const resources = { schemaVersion: 1, root: paths.root, installationId, ledgerId, identities,
+            registry: { id: `registry-${installationId}`, root: paths.registryRoot, locator: pathToFileURL(paths.registryRoot).href },
+            catalog: { id: `catalog-${installationId}`, path: paths.catalogPath }, stateRoot: paths.stateRoot, configRoot: paths.configRoot };
+        await io.writeExclusive(paths.catalogPath, '{"schemaVersion":1,"entries":[]}\n');
+        const content = { schemaVersion: 1, dshHome: home, profile, resources, keyDigests };
+        await io.writeExclusive(paths.receiptPath, JSON.stringify({ ...content, receiptDigest: hash(JSON.stringify(content)) }));
+        for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot, paths.root, parent])
+            await io.syncDirectory(directory);
+        return await inspect(home, profile, signal);
+    }
+    catch (error) {
+        const current = await lstat(paths.root).catch(() => undefined);
+        if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino)
+            await rm(paths.root, { recursive: true, force: true });
+        await io.syncDirectory(parent);
+        throw error;
+    }
+}
+//# sourceMappingURL=rsi-authority-resources.js.map

package/lib/rsi-authority-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-resources.js","sourceRoot":"","sources":["../src/rsi-authority-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM;IACzG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAU,CAAA;AAYvG,MAAM,IAAI,GAAG,wEAAwE,CAAA;AACrF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAEhG,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACtD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;IACrG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AACD,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACnD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC7G,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAA;AAC9H,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,MAAmB;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACtL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IACtG,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;WACrF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa,IAAI,SAAS,EAAE,aAAa,KAAK,CAAC;WACjF,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;WACvG,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,YAAY,SAAS,CAAC,cAAc,EAAE;WACpH,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,KAAK,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI;WACvH,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,WAAW,SAAS,CAAC,cAAc,EAAE,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW;WAC/G,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACpF,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU;WAC5C,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;WAC3F,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACtJ,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC1H,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACnJ,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,GAAG,IAAI,IAAI,SAAS,CAAC,cAAc,EAAE,CAAA;QACtG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;eAClG,QAAQ,CAAC,SAAS,KAAK,iBAAiB,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,iBAAiB,MAAM;eACzF,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACnG,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACxH,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;eAC9E,SAAS,KAAK,QAAQ,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC3G,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;IACD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;IAC3E,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC5F,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAElD;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;WACzF,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC3G,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IAClI,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACtI,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpI,MAAM,cAAc,GAAG,UAAU,EAAE,EAAE,QAAQ,GAAG,UAAU,EAAE,CAAA;QAC5D,MAAM,UAAU,GAAG,EAAwC,EAAE,UAAU,GAAG,EAA0B,CAAA;QACpG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;YACtF,MAAM,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,cAAc,EAAE,CAAA;YAC7C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,SAAS,MAAM,EAAE,OAAO;gBAChE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAA;YACnF,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,SAAS,GAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU;YACjH,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;YACzH,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;QACnI,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAA;QAChF,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAC5F,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxH,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAClJ,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChJ,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/rsi-authority-runtime.d.ts

@@ -0,0 +1,50 @@
+export interface Pin {
+    path: string;
+    sha256: string;
+}
+declare const PHASES: readonly ["pr", "review", "merge", "build", "sign", "publish", "registry-verify", "catalog-admission"];
+type Phase = typeof PHASES[number];
+type Executable = 'approval' | 'release' | 'adoption' | 'observation' | 'qualification' | 'hostAuthority' | 'hostAttestor';
+export interface RsiAuthorityRuntime {
+    schemaVersion: 1;
+    packageVersion: string;
+    root: string;
+    node: Pin;
+    executables: Record<Executable, Pin>;
+    releaseAdapters: Record<Phase, Pin>;
+    processHelper: Pin;
+    observerClient: Pin;
+    catalogValidator: Pin;
+    catalogInterpreter: Pin;
+}
+interface Options {
+    packageRoot?: string;
+    nodePath?: string;
+}
+/** Read a copied runtime receipt through its physical stage path, retaining
+ * the logical paths embedded in the original installation. */
+export declare function readRsiAuthorityRuntimeReceipt(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}): Promise<{
+    runtime: RsiAuthorityRuntime;
+    receiptDigest: string;
+}>;
+/** Replace only the copied runtime under a stopped Home stage. The receipt and
+ * shebangs keep their logical Home paths, so the transaction can rename Home. */
+export declare function replaceRsiAuthorityRuntimeInStage(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}, options?: Options): Promise<RsiAuthorityRuntime>;
+/** Caller holds the home lifecycle lock. Only this function's stage/final claim is removed on failure. */
+export declare function prepareRsiAuthorityRuntime(input: {
+    dshHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}, options?: Options): Promise<RsiAuthorityRuntime>;
+export {};
+//# sourceMappingURL=rsi-authority-runtime.d.ts.map

package/lib/rsi-authority-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-runtime.d.ts","sourceRoot":"","sources":["../src/rsi-authority-runtime.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,GAAG;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACrD,QAAA,MAAM,MAAM,wGAAyG,CAAA;AACrH,KAAK,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAClC,KAAK,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,cAAc,CAAA;AAC1H,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,GAAG,CAAA;IACT,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IACpC,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACnC,aAAa,EAAE,GAAG,CAAA;IAClB,cAAc,EAAE,GAAG,CAAA;IACnB,gBAAgB,EAAE,GAAG,CAAA;IACrB,kBAAkB,EAAE,GAAG,CAAA;CACxB;AAID,UAAU,OAAO;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AA8J7D;8DAC8D;AAC9D,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,mBAAmB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAcnE;AAED;iFACiF;AACjF,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,EAAE,OAAO,GAAE,OAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4DtD;AAED,0GAA0G;AAC1G,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,EAChH,OAAO,GAAE,OAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiErD"}

package/lib/rsi-authority-runtime.js

@@ -0,0 +1,393 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io } from './rsi-build.js';
+import { version } from './version.js';
+const PHASES = ['pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+const EXECUTABLES = {
+    approval: 'dsh-source-approval-authority.js', release: 'dsh-source-release-authority.js',
+    adoption: 'dsh-source-adoption-authority.js', observation: 'dsh-task-observation-authority.js',
+    qualification: 'dsh-live-qualification-authority.js', hostAuthority: 'dsh-systemd-host-authority.js',
+    hostAttestor: 'dsh-systemd-host-attestor.js',
+};
+const MAX_ENTRIES = 512, MAX_FILE = 160_000_000, MAX_TOTAL = 256_000_000;
+const CONTRACT_PACKAGE = '@dsh-enhanced/assistant-growth-contract';
+const CONTRACT_ROOT = `node_modules/${CONTRACT_PACKAGE}`;
+const RUNTIME_DIRECTORIES = ['bin', 'lib', 'node_modules', 'node_modules/@dsh-enhanced', CONTRACT_ROOT, `${CONTRACT_ROOT}/lib`];
+function fail(message) { throw new Error(`rsi authority runtime: ${message}`); }
+function hash(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function exactPath(path) {
+    return isAbsolute(path) && resolve(path) === path
+        && !path.includes('\0') && !path.includes('\r') && !path.includes('\n');
+}
+function environment(home) { return { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home }; }
+function pin(root, path, sha256) { return { path: join(root, path), sha256 }; }
+function result(root, entries) {
+    const found = (path) => {
+        const item = entries.find(entry => entry.path === path);
+        if (!item)
+            fail(`missing asset: ${path}`);
+        return pin(root, path, item.sha256);
+    };
+    const executables = {};
+    for (const [key, filename] of Object.entries(EXECUTABLES))
+        executables[key] = found(`bin/${filename}`);
+    const releaseAdapters = {};
+    for (const phase of PHASES)
+        releaseAdapters[phase] = found(`bin/dsh-local-release-${phase}.js`);
+    return { schemaVersion: 1, packageVersion: version, root, node: found('node'), executables, releaseAdapters,
+        processHelper: found('lib/adapter-process.js'), observerClient: found('lib/runtime-observer-protocol.js'),
+        catalogValidator: found('lib/catalog.js'), catalogInterpreter: found('lib/catalog-interpreter.js') };
+}
+async function asset(path, maximum, signal) {
+    signal.throwIfAborted();
+    const bytes = await io.readStable(path, maximum, false, true);
+    signal.throwIfAborted();
+    return bytes;
+}
+async function sourceAssets(packageRoot, nodePath, signal) {
+    await io.directory(packageRoot, false);
+    await io.directory(join(packageRoot, 'bin'), false);
+    await io.directory(join(packageRoot, 'lib'), false);
+    const packageBytes = await asset(join(packageRoot, 'package.json'), 65_536, signal);
+    const manifest = JSON.parse(packageBytes.toString('utf8'));
+    if (manifest.name !== '@dsh-enhanced/plugin-control-plane' || manifest.version !== version || manifest.type !== 'module')
+        fail('installed package identity differs');
+    if (typeof manifest.dependencies?.[CONTRACT_PACKAGE] !== 'string')
+        fail('installed shared contract is not declared');
+    const libraries = (await readdir(join(packageRoot, 'lib'))).filter(name => name.endsWith('.js')).sort();
+    if (!libraries.length || libraries.length + 19 > MAX_ENTRIES)
+        fail('library entry bound exceeded');
+    const names = new Map([['package.json', join(packageRoot, 'package.json')], ['node', nodePath]]);
+    for (const name of libraries)
+        names.set(`lib/${name}`, join(packageRoot, 'lib', name));
+    for (const name of Object.values(EXECUTABLES))
+        names.set(`bin/${name}`, join(packageRoot, 'bin', name));
+    for (const phase of PHASES)
+        names.set(`bin/dsh-local-release-${phase}.js`, join(packageRoot, 'bin', 'dsh-local-release-adapter.js'));
+    // Resolve through this package's manifest, but accept only its own dependency
+    // edge or the adjacent edge in the same pnpm virtual-store node_modules.
+    const resolvedContract = createRequire(join(packageRoot, 'package.json')).resolve(`${CONTRACT_PACKAGE}/package.json`);
+    const contractRoot = dirname(await realpath(resolvedContract));
+    const edges = [join(packageRoot, 'node_modules', CONTRACT_PACKAGE)];
+    if (basename(dirname(packageRoot)) === '@dsh-enhanced' && basename(dirname(dirname(packageRoot))) === 'node_modules'
+        && basename(dirname(dirname(dirname(dirname(packageRoot))))) === '.pnpm') {
+        edges.push(join(dirname(packageRoot), 'assistant-growth-contract'));
+    }
+    const edgeRoots = await Promise.all(edges.map(async (edge) => realpath(edge).catch(() => undefined)));
+    if (!edgeRoots.includes(contractRoot))
+        fail('installed shared contract resolved outside its dependency edge');
+    await io.directory(contractRoot, false);
+    await io.directory(join(contractRoot, 'lib'), false);
+    const contractPackageBytes = await asset(join(contractRoot, 'package.json'), 65_536, signal);
+    const contractManifest = JSON.parse(contractPackageBytes.toString('utf8'));
+    if (contractManifest.name !== CONTRACT_PACKAGE || contractManifest.version !== version || contractManifest.type !== 'module'
+        || Object.keys(contractManifest.dependencies ?? {}).length || Object.keys(contractManifest.optionalDependencies ?? {}).length) {
+        fail('installed shared contract identity or dependency boundary differs');
+    }
+    names.set(`${CONTRACT_ROOT}/package.json`, join(contractRoot, 'package.json'));
+    const contractLibraries = (await readdir(join(contractRoot, 'lib'))).filter(name => name.endsWith('.js')).sort();
+    if (!contractLibraries.includes('index.js') || names.size + contractLibraries.length > MAX_ENTRIES)
+        fail('shared contract entry bound exceeded');
+    for (const name of contractLibraries)
+        names.set(`${CONTRACT_ROOT}/lib/${name}`, join(contractRoot, 'lib', name));
+    const files = [];
+    let total = 0;
+    for (const [path, sourcePath] of names) {
+        const bytes = path === 'package.json' ? packageBytes : path === `${CONTRACT_ROOT}/package.json`
+            ? contractPackageBytes : await asset(sourcePath, MAX_FILE, signal);
+        total += bytes.length;
+        if (total > MAX_TOTAL)
+            fail('asset byte bound exceeded');
+        const sourceMode = (await lstat(sourcePath)).mode & 0o777;
+        files.push({ path, sourcePath, bytes, sourceSha256: hash(bytes), sourceMode });
+    }
+    const node = files.find(file => file.path === 'node').bytes;
+    if (!node.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
+        fail('Node interpreter is not native ELF');
+    const nodeVersion = await io.command(nodePath, ['--version'], environment(packageRoot), signal, 10_000, 1024);
+    const match = /^v(\d+)\.(\d+)\.(\d+)$/u.exec(nodeVersion);
+    if (!match || !(Number(match[1]) === 22 && Number(match[2]) >= 19 || Number(match[1]) >= 24))
+        fail('Node version is outside package engines');
+    return files;
+}
+async function verifySources(files, signal) {
+    const seen = new Set();
+    for (const file of files) {
+        if (seen.has(file.sourcePath))
+            continue;
+        seen.add(file.sourcePath);
+        if (hash(await asset(file.sourcePath, MAX_FILE, signal)) !== file.sourceSha256
+            || ((await lstat(file.sourcePath)).mode & 0o777) !== file.sourceMode)
+            fail('installed source changed');
+    }
+}
+function deployedBytes(file, root) {
+    if (file.path === 'package.json')
+        return Buffer.from('{"type":"module"}\n');
+    if (!file.path.startsWith('bin/'))
+        return file.bytes;
+    const first = file.bytes.toString('utf8', 0, 128).split('\n', 1)[0] ?? '';
+    if (!first.startsWith('#!'))
+        fail('CLI has no shebang');
+    return Buffer.concat([Buffer.from(`#!${join(root, 'node')}\n`), file.bytes.subarray(Buffer.byteLength(first) + 1)]);
+}
+async function writeFile(path, bytes, mode) {
+    const fd = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode);
+    try {
+        await fd.writeFile(bytes);
+        await fd.chmod(mode);
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function verifyTree(root, entries, signal) {
+    await io.directory(root);
+    const expected = new Map(entries.map(item => [item.path, item]));
+    const visit = async (folder, relative = '') => {
+        signal.throwIfAborted();
+        const names = await readdir(folder);
+        for (const name of names) {
+            const path = relative ? `${relative}/${name}` : name;
+            const full = join(root, path), item = await lstat(full);
+            if (item.isSymbolicLink() || item.nlink !== 1 && item.isFile() || process.getuid && item.uid !== process.getuid())
+                fail('deployed asset is linked or unowned');
+            if (item.isDirectory()) {
+                if (!RUNTIME_DIRECTORIES.includes(path) || !entries.some(entry => entry.path.startsWith(`${path}/`))
+                    || (item.mode & 0o777) !== 0o700)
+                    fail('unexpected runtime directory');
+                await visit(full, path);
+            }
+            else if (item.isFile()) {
+                if (path === 'receipt.json')
+                    continue;
+                const entry = expected.get(path);
+                if (!entry || item.size !== entry.size || (item.mode & 0o777) !== entry.mode
+                    || hash(await asset(full, MAX_FILE, signal)) !== entry.sha256)
+                    fail(`deployed asset changed: ${path}`);
+                expected.delete(path);
+            }
+            else
+                fail('nonregular runtime entry');
+        }
+    };
+    await visit(root);
+    if (expected.size)
+        fail('deployed asset missing');
+    const receipt = await lstat(join(root, 'receipt.json'));
+    if (!receipt.isFile() || receipt.nlink !== 1 || (receipt.mode & 0o777) !== 0o600)
+        fail('unsafe receipt');
+}
+async function verifyRuntime(runtime, signal) {
+    const env = environment(runtime.root);
+    const modules = ['source-approval-authority', 'source-release-authority', 'source-adoption-authority',
+        'task-observation-authority', 'live-qualification-authority', 'systemd-host-authority',
+        'runtime-observer-protocol', 'adapter-process'];
+    const urls = modules.map(name => pathToFileURL(join(runtime.root, 'lib', `${name}.js`)).href);
+    const script = `await Promise.all(${JSON.stringify(urls)}.map(url => import(url)))`;
+    await io.command(runtime.node.path, ['--input-type=module', '--eval', script], env, signal, 10_000, 4096);
+    for (const [key, spec] of [['hostAttestor', runtime.executables.hostAttestor], ...Object.entries(runtime.releaseAdapters)]) {
+        const expected = key === 'hostAttestor' ? 'dsh-systemd-host-attestor-8' : 'dsh-local-release-adapter-1';
+        const output = await io.command(runtime.node.path, [spec.path, '--version'], env, signal, 10_000, 4096);
+        if (output !== expected)
+            fail(`CLI version check failed: ${key}`);
+    }
+}
+/** Read a copied runtime receipt through its physical stage path, retaining
+ * the logical paths embedded in the original installation. */
+export async function readRsiAuthorityRuntimeReceipt(input) {
+    const { logicalHome, physicalHome, profile } = input;
+    if (!exactPath(logicalHome) || !exactPath(physicalHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(profile))
+        fail('invalid copied runtime binding');
+    const root = join(physicalHome, 'rsi-authority-runtimes', profile);
+    const source = await io.readStable(join(root, 'receipt.json'), 65_536, true);
+    const receipt = JSON.parse(source.toString('utf8'));
+    const { digest, ...body } = receipt;
+    if (receipt.schemaVersion !== 1 || receipt.root !== join(logicalHome, 'rsi-authority-runtimes', profile)
+        || !Array.isArray(receipt.entries) || receipt.entries.length > MAX_ENTRIES
+        || !/^[a-f0-9]{64}$/u.test(digest) || hash(JSON.stringify(body)) !== digest)
+        fail('copied runtime receipt differs');
+    const signal = input.signal ?? new AbortController().signal;
+    await verifyTree(root, receipt.entries, signal);
+    const { entries: _entries, ...runtime } = body;
+    return { runtime, receiptDigest: hash(source) };
+}
+/** Replace only the copied runtime under a stopped Home stage. The receipt and
+ * shebangs keep their logical Home paths, so the transaction can rename Home. */
+export async function replaceRsiAuthorityRuntimeInStage(input, options = {}) {
+    const previous = await readRsiAuthorityRuntimeReceipt(input);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(120_000)]);
+    const parent = join(input.physicalHome, 'rsi-authority-runtimes');
+    await io.directory(parent);
+    const final = join(input.logicalHome, 'rsi-authority-runtimes', input.profile);
+    if (previous.runtime.root !== final)
+        fail('previous runtime root changed');
+    const physical = join(parent, input.profile);
+    const packageRoot = options.packageRoot ?? dirname(createRequire(import.meta.url).resolve('@dsh-enhanced/plugin-control-plane/package.json'));
+    const nodePath = await realpath(options.nodePath ?? process.execPath);
+    if (!exactPath(packageRoot) || !exactPath(nodePath))
+        fail('source paths must be canonical');
+    const files = await sourceAssets(packageRoot, nodePath, signal);
+    const logicalSourcePath = (path) => path === input.physicalHome ? input.logicalHome
+        : path.startsWith(`${input.physicalHome}${sep}`)
+            ? join(input.logicalHome, relative(input.physicalHome, path)) : path;
+    const entries = files.map(file => {
+        const bytes = deployedBytes(file, final);
+        return { path: file.path, sha256: hash(bytes), size: bytes.length,
+            mode: file.path === 'node' || file.path.startsWith('bin/') ? 0o700 : 0o600,
+            sourcePath: logicalSourcePath(file.sourcePath), sourceSha256: file.sourceSha256,
+            sourceSize: file.bytes.length, sourceMode: file.sourceMode };
+    }).sort((a, b) => a.path.localeCompare(b.path));
+    const runtime = result(final, entries);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-update-`));
+    const backup = await mkdtemp(join(parent, `.${input.profile}-previous-`));
+    await rm(backup, { recursive: true });
+    let moved = false;
+    try {
+        await chmod(stage, 0o700);
+        for (const directory of RUNTIME_DIRECTORIES)
+            await mkdir(join(stage, directory), { mode: 0o700 });
+        for (const file of files) {
+            const entry = entries.find(item => item.path === file.path);
+            await writeFile(join(stage, file.path), deployedBytes(file, final), entry.mode);
+        }
+        await verifySources(files, signal);
+        const body = { ...runtime, entries };
+        await writeFile(join(stage, 'receipt.json'), Buffer.from(JSON.stringify({ ...body, digest: hash(JSON.stringify(body)) })), 0o600);
+        await verifyTree(stage, entries, signal);
+        for (const directory of [...RUNTIME_DIRECTORIES].reverse())
+            await io.syncDirectory(join(stage, directory));
+        await io.syncDirectory(stage);
+        await rename(physical, backup);
+        moved = true;
+        try {
+            await rename(stage, physical);
+        }
+        catch (error) {
+            await rename(backup, physical);
+            moved = false;
+            throw error;
+        }
+        const actual = await readRsiAuthorityRuntimeReceipt(input);
+        if (!isDeepStrictEqual(actual.runtime, runtime))
+            fail('replacement runtime differs');
+        await verifyRuntime({ ...runtime, root: physical, node: { ...runtime.node, path: join(physical, 'node') },
+            executables: Object.fromEntries(Object.entries(runtime.executables).map(([key, pin]) => [key, { ...pin, path: join(physical, 'bin', EXECUTABLES[key]) }])),
+            releaseAdapters: Object.fromEntries(Object.entries(runtime.releaseAdapters).map(([key, pin]) => [key, { ...pin, path: join(physical, 'bin', `dsh-local-release-${key}.js`) }])) }, signal);
+        await rm(backup, { recursive: true });
+        return runtime;
+    }
+    catch (error) {
+        if (moved) {
+            await rm(physical, { recursive: true, force: true });
+            await rename(backup, physical);
+        }
+        throw error;
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+        if (!moved)
+            await rm(backup, { recursive: true, force: true });
+    }
+}
+/** Caller holds the home lifecycle lock. Only this function's stage/final claim is removed on failure. */
+export async function prepareRsiAuthorityRuntime(input, options = {}) {
+    if (!exactPath(input.dshHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(input.profile))
+        fail('invalid home or profile');
+    if (process.platform !== 'linux')
+        fail('Linux is required');
+    await io.directory(input.dshHome, false);
+    const packageRoot = options.packageRoot ?? dirname(createRequire(import.meta.url).resolve('@dsh-enhanced/plugin-control-plane/package.json'));
+    const nodePath = await realpath(options.nodePath ?? process.execPath);
+    if (!exactPath(packageRoot) || !exactPath(nodePath))
+        fail('source paths must be canonical');
+    const parent = join(input.dshHome, 'rsi-authority-runtimes');
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    const final = join(parent, input.profile);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(120_000)]);
+    const files = await sourceAssets(packageRoot, nodePath, signal);
+    const entries = files.map(file => {
+        const bytes = deployedBytes(file, final);
+        return { path: file.path, sha256: hash(bytes), size: bytes.length,
+            mode: file.path === 'node' || file.path.startsWith('bin/') ? 0o700 : 0o600,
+            sourcePath: file.sourcePath, sourceSha256: file.sourceSha256, sourceSize: file.bytes.length, sourceMode: file.sourceMode };
+    }).sort((a, b) => a.path.localeCompare(b.path));
+    const runtime = result(final, entries);
+    try {
+        await lstat(final);
+        const receipt = JSON.parse((await io.readStable(join(final, 'receipt.json'), 65_536, true)).toString('utf8'));
+        const { digest, ...body } = receipt;
+        if (hash(JSON.stringify(body)) !== digest || !isDeepStrictEqual(body, { ...runtime, entries }))
+            fail('runtime differs from receipt');
+        await verifyTree(final, entries, signal);
+        await verifySources(files, signal);
+        await verifyRuntime(runtime, signal);
+        return runtime;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        try {
+            await lstat(final);
+            fail('existing runtime is incomplete');
+        }
+        catch (found) {
+            if (found.code !== 'ENOENT')
+                throw found;
+        }
+    }
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    let claimed;
+    try {
+        await chmod(stage, 0o700);
+        for (const directory of RUNTIME_DIRECTORIES)
+            await mkdir(join(stage, directory), { mode: 0o700 });
+        for (const file of files) {
+            signal.throwIfAborted();
+            const entry = entries.find(item => item.path === file.path);
+            await writeFile(join(stage, file.path), deployedBytes(file, final), entry.mode);
+        }
+        await verifySources(files, signal);
+        const body = { ...runtime, entries };
+        await writeFile(join(stage, 'receipt.json'), Buffer.from(JSON.stringify({ ...body, digest: hash(JSON.stringify(body)) })), 0o600);
+        for (const directory of [...RUNTIME_DIRECTORIES].reverse())
+            await io.syncDirectory(join(stage, directory));
+        await io.syncDirectory(stage);
+        signal.throwIfAborted();
+        await mkdir(final, { mode: 0o700 });
+        const identity = await lstat(final);
+        claimed = { dev: identity.dev, ino: identity.ino };
+        for (const name of ['bin', 'lib', 'node_modules', 'node', 'package.json', 'receipt.json'])
+            await rename(join(stage, name), join(final, name));
+        await verifyTree(final, entries, signal);
+        await verifyRuntime(runtime, signal);
+        await io.syncDirectory(parent);
+        return runtime;
+    }
+    catch (error) {
+        if (claimed) {
+            const current = await lstat(final).catch(() => undefined);
+            if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino)
+                await rm(final, { recursive: true, force: true });
+        }
+        throw error;
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+        await io.syncDirectory(parent);
+    }
+}
+//# sourceMappingURL=rsi-authority-runtime.js.map