@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.53

package/lib/host-maintenance.js

@@ -0,0 +1,158 @@
+/** Signed, append-only deployment rebasing during an offline managed Host update.
+ * Original plans, approvals and readiness receipts remain unchanged. */
+import { createHash, createPublicKey, sign, verify } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+const unitKeys = ['FragmentPath', 'DropInPaths', 'ExecStart', 'Environment', 'WorkingDirectory', 'User', 'Group', 'Type', 'KillMode'];
+const hex = /^[a-f0-9]{64}$/u;
+function fail() { throw new Error('Host maintenance proof is invalid'); }
+export function hostMaintenanceCanonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(hostMaintenanceCanonical).join(',')}]`;
+    if (typeof value === 'object' && value !== null)
+        return `{${Object.entries(value)
+            .filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${JSON.stringify(key)}:${hostMaintenanceCanonical(item)}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function hostMaintenanceDigest(value) { return createHash('sha256').update(hostMaintenanceCanonical(value)).digest('hex'); }
+function object(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || Object.keys(value).sort().join('\0') !== [...keys].sort().join('\0'))
+        fail();
+    return value;
+}
+function text(value, max = 4096) {
+    if (typeof value !== 'string' || value.length === 0 || Buffer.byteLength(value) > max || value.includes('\0'))
+        fail();
+}
+function path(value) {
+    text(value);
+    if (!isAbsolute(value) || resolve(value) !== value || value === '/')
+        fail();
+}
+function integer(value, min = 1) { if (!Number.isSafeInteger(value) || Number(value) < min)
+    fail(); }
+function digest(value) { if (typeof value !== 'string' || !hex.test(value))
+    fail(); }
+function snapshot(value, root) {
+    const item = object(value, ['executor', 'profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles', 'unitProperties']);
+    const executor = object(item.executor, ['id', 'version', 'path', 'sha256']);
+    text(executor.id);
+    text(executor.version);
+    path(executor.path);
+    digest(executor.sha256);
+    const properties = object(item.unitProperties, unitKeys);
+    for (const value of Object.values(properties))
+        if (typeof value !== 'string' || Buffer.byteLength(value) > 65536 || value.includes('\0'))
+            fail();
+    for (const name of ['profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles']) {
+        const pins = item[name];
+        if (!Array.isArray(pins) || pins.length > 128 || name === 'profileFiles' && pins.length !== 3
+            || name === 'baselineFiles' && ![0, 3].includes(pins.length))
+            fail();
+        const seen = new Set();
+        for (const pin of pins) {
+            const deployment = name.includes('Deployment') || name === 'deploymentFiles';
+            const value = object(pin, deployment ? ['input', 'path', 'sha256'] : ['path', 'sha256']);
+            path(value.path);
+            if (!value.path.startsWith(`${root}/`) || seen.has(value.path))
+                fail();
+            seen.add(value.path);
+            if (deployment)
+                text(value.input);
+            if (value.sha256 !== null || name !== 'baselineFiles')
+                digest(value.sha256);
+        }
+    }
+}
+export function parseHostMaintenanceRecord(value) {
+    if (Buffer.byteLength(JSON.stringify(value)) > 524288)
+        fail();
+    const item = object(value, ['schemaVersion', 'kind', 'transactionId', 'installationId', 'ledger', 'profile', 'plan', 'activation',
+        'predecessor', 'sequence', 'previousDigest', 'before', 'after', 'issuedAt', 'authority', 'keyId', 'publicKeyPem', 'signature']);
+    if (item.schemaVersion !== 1 || item.kind !== 'dsh-host-maintenance')
+        fail();
+    for (const name of ['transactionId', 'installationId', 'authority', 'keyId'])
+        text(item[name], 160);
+    const ledger = object(item.ledger, ['id', 'path']);
+    text(ledger.id);
+    path(ledger.path);
+    const profile = object(item.profile, ['name', 'path']);
+    text(profile.name, 64);
+    path(profile.path);
+    const plan = object(item.plan, ['id', 'digest']);
+    text(plan.id);
+    digest(plan.digest);
+    const activation = object(item.activation, ['id', 'fence']);
+    text(activation.id);
+    integer(activation.fence);
+    const predecessor = object(item.predecessor, ['operationId', 'receiptDigest', 'hostGeneration']);
+    text(predecessor.operationId);
+    digest(predecessor.receiptDigest);
+    integer(predecessor.hostGeneration);
+    integer(item.sequence);
+    integer(item.issuedAt);
+    if (item.sequence === 1 ? item.previousDigest !== null : typeof item.previousDigest !== 'string' || !hex.test(item.previousDigest))
+        fail();
+    snapshot(item.before, profile.path);
+    snapshot(item.after, profile.path);
+    for (const field of ['profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles']) {
+        const identity = (values) => values.map(pin => ({ path: pin.path, ...('input' in pin ? { input: pin.input } : {}) }));
+        if (hostMaintenanceCanonical(identity(item.before[field])) !== hostMaintenanceCanonical(identity(item.after[field])))
+            fail();
+    }
+    if (item.before.executor.id !== item.after.executor.id)
+        fail();
+    text(item.publicKeyPem, 4096);
+    text(item.signature, 256);
+    const { signature, ...unsigned } = item;
+    const key = createPublicKey(item.publicKeyPem);
+    if (key.asymmetricKeyType !== 'ed25519' || !verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), key, Buffer.from(signature, 'base64')))
+        fail();
+    return item;
+}
+export function signHostMaintenanceRecord(input, privateKeyPem) {
+    const unsigned = { ...input, publicKeyPem: createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' }).toString() };
+    return parseHostMaintenanceRecord({ ...unsigned, signature: sign(null, Buffer.from(hostMaintenanceCanonical(unsigned)), privateKeyPem).toString('base64') });
+}
+/** Anchor every maintenance chain in the already applied original readiness key. */
+export function verifyHostMaintenanceChain(records, plan, readiness, witness) {
+    if (records.length > 256 || Buffer.byteLength(JSON.stringify(records)) > 450000
+        || readiness.phase !== 'readiness' || readiness.outcome !== 'passed' || readiness.installationId !== plan.installationId
+        || readiness.planId !== plan.id || readiness.planDigest !== plan.digest || readiness.activationId !== witness.activationId
+        || readiness.fence !== witness.fence || readiness.evidenceDigest !== hostMaintenanceDigest(readiness.evidence))
+        fail();
+    let prior;
+    for (const value of records) {
+        const record = parseHostMaintenanceRecord(value), same = (a, b) => hostMaintenanceDigest(a) === hostMaintenanceDigest(b);
+        if (record.installationId !== plan.installationId || !same(record.ledger, plan.ledger)
+            || record.profile.name !== plan.profile || record.profile.path !== plan.target.profilePath
+            || record.plan.id !== plan.id || record.plan.digest !== plan.digest || record.activation.id !== plan.activation?.id
+            || record.activation.fence !== witness.fence || record.sequence !== (prior?.sequence ?? 0) + 1
+            || record.previousDigest !== (prior ? hostMaintenanceDigest(prior) : null)
+            || record.predecessor.operationId !== readiness.operationId || record.predecessor.receiptDigest !== hostMaintenanceDigest(readiness)
+            || record.predecessor.hostGeneration !== readiness.hostGeneration || record.authority !== readiness.authority
+            || record.keyId !== readiness.keyId || record.issuedAt < readiness.observedAt || record.issuedAt > Date.now()
+            || prior && (record.issuedAt < prior.issuedAt || !same(record.before, prior.after)))
+            fail();
+        const { signature, ...unsigned } = readiness;
+        if (!verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), createPublicKey(record.publicKeyPem), Buffer.from(signature, 'base64')))
+            fail();
+        if (!prior && (!same(record.before.executor, plan.executor) || !same(record.before.profileFiles, witness.profileFiles)
+            || !same(record.before.baselineFiles, plan.activation?.targetBaselineFiles ?? [])
+            || !same(record.before.deploymentFiles, witness.deploymentFiles) || !same(record.before.baselineDeploymentFiles, witness.baselineDeploymentFiles)))
+            fail();
+        prior = record;
+    }
+    return records;
+}
+export function readHostMaintenanceRecords(database, planId) {
+    const rows = database.prepare('SELECT record_json,record_digest,sequence FROM deployment_host_maintenance WHERE plan_id=? ORDER BY sequence').all(planId);
+    return rows.map(row => {
+        const record = parseHostMaintenanceRecord(JSON.parse(String(row.record_json)));
+        if (record.plan.id !== planId || record.sequence !== row.sequence || hostMaintenanceDigest(record) !== row.record_digest)
+            fail();
+        return record;
+    });
+}
+//# sourceMappingURL=host-maintenance.js.map

package/lib/host-maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-maintenance.js","sourceRoot":"","sources":["../src/host-maintenance.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AACrI,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,SAAS,IAAI,KAAY,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA,CAAC,CAAC;AAC/E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9E,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aAC/E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAChG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAAc,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AACnJ,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;IACjF,OAAO,KAAgC,CAAA;AACzC,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,GAAG,GAAG,IAAI;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;AACvH,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,IAAI,EAAE,CAAA;AAC1F,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,GAAG,GAAG,CAAC,IAA6B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;IAAE,IAAI,EAAE,CAAA,CAAC,CAAC;AACtI,SAAS,MAAM,CAAC,KAAc,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,CAAA,CAAC,CAAC;AACtH,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACzI,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,EAAE,CAAA;IAChJ,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,CAAU,EAAE,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;eACxF,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,EAAE,CAAA;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,iBAAiB,CAAA;YAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,EAAE,CAAA;YACtE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACpB,IAAI,UAAU;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,eAAe;gBAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM;QAAE,IAAI,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY;QAC/H,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;IACjI,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB;QAAE,IAAI,EAAE,CAAA;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC3G,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAChG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAA;IACrG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,IAAI,EAAE,CAAA;IAC1I,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,CAAU,EAAE,CAAC;QAC7G,MAAM,QAAQ,GAAG,CAAC,MAAwC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACvJ,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAmB,EAAE,QAAQ,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IAClK,OAAO,IAAwC,CAAA;AACjD,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,KAAgE,EAAE,aAAqB;IAC/H,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC9H,OAAO,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC9J,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B,CAAC,OAAyC,EAAE,IAA0B,EAC9G,SAAiC,EAAE,OAAyB;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM;WAC1E,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;WACrH,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;WACvH,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,cAAc,KAAK,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IACxH,IAAI,KAAwC,CAAA;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1I,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;eACjF,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;eACvF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;eAChH,MAAM,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;eAC3F,MAAM,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;eACvE,MAAM,CAAC,WAAW,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,SAAS,CAAC;eACjI,MAAM,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;eAC1G,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE;eAC1G,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAC7F,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAClJ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;eACjH,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,IAAI,EAAE,CAAC;eAC9E,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QAC5J,KAAK,GAAG,MAAM,CAAA;IAChB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAsB,EAAE,MAAc;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,8GAA8G,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzJ,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,aAAa;YAAE,IAAI,EAAE,CAAA;QAChI,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/host-readiness.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Observe the native launcher's post-audit signal without gating the Control Plane on its presence. */
+export declare function installHostReadiness(ctx: Context, write?: (text: string) => void): void;
+export declare function onHostReady(ctx: Context, callback: () => void): void;
+//# sourceMappingURL=host-readiness.d.ts.map

package/lib/host-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-readiness.d.ts","sourceRoot":"","sources":["../src/host-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAQlD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA6C,GAAG,IAAI,CAE/H;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAcpE"}

package/lib/host-readiness.js

@@ -0,0 +1,22 @@
+const marker = 'dsh-enhanced host ready: v1\n';
+/** Observe the native launcher's post-audit signal without gating the Control Plane on its presence. */
+export function installHostReadiness(ctx, write = text => { process.stderr.write(text); }) {
+    onHostReady(ctx, () => write(marker));
+}
+export function onHostReady(ctx, callback) {
+    ctx.inject(['appReady'], readyCtx => {
+        readyCtx.effect(() => {
+            const appReady = readyCtx.get('appReady');
+            let active = true;
+            let reported = false;
+            const remove = appReady.onReady(() => {
+                if (!active || reported)
+                    return;
+                reported = true;
+                callback();
+            });
+            return () => { active = false; remove(); };
+        }, 'plugin-control-plane.host-readiness');
+    });
+}
+//# sourceMappingURL=host-readiness.js.map

package/lib/host-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-readiness.js","sourceRoot":"","sources":["../src/host-readiness.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,GAAG,+BAA+B,CAAA;AAM9C,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,QAAgC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;IACvH,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,QAAoB;IAC5D,GAAG,CAAC,MAAM,CAAC,CAAC,UAAmB,CAAC,EAAE,QAAQ,CAAC,EAAE;QAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;YACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAmB,CAAwB,CAAA;YACzE,IAAI,MAAM,GAAG,IAAI,CAAA;YACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,MAAM,IAAI,QAAQ;oBAAE,OAAM;gBAC/B,QAAQ,GAAG,IAAI,CAAA;gBACf,QAAQ,EAAE,CAAA;YACZ,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA,CAAC,CAAC,CAAA;QAC3C,CAAC,EAAE,qCAAqC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/index.d.ts

@@ -5,6 +5,11 @@ export declare const name = "dsh-enhanced-plugin-control-plane";
 export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
 export type { NormalizedControlPlaneConfig } from './service.js';
+export type { CreationCapabilityConfig, CreationCapabilityOwner, CreationCapabilityReceipt, CreationCapabilitySourceArchive, CreationCapabilityTaskAssociation } from './creation-capability-types.js';
+export type { CreationCapabilitySourceSnapshot } from './creation-capability-source.js';
+export { inspectCreationCapabilityTaskAssociations } from './creation-capability-feedback.js';
+export type { CreationCapabilityFeedbackInput } from './creation-capability-feedback.js';
+export { validateCreationCapabilityConfig, verifyCreationCapabilityReceipt } from './creation-capability-journal.js';
 export * from './catalog.js';
 export * from './errors.js';
 export * from './source-workspace.js';
@@ -35,9 +40,20 @@ export * from './store.js';
 export * from './types.js';
 export * from './trust.js';
 export type * from './source-job-types.js';
+export { validateSourceBaselineConfig } from './source-baseline.js';
+export type { SourceBaselineConfig } from './source-baseline.js';
+export { parseSourceMaintenanceRecord, signSourceMaintenanceRecord, sourceBaselineChain, sourceMaintenanceDigest, sourceMaintenanceSourceFieldsDigest, verifySourceMaintenanceRecords } from './source-maintenance.js';
+export type { SourceMaintenanceRecord, SourceMaintenanceAnchor } from './source-maintenance.js';
 export type { EnqueueSourceJobInput, SourceJobCaller } from './source-jobs.js';
 export declare function apply(ctx: Context, config: Config): void;
 export default PluginControlPlaneService;
 export type { AdoptionHandoffTerms, AdoptionHandoffRecord } from './adoption-handoff.js';
 export type { AdoptionCoordinatorConfig } from './adoption-coordinator.js';
+export { validateLiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export type { LiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export type { LiveQualificationConfig } from './live-qualification-runtime.js';
+export type { LiveQualificationTerms, LiveQualificationBatch, LiveQualificationReceipt } from './live-qualification.js';
+export { validateSystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export type { SystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export * from './host-maintenance.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,YAAY,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAChE,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC1G,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AACnF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,mBAAmB,6BAA6B,CAAA;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,YAAY,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAA;AACrF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AACjF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,uBAAuB,CAAA;AAC1C,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA;AAExC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,YAAY,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAChE,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,yBAAyB,EACxF,+BAA+B,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAA;AAC5G,YAAY,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAA;AAC7F,YAAY,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAA;AACxF,OAAO,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACpH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC1G,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AACnF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,mBAAmB,6BAA6B,CAAA;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,YAAY,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAA;AACrF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AACjF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,uBAAuB,CAAA;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,uBAAuB,EAC9G,mCAAmC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAA;AACtG,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAC/F,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA;AAExC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAE1E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACzF,YAAY,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AACvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAChF,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,cAAc,uBAAuB,CAAA"}

package/lib/index.js

@@ -3,6 +3,8 @@ import { version } from './version.js';
 export const name = 'dsh-enhanced-plugin-control-plane';
 export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
+export { inspectCreationCapabilityTaskAssociations } from './creation-capability-feedback.js';
+export { validateCreationCapabilityConfig, verifyCreationCapabilityReceipt } from './creation-capability-journal.js';
 export * from './catalog.js';
 export * from './errors.js';
 export * from './source-workspace.js';
@@ -23,8 +25,13 @@ export * from './sqlite.js';
 export * from './store.js';
 export * from './types.js';
 export * from './trust.js';
+export { validateSourceBaselineConfig } from './source-baseline.js';
+export { parseSourceMaintenanceRecord, signSourceMaintenanceRecord, sourceBaselineChain, sourceMaintenanceDigest, sourceMaintenanceSourceFieldsDigest, verifySourceMaintenanceRecords } from './source-maintenance.js';
 export function apply(ctx, config) {
     new PluginControlPlaneService(ctx, config);
 }
 export default PluginControlPlaneService;
+export { validateLiveQualificationAuthorityConfig } from './live-qualification-authority.js';
+export { validateSystemdHostAuthorityConfig } from './systemd-host-authority.js';
+export * from './host-maintenance.js';
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAe,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAGtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAEtF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAGxF,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AAEpF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAI1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAe,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAKrC,OAAO,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAA;AAE7F,OAAO,EAAE,gCAAgC,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACpH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAGtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAEtF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAGxF,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AAEpF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEnE,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,uBAAuB,EAC9G,mCAAmC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAA;AAItG,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA;AAKxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAI5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAEhF,cAAc,uBAAuB,CAAA"}

package/lib/live-qualification-authority.d.ts

@@ -0,0 +1,32 @@
+import { type LiveQualificationReceipt, type LiveQualificationRequest, type LiveQualificationTerms } from './live-qualification.js';
+import type { TaskObservationOwner } from './task-observation-types.js';
+export interface LiveQualificationAuthorityConfig {
+    schemaVersion: 1;
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    statePath: string;
+    controlDatabasePath: string;
+    grant: {
+        id: string;
+        expiresAt: number;
+        maxQualifications: number;
+        owner: TaskObservationOwner;
+        installationId: string;
+        ledger: {
+            id: string;
+            path: string;
+        };
+        profilePath: string;
+        packages: readonly string[];
+        terms: LiveQualificationTerms;
+        receiptTtlMs: number;
+    };
+}
+export declare class LiveQualificationAuthorityError extends Error {
+    constructor();
+}
+export declare function validateLiveQualificationAuthorityConfig(value: unknown): asserts value is LiveQualificationAuthorityConfig;
+export declare function authorizeLiveQualification(configInput: LiveQualificationAuthorityConfig, requestInput: LiveQualificationRequest): Promise<LiveQualificationReceipt>;
+export declare function runLiveQualificationAuthority(argv?: string[]): Promise<void>;
+//# sourceMappingURL=live-qualification-authority.d.ts.map

package/lib/live-qualification-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-qualification-authority.d.ts","sourceRoot":"","sources":["../src/live-qualification-authority.ts"],"names":[],"mappings":"AAOA,OAAO,EAEwB,KAAK,wBAAwB,EAAE,KAAK,wBAAwB,EACzF,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AASvE,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAA;QACV,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB,EAAE,MAAM,CAAA;QACzB,KAAK,EAAE,oBAAoB,CAAA;QAC3B,cAAc,EAAE,MAAM,CAAA;QACtB,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACpC,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;QAC3B,KAAK,EAAE,sBAAsB,CAAA;QAC7B,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAiCD,wBAAgB,wCAAwC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,gCAAgC,CA2B1H;AA6FD,wBAAsB,0BAA0B,CAAC,WAAW,EAAE,gCAAgC,EAC5F,YAAY,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoD3E;AAED,wBAAsB,6BAA6B,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/F"}

package/lib/live-qualification-authority.js

@@ -0,0 +1,280 @@
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
+import { resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { sourceAuthorityCanonicalSafePath, sourceAuthorityReadSafeFile } from './source-approval-authority.js';
+import { controlPlaneDigest, readLiveQualificationContext } from './store.js';
+import { PROTECTED_PLUGIN_DENYLIST } from './source-workspace.js';
+import { assertLiveQualificationBatch, liveQualificationReceiptId, liveQualificationSigningPayload, parseLiveQualificationReceipt, validateLiveQualificationTerms } from './live-qualification.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const PACKAGE = /^@dsh-enhanced\/[a-z][a-z0-9-]*$/u;
+const MAX_CONFIG = 65_536;
+const MAX_REQUEST = 8_192;
+const MAX_KEY = 32_768;
+export class LiveQualificationAuthorityError extends Error {
+    constructor() {
+        super('live qualification authority refused the request');
+        this.name = 'LiveQualificationAuthorityError';
+    }
+}
+function fail() { throw new LiveQualificationAuthorityError(); }
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail();
+    return value;
+}
+function exact(value, fields) {
+    if (Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0'))
+        fail();
+}
+function string(value, pattern = ID, maximum = 4096) {
+    if (typeof value !== 'string' || !pattern.test(value) || value.normalize('NFC').trim() !== value
+        || Buffer.byteLength(value) > maximum || /[\p{Cc}]/u.test(value))
+        fail();
+    return value;
+}
+function integer(value, minimum, maximum = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum)
+        fail();
+    return Number(value);
+}
+function path(value) {
+    const result = string(value, /^[\s\S]+$/u);
+    if (!result.startsWith('/') || result === '/' || resolve(result) !== result)
+        fail();
+    return result;
+}
+function equal(left, right) { return controlPlaneDigest(left) === controlPlaneDigest(right); }
+function owner(value) {
+    const item = object(value);
+    exact(item, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']);
+    return Object.freeze({ authorityId: string(item.authorityId), authorityHash: string(item.authorityHash, DIGEST, 64),
+        principalId: string(item.principalId, /^[\s\S]+$/u, 512),
+        principalRecordId: string(item.principalRecordId, /^[\s\S]+$/u, 512),
+        principalVersion: integer(item.principalVersion, 1), workspace: path(item.workspace), agentPreset: string(item.agentPreset) });
+}
+export function validateLiveQualificationAuthorityConfig(value) {
+    const item = object(value);
+    exact(item, ['schemaVersion', 'authority', 'keyId', 'keyPath', 'statePath', 'controlDatabasePath', 'grant']);
+    if (item.schemaVersion !== 1)
+        fail();
+    const authority = string(item.authority), keyId = string(item.keyId);
+    const keyPath = sourceAuthorityCanonicalSafePath(path(item.keyPath), 'file');
+    const statePath = path(item.statePath);
+    const controlPath = sourceAuthorityCanonicalSafePath(path(item.controlDatabasePath), 'file');
+    if (new Set([keyPath, statePath, controlPath]).size !== 3)
+        fail();
+    const grant = object(item.grant);
+    exact(grant, ['id', 'expiresAt', 'maxQualifications', 'owner', 'installationId', 'ledger', 'profilePath', 'packages', 'terms', 'receiptTtlMs']);
+    string(grant.id);
+    integer(grant.expiresAt, 1);
+    integer(grant.maxQualifications, 1, 1000);
+    owner(grant.owner);
+    string(grant.installationId);
+    const ledger = object(grant.ledger);
+    exact(ledger, ['id', 'path']);
+    string(ledger.id);
+    if (path(ledger.path) !== controlPath)
+        fail();
+    path(grant.profilePath);
+    validateLiveQualificationTerms(grant.terms);
+    if (grant.terms.authority !== authority || grant.terms.keyId !== keyId)
+        fail();
+    integer(grant.receiptTtlMs, 1_000, 300_000);
+    if (!Array.isArray(grant.packages) || grant.packages.length < 1 || grant.packages.length > 64)
+        fail();
+    const packages = grant.packages.map((value) => string(value, PACKAGE, 128));
+    if (new Set(packages).size !== packages.length)
+        fail();
+}
+function parseRequest(value) {
+    const item = object(value);
+    exact(item, ['protocol', 'batchId', 'batchDigest']);
+    if (item.protocol !== 'dsh-live-qualification/v1')
+        fail();
+    return Object.freeze({ protocol: 'dsh-live-qualification/v1',
+        batchId: string(item.batchId, /^live-qualification-[a-f0-9]{64}$/u),
+        batchDigest: string(item.batchDigest, DIGEST, 64) });
+}
+function openState(statePath) {
+    sourceAuthorityCanonicalSafePath(statePath, 'file', true);
+    const database = new DatabaseSync(statePath);
+    try {
+        database.exec(`PRAGMA busy_timeout = 5000;
+      PRAGMA journal_mode = WAL;
+      PRAGMA synchronous = FULL;
+      CREATE TABLE IF NOT EXISTS live_qualification_grants (
+        grant_id TEXT PRIMARY KEY, config_digest TEXT NOT NULL, key_fingerprint TEXT NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS live_qualification_receipts (
+        request_digest TEXT PRIMARY KEY, grant_id TEXT NOT NULL, config_digest TEXT NOT NULL,
+        batch_id TEXT NOT NULL UNIQUE, batch_digest TEXT NOT NULL,
+        receipt_json TEXT NOT NULL, receipt_digest TEXT NOT NULL
+      ) STRICT;`);
+        return database;
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
+}
+function storedReceipt(receiptJson, digest, key) {
+    if (controlPlaneDigest(receiptJson) !== digest)
+        fail();
+    try {
+        const receipt = parseLiveQualificationReceipt(JSON.parse(receiptJson));
+        const { signature, ...unsigned } = receipt;
+        if (!verify(null, Buffer.from(liveQualificationSigningPayload(unsigned)), createPublicKey(key), Buffer.from(signature, 'base64')))
+            fail();
+        return receipt;
+    }
+    catch {
+        return fail();
+    }
+}
+function validateContext(config, request, now) {
+    const db = new DatabaseSync(sourceAuthorityCanonicalSafePath(config.controlDatabasePath, 'file'), { readOnly: true });
+    try {
+        db.exec('PRAGMA query_only = ON');
+        const context = readLiveQualificationContext(db, request.batchId);
+        const { record, plan, source, deployments } = context;
+        const batch = record.batch;
+        assertLiveQualificationBatch(batch);
+        if (!['pending', 'signed'].includes(record.state) || batch.id !== request.batchId || batch.digest !== request.batchDigest
+            || batch.expiresAt <= now || now >= batch.deadlineAt || config.grant.expiresAt <= now
+            || !equal(batch.terms, config.grant.terms) || !equal(batch.owner, config.grant.owner)
+            || batch.installationId !== config.grant.installationId || !equal(plan.ledger, config.grant.ledger)
+            || batch.profilePath !== config.grant.profilePath || plan.id !== batch.planId || plan.digest !== batch.planDigest
+            || plan.status !== 'awaiting-live-tasks' || !plan.activation || plan.activation.id !== batch.activationId
+            || plan.activation.fence !== batch.fence || PROTECTED_PLUGIN_DENYLIST.has(plan.candidate.id)
+            || !config.grant.packages.includes(plan.candidate.package)
+            || !equal(plan.dossier.liveQualification, batch.terms)
+            || source.owner.authorityId !== batch.owner.authorityId || source.owner.authorityHash !== batch.owner.authorityHash
+            || source.owner.principalId !== batch.owner.principalId || source.owner.principalRecordId !== batch.owner.principalRecordId
+            || source.owner.principalVersion !== batch.owner.principalVersion || source.owner.workspace !== batch.owner.workspace
+            || source.owner.agentPreset !== batch.owner.agentPreset || deployments.length !== batch.votes.length)
+            fail();
+        for (const vote of batch.votes) {
+            const deployment = deployments.find((item) => item.task.inboxId === vote.inboxId);
+            if (!deployment || controlPlaneDigest(deployment) !== vote.deploymentDigest
+                || deployment.readiness.planId !== plan.id || deployment.readiness.planDigest !== plan.digest
+                || deployment.readiness.activationId !== batch.activationId || deployment.readiness.fence !== batch.fence
+                || deployment.readiness.hostGeneration !== batch.hostGeneration
+                || deployment.task.owner.principalRecordId !== batch.owner.principalRecordId
+                || deployment.task.owner.principalVersion !== batch.owner.principalVersion
+                || deployment.task.scope.workspace !== batch.owner.workspace || deployment.task.scope.preset !== batch.owner.agentPreset
+                || !deployment.execution || deployment.execution.completedAt !== vote.completedAt)
+                fail();
+        }
+        return context;
+    }
+    finally {
+        db.close();
+    }
+}
+function makeReceipt(config, batch, key, now) {
+    const identity = {
+        schemaVersion: 1, kind: 'dsh-live-qualification-receipt',
+        authority: config.authority, keyId: config.keyId, batchId: batch.id, batchDigest: batch.digest,
+        planId: batch.planId, planDigest: batch.planDigest, activationId: batch.activationId, fence: batch.fence,
+        hostGeneration: batch.hostGeneration,
+        disposition: batch.votes.some(vote => vote.status === 'not-achieved') ? 'failed' : 'qualified',
+        observedAt: now,
+        expiresAt: Math.min(now + config.grant.receiptTtlMs, batch.expiresAt, config.grant.expiresAt),
+    };
+    if (identity.expiresAt <= now)
+        fail();
+    const unsigned = { ...identity, receiptId: liveQualificationReceiptId(identity) };
+    return parseLiveQualificationReceipt({ ...unsigned,
+        signature: sign(null, Buffer.from(liveQualificationSigningPayload(unsigned)), key).toString('base64') });
+}
+export async function authorizeLiveQualification(configInput, requestInput) {
+    try {
+        validateLiveQualificationAuthorityConfig(configInput);
+        const config = configInput, request = parseRequest(requestInput);
+        const keyBytes = sourceAuthorityReadSafeFile(config.keyPath, MAX_KEY);
+        const key = createPrivateKey(keyBytes);
+        if (key.asymmetricKeyType !== 'ed25519')
+            fail();
+        const configDigest = controlPlaneDigest(config);
+        const keyFingerprint = createHash('sha256').update(keyBytes).digest('hex');
+        const requestDigest = controlPlaneDigest(request);
+        const state = openState(config.statePath);
+        try {
+            state.exec('BEGIN IMMEDIATE');
+            const frozen = state.prepare('SELECT config_digest,key_fingerprint FROM live_qualification_grants WHERE grant_id=?')
+                .get(config.grant.id);
+            if (frozen && (frozen.config_digest !== configDigest || frozen.key_fingerprint !== keyFingerprint))
+                fail();
+            const prior = state.prepare(`SELECT receipt_json,receipt_digest,grant_id,config_digest,batch_id,batch_digest
+        FROM live_qualification_receipts WHERE request_digest=?`).get(requestDigest);
+            if (prior) {
+                if (prior.grant_id !== config.grant.id || prior.config_digest !== configDigest
+                    || prior.batch_id !== request.batchId || prior.batch_digest !== request.batchDigest)
+                    fail();
+                const receipt = storedReceipt(prior.receipt_json, prior.receipt_digest, key);
+                if (receipt.batchId !== request.batchId || receipt.batchDigest !== request.batchDigest
+                    || receipt.authority !== config.authority || receipt.keyId !== config.keyId)
+                    fail();
+                state.exec('COMMIT');
+                return receipt;
+            }
+            const now = Date.now();
+            const first = validateContext(config, request, now);
+            const final = validateContext(config, request, now);
+            if (!equal(first.record.batch, final.record.batch) || !equal(first.plan, final.plan))
+                fail();
+            const count = state.prepare('SELECT COUNT(*) AS count FROM live_qualification_receipts WHERE grant_id=?')
+                .get(config.grant.id);
+            if (count.count >= config.grant.maxQualifications)
+                fail();
+            if (!frozen)
+                state.prepare('INSERT INTO live_qualification_grants VALUES (?,?,?)')
+                    .run(config.grant.id, configDigest, keyFingerprint);
+            const receipt = makeReceipt(config, final.record.batch, key, now);
+            const receiptJson = JSON.stringify(receipt);
+            state.prepare('INSERT INTO live_qualification_receipts VALUES (?,?,?,?,?,?,?)').run(requestDigest, config.grant.id, configDigest, request.batchId, request.batchDigest, receiptJson, controlPlaneDigest(receiptJson));
+            state.exec('COMMIT');
+            return receipt;
+        }
+        catch (error) {
+            try {
+                state.exec('ROLLBACK');
+            }
+            catch { }
+            ;
+            throw error;
+        }
+        finally {
+            state.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof LiveQualificationAuthorityError)
+            throw error;
+        throw new LiveQualificationAuthorityError();
+    }
+}
+export async function runLiveQualificationAuthority(argv = process.argv.slice(2)) {
+    try {
+        if (argv.length !== 2 || argv[0] !== '--config')
+            fail();
+        const configBytes = sourceAuthorityReadSafeFile(path(argv[1]), MAX_CONFIG);
+        const config = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(configBytes));
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            size += bytes.length;
+            if (size > MAX_REQUEST)
+                fail();
+            chunks.push(bytes);
+        }
+        const request = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        process.stdout.write(`${JSON.stringify(await authorizeLiveQualification(config, request))}\n`);
+    }
+    catch {
+        throw new LiveQualificationAuthorityError();
+    }
+}
+//# sourceMappingURL=live-qualification-authority.js.map