@dsh-enhanced/plugin-control-plane 0.1.47 → 0.1.49

package/lib/host-inputs.js

@@ -0,0 +1,162 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, realpath, rename, unlink } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+const maximumInputBytes = 64n * 1024n * 1024n;
+function insideProfile(profilePath, physical) {
+    const inside = relative(profilePath, physical);
+    if (!inside || inside === '..' || inside.startsWith(`..${sep}`) || isAbsolute(inside))
+        throw new Error('Host input escapes profile');
+    return inside;
+}
+function validInput(input) {
+    if (!input || input.includes('\\') || input.includes('\0') || isAbsolute(input)
+        || input.split('/').some(part => !part || part === '.' || part === '..'))
+        throw new Error('Host input path is invalid');
+}
+function trustedFile(stat) {
+    const uid = process.getuid?.();
+    return stat.isFile() && stat.size <= maximumInputBytes && (stat.mode & 18n) === 0n
+        && (stat.mode & 3584n) === 0n && (uid === undefined || stat.uid === 0n || stat.uid === BigInt(uid));
+}
+/**
+ * Break pnpm-style hardlinks only for signed, declared inputs. The caller holds
+ * the profile mutation lock; directory-descriptor paths keep every write in
+ * the already-open private profile directory if a pathname is swapped.
+ */
+export async function materializeHostInputFiles(profilePath, inputs) {
+    if (!isAbsolute(profilePath) || resolve(profilePath) !== profilePath || await realpath(profilePath) !== profilePath) {
+        throw new Error('Host input profile is not canonical');
+    }
+    if (inputs.length < 1 || inputs.length > 128)
+        throw new Error('Host input count is invalid');
+    const physicalPaths = new Set();
+    let copiedBytes = 0n;
+    for (const input of inputs) {
+        validInput(input);
+        const logical = join(profilePath, input), physical = await realpath(logical);
+        insideProfile(profilePath, physical);
+        if (physicalPaths.has(physical))
+            throw new Error('Host inputs alias the same file');
+        physicalPaths.add(physical);
+        const parent = dirname(physical);
+        if (await realpath(parent) !== parent)
+            throw new Error('Host input parent is not canonical');
+        const directory = await open(parent, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        let temporary;
+        try {
+            const directoryStat = await directory.stat({ bigint: true }), uid = process.getuid?.();
+            if (!directoryStat.isDirectory() || (directoryStat.mode & 18n) !== 0n
+                || (uid !== undefined && directoryStat.uid !== 0n && directoryStat.uid !== BigInt(uid))) {
+                throw new Error('Host input parent is not a trusted directory');
+            }
+            // /proc/self/fd anchors both rename operands to the opened directory,
+            // so a concurrent parent symlink swap cannot redirect writes outside it.
+            const anchored = `/proc/self/fd/${directory.fd}`;
+            if (await realpath(anchored) !== parent)
+                throw new Error('Host input parent changed before copy');
+            const target = join(anchored, basename(physical));
+            const pathname = await lstat(target, { bigint: true });
+            if (!trustedFile(pathname))
+                throw new Error('Host input is not a trusted regular file');
+            const source = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            try {
+                const before = await source.stat({ bigint: true });
+                if (before.dev !== pathname.dev || before.ino !== pathname.ino || before.size !== pathname.size
+                    || before.mtimeNs !== pathname.mtimeNs || before.ctimeNs !== pathname.ctimeNs)
+                    throw new Error('Host input changed before copy');
+                if (before.nlink === 1n)
+                    continue;
+                copiedBytes += before.size;
+                if (copiedBytes > 512n * 1024n * 1024n)
+                    throw new Error('Host input materialization byte budget exceeded');
+                const bytes = await source.readFile(), after = await source.stat({ bigint: true });
+                if (BigInt(bytes.length) !== before.size || after.dev !== before.dev || after.ino !== before.ino
+                    || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) {
+                    throw new Error('Host input changed during copy');
+                }
+                temporary = join(anchored, `.dsh-host-input-${randomUUID()}`);
+                const copy = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+                try {
+                    await copy.writeFile(bytes);
+                    await copy.chmod(Number(before.mode & 511n));
+                    const copied = await copy.stat({ bigint: true });
+                    if (!copied.isFile() || copied.nlink !== 1n || copied.size !== before.size)
+                        throw new Error('Host input copy is incomplete');
+                    await copy.sync();
+                }
+                finally {
+                    await copy.close();
+                }
+                const current = await lstat(target, { bigint: true });
+                if (current.dev !== before.dev || current.ino !== before.ino || current.size !== before.size
+                    || current.mtimeNs !== before.mtimeNs || current.ctimeNs !== before.ctimeNs
+                    || await realpath(anchored) !== parent || await realpath(logical) !== physical
+                    || await realpath(profilePath) !== profilePath) {
+                    throw new Error('Host input changed before atomic replacement');
+                }
+                await rename(temporary, target);
+                temporary = undefined;
+                await directory.sync();
+                const detached = await lstat(target, { bigint: true });
+                if (!trustedFile(detached) || detached.nlink !== 1n || detached.size !== before.size
+                    || await realpath(anchored) !== parent || await realpath(logical) !== physical) {
+                    throw new Error('Host input changed after atomic replacement');
+                }
+            }
+            finally {
+                await source.close();
+            }
+        }
+        finally {
+            try {
+                if (temporary !== undefined) {
+                    await unlink(temporary).catch(error => {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    });
+                    await directory.sync();
+                }
+            }
+            finally {
+                await directory.close();
+            }
+        }
+    }
+}
+/** Capture declared deployment inputs before a staged profile can reach its Host. */
+export async function captureHostInputFiles(profilePath, finalProfilePath, inputs) {
+    if (!isAbsolute(profilePath) || resolve(profilePath) !== profilePath || await realpath(profilePath) !== profilePath
+        || !isAbsolute(finalProfilePath) || resolve(finalProfilePath) !== finalProfilePath)
+        throw new Error('Host input profile is not canonical');
+    const captured = [];
+    for (const input of inputs) {
+        validInput(input);
+        const logical = join(profilePath, input), physical = await realpath(logical);
+        const inside = insideProfile(profilePath, physical);
+        const pathname = await lstat(physical, { bigint: true }), uid = process.getuid?.();
+        if (!trustedFile(pathname) || pathname.nlink !== 1n
+            || (uid !== undefined && pathname.uid !== 0n && pathname.uid !== BigInt(uid)))
+            throw new Error('Host input is not a trusted regular file');
+        const handle = await open(physical, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const before = await handle.stat({ bigint: true });
+            if (before.dev !== pathname.dev || before.ino !== pathname.ino || before.size !== pathname.size
+                || before.mtimeNs !== pathname.mtimeNs || before.ctimeNs !== pathname.ctimeNs)
+                throw new Error('Host input changed before read');
+            const bytes = await handle.readFile(), after = await handle.stat({ bigint: true }), linked = await lstat(physical, { bigint: true });
+            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs
+                || before.ctimeNs !== after.ctimeNs || BigInt(bytes.length) !== before.size || before.dev !== linked.dev
+                || before.ino !== linked.ino || await realpath(logical) !== physical)
+                throw new Error('Host input changed during read');
+            captured.push({ input, path: join(finalProfilePath, inside), sha256: createHash('sha256').update(bytes).digest('hex') });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    if (new Set(captured.map(file => file.path)).size !== captured.length)
+        throw new Error('Host inputs alias the same file');
+    return captured;
+}
+//# sourceMappingURL=host-inputs.js.map

package/lib/host-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-inputs.js","sourceRoot":"","sources":["../src/host-inputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEvF,MAAM,iBAAiB,GAAG,GAAG,GAAG,KAAK,GAAG,KAAK,CAAA;AAE7C,SAAS,aAAa,CAAC,WAAmB,EAAE,QAAgB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACpI,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;WAC1E,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AAC3H,CAAC;AAED,SAAS,WAAW,CAAC,IAAoE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,EAAE;WAChF,CAAC,IAAI,CAAC,IAAI,GAAG,KAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACzG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,WAAmB,EAAE,MAAyB;IAC5F,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC5F,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,KAAK,CAAC,CAAA;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5E,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QACpC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACnF,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChC,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACvG,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;YACtF,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,EAAE;mBACnE,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,KAAK,EAAE,IAAI,aAAa,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACjE,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,QAAQ,GAAG,iBAAiB,SAAS,CAAC,EAAE,EAAE,CAAA;YAChD,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACjG,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACtD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACnG,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClD,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;uBAC1F,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;gBAClI,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;oBAAE,SAAQ;gBACjC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAA;gBAC1B,IAAI,WAAW,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBAC1G,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;uBAC3F,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;oBACxG,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;gBACnD,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,UAAU,EAAE,EAAE,CAAC,CAAA;gBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;gBAC3H,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;oBAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,IAAM,CAAC,CAAC,CAAA;oBAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;oBAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;oBAC5H,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBACnB,CAAC;wBAAS,CAAC;oBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBACrD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;uBACvF,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;uBACxE,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;uBAC3E,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;gBACjE,CAAC;gBACD,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC/B,SAAS,GAAG,SAAS,CAAA;gBACrB,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;gBACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBACtD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;uBAC/E,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjF,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;gBAChE,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;wBACpC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,KAAK,CAAA;oBACrE,CAAC,CAAC,CAAA;oBACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;gBACxB,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB,EAAE,gBAAwB,EAAE,MAAyB;IAGlH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW;WAC9G,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC5I,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,KAAK,CAAC,CAAA;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;QAClF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE;eAC9C,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC5I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACrG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAClD,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;mBAC1F,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAClI,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACpI,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;mBACrH,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;mBACrG,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACzH,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC1H,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACzH,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/lib/host-maintenance.d.ts

@@ -0,0 +1,61 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { HostAttestationReceipt, HostInputWitness, PluginActivationPlan } from './types.js';
+type Pin = {
+    path: string;
+    sha256: string | null;
+};
+type DeploymentPin = {
+    input: string;
+    path: string;
+    sha256: string;
+};
+export interface HostMaintenanceSnapshot {
+    executor: PluginActivationPlan['executor'];
+    profileFiles: readonly Pin[];
+    baselineFiles: readonly Pin[];
+    deploymentFiles: readonly DeploymentPin[];
+    baselineDeploymentFiles: readonly DeploymentPin[];
+    unitProperties: Record<string, string>;
+}
+export interface HostMaintenanceRecord {
+    schemaVersion: 1;
+    kind: 'dsh-host-maintenance';
+    transactionId: string;
+    installationId: string;
+    ledger: PluginActivationPlan['ledger'];
+    profile: {
+        name: string;
+        path: string;
+    };
+    plan: {
+        id: string;
+        digest: string;
+    };
+    activation: {
+        id: string;
+        fence: number;
+    };
+    predecessor: {
+        operationId: string;
+        receiptDigest: string;
+        hostGeneration: number;
+    };
+    sequence: number;
+    previousDigest: string | null;
+    before: HostMaintenanceSnapshot;
+    after: HostMaintenanceSnapshot;
+    issuedAt: number;
+    authority: string;
+    keyId: string;
+    publicKeyPem: string;
+    signature: string;
+}
+export declare function hostMaintenanceCanonical(value: unknown): string;
+export declare function hostMaintenanceDigest(value: unknown): string;
+export declare function parseHostMaintenanceRecord(value: unknown): HostMaintenanceRecord;
+export declare function signHostMaintenanceRecord(input: Omit<HostMaintenanceRecord, 'publicKeyPem' | 'signature'>, privateKeyPem: string): HostMaintenanceRecord;
+/** Anchor every maintenance chain in the already applied original readiness key. */
+export declare function verifyHostMaintenanceChain(records: readonly HostMaintenanceRecord[], plan: PluginActivationPlan, readiness: HostAttestationReceipt, witness: HostInputWitness): readonly HostMaintenanceRecord[];
+export declare function readHostMaintenanceRecords(database: DatabaseSync, planId: string): HostMaintenanceRecord[];
+export {};
+//# sourceMappingURL=host-maintenance.d.ts.map

package/lib/host-maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-maintenance.d.ts","sourceRoot":"","sources":["../src/host-maintenance.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEhG,KAAK,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAClD,KAAK,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AACpE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAA;IAC1C,YAAY,EAAE,SAAS,GAAG,EAAE,CAAA;IAC5B,aAAa,EAAE,SAAS,GAAG,EAAE,CAAA;IAC7B,eAAe,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,uBAAuB,EAAE,SAAS,aAAa,EAAE,CAAA;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC;AACD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACtC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,WAAW,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IACnF,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,MAAM,EAAE,uBAAuB,CAAA;IAC/B,KAAK,EAAE,uBAAuB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM/D;AACD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAsF;AAoCnJ,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAyBhF;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,WAAW,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,qBAAqB,CAGxJ;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAC9G,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,qBAAqB,EAAE,CAyBhG;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAO1G"}

package/lib/host-maintenance.js

@@ -0,0 +1,158 @@
+/** Signed, append-only deployment rebasing during an offline managed Host update.
+ * Original plans, approvals and readiness receipts remain unchanged. */
+import { createHash, createPublicKey, sign, verify } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+const unitKeys = ['FragmentPath', 'DropInPaths', 'ExecStart', 'Environment', 'WorkingDirectory', 'User', 'Group', 'Type', 'KillMode'];
+const hex = /^[a-f0-9]{64}$/u;
+function fail() { throw new Error('Host maintenance proof is invalid'); }
+export function hostMaintenanceCanonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(hostMaintenanceCanonical).join(',')}]`;
+    if (typeof value === 'object' && value !== null)
+        return `{${Object.entries(value)
+            .filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${JSON.stringify(key)}:${hostMaintenanceCanonical(item)}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function hostMaintenanceDigest(value) { return createHash('sha256').update(hostMaintenanceCanonical(value)).digest('hex'); }
+function object(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || Object.keys(value).sort().join('\0') !== [...keys].sort().join('\0'))
+        fail();
+    return value;
+}
+function text(value, max = 4096) {
+    if (typeof value !== 'string' || value.length === 0 || Buffer.byteLength(value) > max || value.includes('\0'))
+        fail();
+}
+function path(value) {
+    text(value);
+    if (!isAbsolute(value) || resolve(value) !== value || value === '/')
+        fail();
+}
+function integer(value, min = 1) { if (!Number.isSafeInteger(value) || Number(value) < min)
+    fail(); }
+function digest(value) { if (typeof value !== 'string' || !hex.test(value))
+    fail(); }
+function snapshot(value, root) {
+    const item = object(value, ['executor', 'profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles', 'unitProperties']);
+    const executor = object(item.executor, ['id', 'version', 'path', 'sha256']);
+    text(executor.id);
+    text(executor.version);
+    path(executor.path);
+    digest(executor.sha256);
+    const properties = object(item.unitProperties, unitKeys);
+    for (const value of Object.values(properties))
+        if (typeof value !== 'string' || Buffer.byteLength(value) > 65536 || value.includes('\0'))
+            fail();
+    for (const name of ['profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles']) {
+        const pins = item[name];
+        if (!Array.isArray(pins) || pins.length > 128 || name === 'profileFiles' && pins.length !== 3
+            || name === 'baselineFiles' && ![0, 3].includes(pins.length))
+            fail();
+        const seen = new Set();
+        for (const pin of pins) {
+            const deployment = name.includes('Deployment') || name === 'deploymentFiles';
+            const value = object(pin, deployment ? ['input', 'path', 'sha256'] : ['path', 'sha256']);
+            path(value.path);
+            if (!value.path.startsWith(`${root}/`) || seen.has(value.path))
+                fail();
+            seen.add(value.path);
+            if (deployment)
+                text(value.input);
+            if (value.sha256 !== null || name !== 'baselineFiles')
+                digest(value.sha256);
+        }
+    }
+}
+export function parseHostMaintenanceRecord(value) {
+    if (Buffer.byteLength(JSON.stringify(value)) > 524288)
+        fail();
+    const item = object(value, ['schemaVersion', 'kind', 'transactionId', 'installationId', 'ledger', 'profile', 'plan', 'activation',
+        'predecessor', 'sequence', 'previousDigest', 'before', 'after', 'issuedAt', 'authority', 'keyId', 'publicKeyPem', 'signature']);
+    if (item.schemaVersion !== 1 || item.kind !== 'dsh-host-maintenance')
+        fail();
+    for (const name of ['transactionId', 'installationId', 'authority', 'keyId'])
+        text(item[name], 160);
+    const ledger = object(item.ledger, ['id', 'path']);
+    text(ledger.id);
+    path(ledger.path);
+    const profile = object(item.profile, ['name', 'path']);
+    text(profile.name, 64);
+    path(profile.path);
+    const plan = object(item.plan, ['id', 'digest']);
+    text(plan.id);
+    digest(plan.digest);
+    const activation = object(item.activation, ['id', 'fence']);
+    text(activation.id);
+    integer(activation.fence);
+    const predecessor = object(item.predecessor, ['operationId', 'receiptDigest', 'hostGeneration']);
+    text(predecessor.operationId);
+    digest(predecessor.receiptDigest);
+    integer(predecessor.hostGeneration);
+    integer(item.sequence);
+    integer(item.issuedAt);
+    if (item.sequence === 1 ? item.previousDigest !== null : typeof item.previousDigest !== 'string' || !hex.test(item.previousDigest))
+        fail();
+    snapshot(item.before, profile.path);
+    snapshot(item.after, profile.path);
+    for (const field of ['profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles']) {
+        const identity = (values) => values.map(pin => ({ path: pin.path, ...('input' in pin ? { input: pin.input } : {}) }));
+        if (hostMaintenanceCanonical(identity(item.before[field])) !== hostMaintenanceCanonical(identity(item.after[field])))
+            fail();
+    }
+    if (item.before.executor.id !== item.after.executor.id)
+        fail();
+    text(item.publicKeyPem, 4096);
+    text(item.signature, 256);
+    const { signature, ...unsigned } = item;
+    const key = createPublicKey(item.publicKeyPem);
+    if (key.asymmetricKeyType !== 'ed25519' || !verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), key, Buffer.from(signature, 'base64')))
+        fail();
+    return item;
+}
+export function signHostMaintenanceRecord(input, privateKeyPem) {
+    const unsigned = { ...input, publicKeyPem: createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' }).toString() };
+    return parseHostMaintenanceRecord({ ...unsigned, signature: sign(null, Buffer.from(hostMaintenanceCanonical(unsigned)), privateKeyPem).toString('base64') });
+}
+/** Anchor every maintenance chain in the already applied original readiness key. */
+export function verifyHostMaintenanceChain(records, plan, readiness, witness) {
+    if (records.length > 256 || Buffer.byteLength(JSON.stringify(records)) > 450000
+        || readiness.phase !== 'readiness' || readiness.outcome !== 'passed' || readiness.installationId !== plan.installationId
+        || readiness.planId !== plan.id || readiness.planDigest !== plan.digest || readiness.activationId !== witness.activationId
+        || readiness.fence !== witness.fence || readiness.evidenceDigest !== hostMaintenanceDigest(readiness.evidence))
+        fail();
+    let prior;
+    for (const value of records) {
+        const record = parseHostMaintenanceRecord(value), same = (a, b) => hostMaintenanceDigest(a) === hostMaintenanceDigest(b);
+        if (record.installationId !== plan.installationId || !same(record.ledger, plan.ledger)
+            || record.profile.name !== plan.profile || record.profile.path !== plan.target.profilePath
+            || record.plan.id !== plan.id || record.plan.digest !== plan.digest || record.activation.id !== plan.activation?.id
+            || record.activation.fence !== witness.fence || record.sequence !== (prior?.sequence ?? 0) + 1
+            || record.previousDigest !== (prior ? hostMaintenanceDigest(prior) : null)
+            || record.predecessor.operationId !== readiness.operationId || record.predecessor.receiptDigest !== hostMaintenanceDigest(readiness)
+            || record.predecessor.hostGeneration !== readiness.hostGeneration || record.authority !== readiness.authority
+            || record.keyId !== readiness.keyId || record.issuedAt < readiness.observedAt || record.issuedAt > Date.now()
+            || prior && (record.issuedAt < prior.issuedAt || !same(record.before, prior.after)))
+            fail();
+        const { signature, ...unsigned } = readiness;
+        if (!verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), createPublicKey(record.publicKeyPem), Buffer.from(signature, 'base64')))
+            fail();
+        if (!prior && (!same(record.before.executor, plan.executor) || !same(record.before.profileFiles, witness.profileFiles)
+            || !same(record.before.baselineFiles, plan.activation?.targetBaselineFiles ?? [])
+            || !same(record.before.deploymentFiles, witness.deploymentFiles) || !same(record.before.baselineDeploymentFiles, witness.baselineDeploymentFiles)))
+            fail();
+        prior = record;
+    }
+    return records;
+}
+export function readHostMaintenanceRecords(database, planId) {
+    const rows = database.prepare('SELECT record_json,record_digest,sequence FROM deployment_host_maintenance WHERE plan_id=? ORDER BY sequence').all(planId);
+    return rows.map(row => {
+        const record = parseHostMaintenanceRecord(JSON.parse(String(row.record_json)));
+        if (record.plan.id !== planId || record.sequence !== row.sequence || hostMaintenanceDigest(record) !== row.record_digest)
+            fail();
+        return record;
+    });
+}
+//# sourceMappingURL=host-maintenance.js.map

package/lib/host-maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-maintenance.js","sourceRoot":"","sources":["../src/host-maintenance.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AACrI,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,SAAS,IAAI,KAAY,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA,CAAC,CAAC;AAC/E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9E,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAC/E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAChG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAAc,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AACnJ,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;IACjF,OAAO,KAAgC,CAAA;AACzC,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,GAAG,GAAG,IAAI;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;AACvH,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,IAAI,EAAE,CAAA;AAC1F,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,GAAG,GAAG,CAAC,IAA6B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;IAAE,IAAI,EAAE,CAAA,CAAC,CAAC;AACtI,SAAS,MAAM,CAAC,KAAc,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,CAAA,CAAC,CAAC;AACtH,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACzI,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,EAAE,CAAA;IAChJ,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,CAAU,EAAE,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;eACxF,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,EAAE,CAAA;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,iBAAiB,CAAA;YAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,EAAE,CAAA;YACtE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACpB,IAAI,UAAU;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,eAAe;gBAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM;QAAE,IAAI,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY;QAC/H,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;IACjI,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB;QAAE,IAAI,EAAE,CAAA;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3G,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAChG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAA;IACrG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,IAAI,EAAE,CAAA;IAC1I,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,CAAU,EAAE,CAAC;QAC7G,MAAM,QAAQ,GAAG,CAAC,MAAwC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACvJ,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAmB,EAAE,QAAQ,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IAClK,OAAO,IAAwC,CAAA;AACjD,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,KAAgE,EAAE,aAAqB;IAC/H,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC9H,OAAO,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC9J,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B,CAAC,OAAyC,EAAE,IAA0B,EAC9G,SAAiC,EAAE,OAAyB;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM;WAC1E,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;WACrH,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;WACvH,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,cAAc,KAAK,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IACxH,IAAI,KAAwC,CAAA;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1I,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;eACjF,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;eACvF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;eAChH,MAAM,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;eAC3F,MAAM,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;eACvE,MAAM,CAAC,WAAW,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,SAAS,CAAC;eACjI,MAAM,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;eAC1G,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE;eAC1G,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAC7F,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAClJ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;eACjH,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,IAAI,EAAE,CAAC;eAC9E,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAC5J,KAAK,GAAG,MAAM,CAAA;IAChB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAsB,EAAE,MAAc;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,8GAA8G,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzJ,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,aAAa;YAAE,IAAI,EAAE,CAAA;QAChI,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/host-readiness.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Observe the native launcher's post-audit signal without gating the Control Plane on its presence. */
+export declare function installHostReadiness(ctx: Context, write?: (text: string) => void): void;
+export declare function onHostReady(ctx: Context, callback: () => void): void;
+//# sourceMappingURL=host-readiness.d.ts.map

package/lib/host-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-readiness.d.ts","sourceRoot":"","sources":["../src/host-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAQlD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA6C,GAAG,IAAI,CAE/H;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAcpE"}

package/lib/host-readiness.js

@@ -0,0 +1,22 @@
+const marker = 'dsh-enhanced host ready: v1\n';
+/** Observe the native launcher's post-audit signal without gating the Control Plane on its presence. */
+export function installHostReadiness(ctx, write = text => { process.stderr.write(text); }) {
+    onHostReady(ctx, () => write(marker));
+}
+export function onHostReady(ctx, callback) {
+    ctx.inject(['appReady'], readyCtx => {
+        readyCtx.effect(() => {
+            const appReady = readyCtx.get('appReady');
+            let active = true;
+            let reported = false;
+            const remove = appReady.onReady(() => {
+                if (!active || reported)
+                    return;
+                reported = true;
+                callback();
+            });
+            return () => { active = false; remove(); };
+        }, 'plugin-control-plane.host-readiness');
+    });
+}
+//# sourceMappingURL=host-readiness.js.map

package/lib/host-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-readiness.js","sourceRoot":"","sources":["../src/host-readiness.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,+BAA+B,CAAA;AAM9C,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,QAAgC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;IACvH,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,QAAoB;IAC5D,GAAG,CAAC,MAAM,CAAC,CAAC,UAAmB,CAAC,EAAE,QAAQ,CAAC,EAAE;QAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAmB,CAAwB,CAAA;YACzE,IAAI,MAAM,GAAG,IAAI,CAAA;YACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,MAAM,IAAI,QAAQ;oBAAE,OAAM;gBAC/B,QAAQ,GAAG,IAAI,CAAA;gBACf,QAAQ,EAAE,CAAA;YACZ,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA,CAAC,CAAC,CAAA;QAC3C,CAAC,EAAE,qCAAqC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/index.d.ts

@@ -5,6 +5,11 @@ export declare const name = "dsh-enhanced-plugin-control-plane";
 export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
 export type { NormalizedControlPlaneConfig } from './service.js';
+export type { CreationCapabilityConfig, CreationCapabilityOwner, CreationCapabilityReceipt, CreationCapabilitySourceArchive, CreationCapabilityTaskAssociation } from './creation-capability-types.js';
+export type { CreationCapabilitySourceSnapshot } from './creation-capability-source.js';
+export { inspectCreationCapabilityTaskAssociations } from './creation-capability-feedback.js';
+export type { CreationCapabilityFeedbackInput } from './creation-capability-feedback.js';
+export { validateCreationCapabilityConfig, verifyCreationCapabilityReceipt } from './creation-capability-journal.js';
 export * from './catalog.js';
 export * from './errors.js';
 export * from './source-workspace.js';
@@ -35,9 +40,20 @@ export * from './store.js';
 export * from './types.js';
 export * from './trust.js';
 export type * from './source-job-types.js';
+export { validateSourceBaselineConfig } from './source-baseline.js';
+export type { SourceBaselineConfig } from './source-baseline.js';
+export { parseSourceMaintenanceRecord, signSourceMaintenanceRecord, sourceBaselineChain, sourceMaintenanceDigest, sourceMaintenanceSourceFieldsDigest, verifySourceMaintenanceRecords } from './source-maintenance.js';
+export type { SourceMaintenanceRecord, SourceMaintenanceAnchor } from './source-maintenance.js';
 export type { EnqueueSourceJobInput, SourceJobCaller } from './source-jobs.js';
 export declare function apply(ctx: Context, config: Config): void;
 export default PluginControlPlaneService;
 export type { AdoptionHandoffTerms, AdoptionHandoffRecord } from './adoption-handoff.js';
 export type { AdoptionCoordinatorConfig } from './adoption-coordinator.js';
+export { validateLiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export type { LiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export type { LiveQualificationConfig } from './live-qualification-runtime.js';
+export type { LiveQualificationTerms, LiveQualificationBatch, LiveQualificationReceipt } from './live-qualification.js';
+export { validateSystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export type { SystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export * from './host-maintenance.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,YAAY,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAChE,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC1G,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AACnF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,mBAAmB,6BAA6B,CAAA;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,YAAY,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAA;AACrF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AACjF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,uBAAuB,CAAA;AAC1C,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA;AAExC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,YAAY,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAChE,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,yBAAyB,EACxF,+BAA+B,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAA;AAC5G,YAAY,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAA;AAC7F,YAAY,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAA;AACxF,OAAO,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACpH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC1G,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AACnF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,mBAAmB,6BAA6B,CAAA;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,YAAY,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAA;AACrF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AACjF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,uBAAuB,CAAA;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,uBAAuB,EAC9G,mCAAmC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAA;AACtG,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAC/F,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA;AAExC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAE1E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACzF,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AACvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAChF,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,cAAc,uBAAuB,CAAA"}

package/lib/index.js

@@ -3,6 +3,8 @@ import { version } from './version.js';
 export const name = 'dsh-enhanced-plugin-control-plane';
 export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
+export { inspectCreationCapabilityTaskAssociations } from './creation-capability-feedback.js';
+export { validateCreationCapabilityConfig, verifyCreationCapabilityReceipt } from './creation-capability-journal.js';
 export * from './catalog.js';
 export * from './errors.js';
 export * from './source-workspace.js';
@@ -23,8 +25,13 @@ export * from './sqlite.js';
 export * from './store.js';
 export * from './types.js';
 export * from './trust.js';
+export { validateSourceBaselineConfig } from './source-baseline.js';
+export { parseSourceMaintenanceRecord, signSourceMaintenanceRecord, sourceBaselineChain, sourceMaintenanceDigest, sourceMaintenanceSourceFieldsDigest, verifySourceMaintenanceRecords } from './source-maintenance.js';
 export function apply(ctx, config) {
     new PluginControlPlaneService(ctx, config);
 }
 export default PluginControlPlaneService;
+export { validateLiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export { validateSystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export * from './host-maintenance.js';
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAe,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAGtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAEtF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAGxF,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AAEpF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAI1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAe,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAKrC,OAAO,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAA;AAE7F,OAAO,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACpH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAGtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAEtF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAGxF,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AAEpF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEnE,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,uBAAuB,EAC9G,mCAAmC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAA;AAItG,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA;AAKxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAI5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAEhF,cAAc,uBAAuB,CAAA"}

package/lib/live-qualification-authority.d.ts

@@ -0,0 +1,32 @@
+import { type LiveQualificationReceipt, type LiveQualificationRequest, type LiveQualificationTerms } from './live-qualification.js';
+import type { TaskObservationOwner } from './task-observation-types.js';
+export interface LiveQualificationAuthorityConfig {
+    schemaVersion: 1;
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    statePath: string;
+    controlDatabasePath: string;
+    grant: {
+        id: string;
+        expiresAt: number;
+        maxQualifications: number;
+        owner: TaskObservationOwner;
+        installationId: string;
+        ledger: {
+            id: string;
+            path: string;
+        };
+        profilePath: string;
+        packages: readonly string[];
+        terms: LiveQualificationTerms;
+        receiptTtlMs: number;
+    };
+}
+export declare class LiveQualificationAuthorityError extends Error {
+    constructor();
+}
+export declare function validateLiveQualificationAuthorityConfig(value: unknown): asserts value is LiveQualificationAuthorityConfig;
+export declare function authorizeLiveQualification(configInput: LiveQualificationAuthorityConfig, requestInput: LiveQualificationRequest): Promise<LiveQualificationReceipt>;
+export declare function runLiveQualificationAuthority(argv?: string[]): Promise<void>;
+//# sourceMappingURL=live-qualification-authority.d.ts.map

package/lib/live-qualification-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-qualification-authority.d.ts","sourceRoot":"","sources":["../src/live-qualification-authority.ts"],"names":[],"mappings":"AAOA,OAAO,EAEwB,KAAK,wBAAwB,EAAE,KAAK,wBAAwB,EACzF,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AASvE,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAA;QACV,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB,EAAE,MAAM,CAAA;QACzB,KAAK,EAAE,oBAAoB,CAAA;QAC3B,cAAc,EAAE,MAAM,CAAA;QACtB,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACpC,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;QAC3B,KAAK,EAAE,sBAAsB,CAAA;QAC7B,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAiCD,wBAAgB,wCAAwC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,gCAAgC,CA2B1H;AA6FD,wBAAsB,0BAA0B,CAAC,WAAW,EAAE,gCAAgC,EAC5F,YAAY,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoD3E;AAED,wBAAsB,6BAA6B,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/F"}