@dsh-enhanced/plugin-control-plane 0.1.65 → 0.1.67

package/lib/creation-capability-sealed-handoff.d.ts

@@ -0,0 +1,160 @@
+import { type AdoptionAuthorityIdentity, type FileIdentity, type FileSnapshot } from './creation-capability-handoff-common.js';
+import { SEALED_ADOPTION_HANDOFF_PROTOCOL as PROTOCOL } from './creation-capability-sealed-audit.js';
+import type { EmptyAdoptionScope } from './creation-capability-empty-handoff.js';
+declare const ADOPTION_STATUSES: readonly ["claimed", "authorized", "active", "closed", "unknown", "rejected"];
+export type SealedAdoptionStatus = 'active' | 'closed' | 'rejected' | 'unknown';
+/** Facts read from raw TEXT bytes. claimed/authorized/unknown adoptions and claimed/unknown calls
+ * cannot be reconciled after the Docker runner retires, so they are sealed as `unknown`. */
+export interface SealedAdoptionRow {
+    planId: string;
+    status: SealedAdoptionStatus;
+    originalStatus: typeof ADOPTION_STATUSES[number];
+    reason: string | null;
+    certificate: {
+        protocol: string;
+        digest: string;
+    };
+    artifactSha256: string;
+    receiptDigest: string | null;
+    callCount: number;
+    completedCalls: number;
+    unknownCalls: number;
+    sourceArchiveDigest: string | null;
+}
+export interface SealedAdoptionHistory {
+    counts: {
+        adoptions: number;
+        calls: number;
+        sourceArchives: number;
+    };
+    byStatus: Record<SealedAdoptionStatus, number>;
+    rows: SealedAdoptionRow[];
+    rowsDigest: string;
+}
+/** Active Docker adoptions the next authority must independently re-verify before any reuse. */
+export interface SealedPendingReverification {
+    planId: string;
+    certificateDigest: string;
+    receiptDigest: string;
+    artifactSha256: string;
+    toolsDigest: string;
+}
+export interface SealedAdoptionScope extends EmptyAdoptionScope {
+    archiveLogicalPath: string;
+    archivePhysicalPath: string;
+}
+export interface SealedAdoptionPlan {
+    protocol: typeof PROTOCOL;
+    transactionId: string;
+    hostAnchor: string;
+    physicalPath: string;
+    oldIdentity: AdoptionAuthorityIdentity;
+    nextIdentity: AdoptionAuthorityIdentity;
+    snapshot: FileSnapshot;
+    archive: {
+        logicalPath: string;
+        physicalPath: string;
+    };
+    history: SealedAdoptionHistory;
+    pendingReverification: SealedPendingReverification[];
+    inheritedUsage: {
+        adoptions: number;
+        calls: number;
+    };
+    createdAt: number;
+    expiresAt: number;
+    digest: string;
+}
+export interface SealedAdoptionProof {
+    protocol: typeof PROTOCOL;
+    plan: SealedAdoptionPlan;
+    fileIdentity: FileIdentity;
+    archive: {
+        logicalPath: string;
+        fileIdentity: FileIdentity;
+        bytes: number;
+        digest: string;
+        mode: 0o400;
+    };
+    liveBusiness: {
+        adoptions: 0;
+        calls: 0;
+        sourceArchives: 0;
+    };
+    inheritedUsage: {
+        adoptions: number;
+        calls: number;
+    };
+    digest: string;
+}
+/** Plan sealing a stopped staged Docker journal whose history is non-empty. Same caller duties as the
+ * empty handoff: independently verify the source copy and both configurations, bind them in hostAnchor
+ * and freeze the plan digest outside this file. */
+export declare function planSealedAdoptionHandoff(scope: SealedAdoptionScope): Readonly<SealedAdoptionPlan>;
+export declare function applySealedAdoptionHandoff(plan: SealedAdoptionPlan, input: {
+    now: number;
+    expectedPlanDigest: string;
+    expectedHostAnchor: string;
+}): Readonly<SealedAdoptionProof>;
+/** Read-only Host cross-check of a possibly live journal (WAL sidecars allowed). Returns the stored
+ * sealed proof digest after the same audit validation the journal performs, or null when no audit
+ * object exists. The journal alone cannot detect a wholly dropped audit; the caller compares this
+ * result with its signed proof digest and refuses on any difference. */
+export declare function readSealedAdoptionHandoffDigest(input: {
+    physicalPath: string;
+}): string | null;
+/** Stopped-stage / post-cutover BEFORE START acceptance only. The live file may have been renamed on
+ * the same inode; the archive must sit in the same relative placement and keep its exact identity. */
+export declare function verifySealedAdoptionHandoff(input: {
+    physicalPath: string;
+    archivePhysicalPath: string;
+    plan: SealedAdoptionPlan;
+    expectedProofDigest: string;
+}): Readonly<SealedAdoptionProof>;
+/** Provenance of one sealed Docker-era tool's archived source, re-rooted relative to `plugins/<name>/`. */
+export interface SealedReverificationSource {
+    planId: string;
+    name: string;
+    /** Candidate-authority files only (README.md, src/**, tests/**); Host-generated metadata is omitted. */
+    files: {
+        path: string;
+        content: string;
+    }[];
+    /** sha256 of the stored source-archive JSON, equal to the sealed history row's sourceArchiveDigest. */
+    archiveRowDigest: string;
+    filesDigest: string;
+    oldAuthorityDigest: string;
+}
+/** Proof that a new replay plan id is isolated from the sealed handoff's history. */
+export interface SealedReplayPlanIdIsolation {
+    protocol: 'dsh-sealed-replay-plan-id-isolation/v1';
+    planId: string;
+    proofDigest: string;
+    sealedRows: number;
+}
+/** S2 naming isolation for sealed tool replay (check and refuse only; nothing adopts with it yet).
+ *
+ * A replayed sealed tool must return under a NEW plan id. Bound to the caller's signed proof digest, this
+ * refuses `planId` when it names any sealed history row (every status, not only pending reverification),
+ * equals one ignoring case, or equals ignoring case any `adoptions` row of the live ledger, whatever its
+ * authority (stricter than the next authority alone, intentionally fail-closed).
+ * It reads the journal only and grants nothing: passing it is necessary for a replay plan, never sufficient.
+ * It runs in its own read-only snapshot and reserves nothing, and `CreationCapabilityJournal.claim` compares
+ * plan ids exactly without case folding, so whoever wires it must re-run this case-folded check inside the
+ * claim writer transaction; otherwise a concurrent `FRESH`/`fresh` pair both pass. */
+export declare function assertSealedReplayPlanIdIsolated(input: {
+    physicalPath: string;
+    expectedProofDigest: string;
+    planId: string;
+}): Readonly<SealedReplayPlanIdIsolation>;
+/** Read-only provenance reader for re-verifying one sealed `pendingReverification` tool. It binds the live
+ * or stopped journal's immutable proof to the caller's signed proof digest, reads the exact sealed 0400
+ * archive under the OLD authority and returns only candidate source files. It grants nothing: no
+ * certificate, artifact, receipt or tools leave this function, and re-verification itself is the caller's. */
+export declare function readSealedReverificationSource(input: {
+    physicalPath: string;
+    expectedProofDigest: string;
+    planId: string;
+}): Readonly<SealedReverificationSource>;
+export {};
+//# sourceMappingURL=creation-capability-sealed-handoff.d.ts.map

package/lib/creation-capability-sealed-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creation-capability-sealed-handoff.d.ts","sourceRoot":"","sources":["../src/creation-capability-sealed-handoff.ts"],"names":[],"mappings":"AAUA,OAAO,EAAgD,KAAK,yBAAyB,EAAE,KAAK,YAAY,EACtG,KAAK,YAAY,EAAE,MAAM,yCAAyC,CAAA;AACpE,OAAO,EAA2D,gCAAgC,IAAI,QAAQ,EACX,MAAM,uCAAuC,CAAA;AAChJ,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAYhF,QAAA,MAAM,iBAAiB,+EAAgF,CAAA;AAIvG,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAA;AAC/E;4FAC4F;AAC5F,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;IAC5B,cAAc,EAAE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACjD,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IAC9C,IAAI,EAAE,iBAAiB,EAAE,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,gGAAgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;CACpB;AACD,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,QAAQ,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,yBAAyB,CAAA;IACtC,YAAY,EAAE,yBAAyB,CAAA;IACvC,QAAQ,EAAE,YAAY,CAAA;IACtB,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,OAAO,EAAE,qBAAqB,CAAA;IAC9B,qBAAqB,EAAE,2BAA2B,EAAE,CAAA;IACpD,cAAc,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,QAAQ,CAAA;IACzB,IAAI,EAAE,kBAAkB,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAA;KAAE,CAAA;IACxG,YAAY,EAAE;QAAE,SAAS,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC,CAAC;QAAC,cAAc,EAAE,CAAC,CAAA;KAAE,CAAA;IAC3D,cAAc,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,MAAM,EAAE,MAAM,CAAA;CACf;AA8ND;;mDAEmD;AACnD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAwBlG;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EACjE,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAyC/G;AAED;;;wEAGwE;AACxE,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAY9F;AAuBD;sGACsG;AACtG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IACrG,IAAI,EAAE,kBAAkB,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAcxF;AAED,2GAA2G;AAC3G,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,wGAAwG;IACxG,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1C,uGAAuG;IACvG,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAmDD,qFAAqF;AACrF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,wCAAwC,CAAA;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;sFASsF;AACtF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAC1G,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAAC,2BAA2B,CAAC,CAoBzD;AAED;;;8GAG8G;AAC9G,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IACxG,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAAC,0BAA0B,CAAC,CAwDxD"}