@ouro.bot/cli 0.1.0-alpha.816 → 0.1.0-alpha.817

package/dist/heart/daemon/sanctuary-authority-epoch.js

@@ -0,0 +1,256 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSanctuaryAuthorityEpoch = readSanctuaryAuthorityEpoch;
+exports.prepareSanctuaryAuthorityEpoch = prepareSanctuaryAuthorityEpoch;
+exports.releaseSanctuaryAuthorityToken = releaseSanctuaryAuthorityToken;
+exports.retireSanctuaryAuthorityEpoch = retireSanctuaryAuthorityEpoch;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const session_transaction_1 = require("../../mind/session-transaction");
+const runtime_1 = require("../../nerves/runtime");
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const TOKEN = /^[1-9][0-9]*:[A-Za-z0-9_-]{20,}$/u;
+const sha = (bytes) => `sha256:${(0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex")}`;
+function assertRoot(root, owner) {
+    const stat = fs.lstatSync(root);
+    if (!stat.isDirectory() || fs.realpathSync(root) !== root || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o700)
+        throw new Error("Sanctuary authority epoch root is unsafe");
+}
+function privateBytes(filePath, owner) {
+    if (!path.isAbsolute(filePath) || fs.realpathSync(filePath) !== filePath)
+        throw new Error("Sanctuary authority epoch path is unsafe");
+    const fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o600 || stat.size < 1 || stat.size > 65536)
+            throw new Error("Sanctuary authority epoch file metadata is unsafe");
+        return fs.readFileSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function issuer(root, owner) {
+    const key = (0, node_crypto_1.createPrivateKey)(privateBytes(path.join(root, "issuer.pem"), owner));
+    const publicKey = (0, node_crypto_1.createPublicKey)(key);
+    if (publicKey.asymmetricKeyType !== "ed25519")
+        throw new Error("Sanctuary authority issuer is not Ed25519");
+    return { publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(), publicKeyDigest: sha(publicKey.export({ type: "spki", format: "der" })) };
+}
+function validate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Sanctuary authority epoch is invalid");
+    const epoch = value;
+    if (Object.keys(epoch).sort().join(",") !== "botId,createdAt,epochId,ownerChatId,ownerUserId,packageDigest,predecessorCursor,previousTokenDigest,publicKeyDigest,publicKeyPem,revokedTokenStatus,schemaVersion,state,terminalCursor,tokenDigest,tokenPath"
+        || epoch.schemaVersion !== 1 || !["prepared", "retired"].includes(epoch.state)
+        || typeof epoch.epochId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(epoch.epochId)
+        || ![epoch.botId, epoch.ownerUserId, epoch.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id)) || epoch.ownerUserId !== epoch.ownerChatId
+        || !Number.isSafeInteger(epoch.predecessorCursor) || epoch.predecessorCursor < 0
+        || ![epoch.packageDigest, epoch.tokenDigest, epoch.previousTokenDigest, epoch.publicKeyDigest].every((value) => typeof value === "string" && DIGEST.test(value))
+        || epoch.tokenDigest === epoch.previousTokenDigest || typeof epoch.tokenPath !== "string" || !path.isAbsolute(epoch.tokenPath)
+        || typeof epoch.publicKeyPem !== "string" || epoch.revokedTokenStatus !== 401
+        || typeof epoch.createdAt !== "string" || !Number.isFinite(Date.parse(epoch.createdAt)) || new Date(epoch.createdAt).toISOString() !== epoch.createdAt
+        || (epoch.state === "prepared" ? epoch.terminalCursor !== null : !Number.isSafeInteger(epoch.terminalCursor) || epoch.terminalCursor < epoch.predecessorCursor))
+        throw new Error("Sanctuary authority epoch is invalid");
+    return epoch;
+}
+function syncRoot(root) {
+    const fd = fs.openSync(root, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY);
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function writeRecord(filePath, record) {
+    (0, session_transaction_1.withImmediateSessionTurnLease)(filePath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(filePath, lease);
+        (0, session_transaction_1.writeSessionTransaction)(filePath, record, { lease, expectedRevision: transaction.revision });
+    });
+}
+function writeIssuer(root, key, owner) {
+    const temporary = path.join(root, "issuer.pem.tmp");
+    const fd = fs.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+    let owned = false;
+    try {
+        try {
+            const stat = fs.fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o600)
+                throw new Error("Sanctuary issuer temporary is unsafe");
+            owned = true;
+            fs.ftruncateSync(fd, 0);
+            fs.writeFileSync(fd, key);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temporary, path.join(root, "issuer.pem"));
+    }
+    catch (error) {
+        if (owned)
+            fs.unlinkSync(temporary);
+        throw error;
+    }
+    syncRoot(root);
+}
+function readSanctuaryAuthorityEpoch(root, owner) {
+    assertRoot(root, owner);
+    const epoch = validate(JSON.parse(privateBytes(path.join(root, "epoch.json"), owner).toString("utf8")));
+    const publicKey = issuer(root, owner);
+    if (publicKey.publicKeyDigest !== epoch.publicKeyDigest || publicKey.publicKeyPem !== epoch.publicKeyPem)
+        throw new Error("Sanctuary authority epoch key or token changed");
+    if (epoch.state === "retired" && fs.existsSync(path.join(root, "handoff.json"))) {
+        const handoff = JSON.parse(privateBytes(path.join(root, "handoff.json"), owner).toString("utf8"));
+        if (JSON.stringify(handoff) !== JSON.stringify({ schemaVersion: 1, epochId: epoch.epochId, tokenDigest: epoch.tokenDigest, cursor: epoch.terminalCursor }))
+            throw new Error("Sanctuary authority token handoff changed");
+        if (fs.existsSync(epoch.tokenPath) && sha(privateBytes(epoch.tokenPath, owner).toString("utf8").trim()) !== epoch.tokenDigest)
+            throw new Error("Sanctuary authority epoch key or token changed");
+    }
+    else if (sha(privateBytes(epoch.tokenPath, owner).toString("utf8").trim()) !== epoch.tokenDigest)
+        throw new Error("Sanctuary authority epoch key or token changed");
+    return epoch;
+}
+async function prepareSanctuaryAuthorityEpoch(input, options) {
+    assertRoot(input.root, options);
+    if (typeof input.epochId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(input.epochId)
+        || ![input.botId, input.ownerUserId, input.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id)) || input.ownerUserId !== input.ownerChatId
+        || !Number.isSafeInteger(input.predecessorCursor) || input.predecessorCursor < 0 || !DIGEST.test(input.packageDigest))
+        throw new Error("Sanctuary authority epoch input is invalid");
+    const token = privateBytes(input.tokenPath, options).toString("utf8").trim();
+    const previousToken = privateBytes(input.previousTokenPath, options).toString("utf8").trim();
+    if (!TOKEN.test(token) || !TOKEN.test(previousToken) || token.split(":")[0] !== input.botId || previousToken.split(":")[0] !== input.botId || token === previousToken)
+        throw new Error("Sanctuary authority requires a fresh same-bot token");
+    const previous = await options.probe(previousToken);
+    if (previous.status !== 401 || previous.botId !== null)
+        throw new Error("Sanctuary previous Telegram token is not proven revoked");
+    const current = await options.probe(token);
+    if (current.status !== 200 || current.botId !== input.botId)
+        throw new Error("Sanctuary new Telegram token identity is invalid");
+    const epochPath = path.join(input.root, "epoch.json");
+    const keyPath = path.join(input.root, "issuer.pem");
+    const intentPath = path.join(input.root, "issuer-intent.json");
+    const inputDigest = sha(JSON.stringify({ ...input, tokenDigest: sha(token), previousTokenDigest: sha(previousToken) }));
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        let existing = false;
+        try {
+            fs.lstatSync(epochPath);
+            existing = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (existing) {
+            const epoch = readSanctuaryAuthorityEpoch(input.root, options);
+            if (epoch.state === "retired")
+                throw new Error("Sanctuary authority epoch is retired; a fresh token and key epoch are required");
+            for (const key of ["epochId", "botId", "ownerUserId", "ownerChatId", "predecessorCursor", "packageDigest", "tokenPath"]) {
+                if (epoch[key] !== input[key])
+                    throw new Error("Sanctuary authority epoch input changed");
+            }
+            if (epoch.previousTokenDigest !== sha(previousToken))
+                throw new Error("Sanctuary authority predecessor token changed");
+            if (fs.existsSync(intentPath)) {
+                const intent = JSON.parse(privateBytes(intentPath, options).toString("utf8"));
+                if (intent.inputDigest !== inputDigest || intent.key !== privateBytes(keyPath, options).toString("utf8"))
+                    throw new Error("Sanctuary issuer cleanup identity changed");
+                fs.unlinkSync(intentPath);
+                syncRoot(input.root);
+            }
+            return epoch;
+        }
+        let intent;
+        if (fs.existsSync(intentPath)) {
+            intent = JSON.parse(privateBytes(intentPath, options).toString("utf8"));
+            if (!intent || Object.keys(intent).sort().join(",") !== "createdAt,inputDigest,key" || intent.inputDigest !== inputDigest || typeof intent.key !== "string")
+                throw new Error("Sanctuary issuer preparation identity changed");
+        }
+        else {
+            if (fs.existsSync(keyPath))
+                throw new Error("Sanctuary authority issuer is orphaned; a fresh epoch is required");
+            intent = { inputDigest, key: (0, node_crypto_1.generateKeyPairSync)("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString(), createdAt: options.now() };
+            writeRecord(intentPath, intent);
+        }
+        if (fs.existsSync(keyPath)) {
+            if (privateBytes(keyPath, options).toString("utf8") !== intent.key)
+                throw new Error("Sanctuary prepared issuer changed");
+        }
+        else {
+            writeIssuer(input.root, intent.key, options);
+        }
+        const epoch = validate({
+            schemaVersion: 1, state: "prepared", epochId: input.epochId, botId: input.botId, ownerUserId: input.ownerUserId, ownerChatId: input.ownerChatId,
+            predecessorCursor: input.predecessorCursor, packageDigest: input.packageDigest, tokenPath: input.tokenPath, tokenDigest: sha(token), previousTokenDigest: sha(previousToken),
+            ...issuer(input.root, options), revokedTokenStatus: 401, createdAt: intent.createdAt, terminalCursor: null,
+        });
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, epoch, { lease, expectedRevision: transaction.revision });
+        fs.unlinkSync(intentPath);
+        syncRoot(input.root);
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_epoch_prepared", message: "Sanctuary authority epoch prepared", meta: { epochId: epoch.epochId, publicKeyDigest: epoch.publicKeyDigest } });
+        return epoch;
+    });
+}
+function releaseSanctuaryAuthorityToken(root, options) {
+    const epoch = readSanctuaryAuthorityEpoch(root, options);
+    if (epoch.state !== "retired")
+        throw new Error("Sanctuary authority token cannot leave an unretired epoch");
+    if (epoch.tokenDigest !== options.tokenDigest || epoch.terminalCursor !== options.cursor || path.dirname(epoch.tokenPath) !== root)
+        throw new Error("Sanctuary authority token handoff is invalid");
+    writeRecord(path.join(root, "handoff.json"), { schemaVersion: 1, epochId: epoch.epochId, tokenDigest: epoch.tokenDigest, cursor: epoch.terminalCursor });
+    if (fs.existsSync(epoch.tokenPath))
+        fs.unlinkSync(epoch.tokenPath);
+    syncRoot(root);
+}
+function retireSanctuaryAuthorityEpoch(root, options) {
+    if (options.quiescent !== true)
+        throw new Error("Sanctuary authority execution state is not quiescent");
+    const epochPath = path.join(root, "epoch.json");
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        const epoch = readSanctuaryAuthorityEpoch(root, options);
+        if (!Number.isSafeInteger(options.cursor) || options.cursor < epoch.predecessorCursor || (epoch.state === "retired" && options.cursor !== epoch.terminalCursor))
+            throw new Error("Sanctuary authority terminal cursor is invalid");
+        if (epoch.state === "retired")
+            return epoch;
+        const retired = { ...epoch, state: "retired", terminalCursor: options.cursor };
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, retired, { lease, expectedRevision: transaction.revision });
+        return retired;
+    });
+}

package/dist/heart/daemon/sanctuary-authority-installation.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySanctuaryAuthorityInstallation = verifySanctuaryAuthorityInstallation;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function digest(bytes) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex")}`;
+}
+function canonical(filePath) {
+    if (!path.isAbsolute(filePath) || path.normalize(filePath) !== filePath || fs.realpathSync(filePath) !== filePath) {
+        throw new Error("Sanctuary authority installation path is not canonical");
+    }
+}
+function directory(filePath, uid, gid, mode) {
+    canonical(filePath);
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isDirectory() || stat.uid !== uid || stat.gid !== gid || (stat.mode & 0o7777) !== mode) {
+        throw new Error("Sanctuary authority installation directory metadata changed");
+    }
+}
+function readOwned(filePath, uid, gid, mode) {
+    canonical(filePath);
+    const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        const stat = fs.fstatSync(descriptor);
+        if (!stat.isFile() || stat.uid !== uid || stat.gid !== gid || (stat.mode & 0o7777) !== mode || stat.nlink !== 1) {
+            throw new Error("Sanctuary authority installation file metadata changed");
+        }
+        return fs.readFileSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function verifySanctuaryAuthorityInstallation(input) {
+    const { expectedUid: uid, expectedGid: gid } = input;
+    for (const root of [input.packageRoot, input.stateRoot, input.stagingRoot, input.cgroupRoot])
+        directory(root, uid, gid, 0o700);
+    directory(input.socketRoot, uid, input.socketGroupId, 0o750);
+    const bytes = readOwned(input.manifestPath, uid, gid, 0o600);
+    if (digest(bytes) !== input.manifestDigest)
+        throw new Error("Sanctuary authority package manifest digest changed");
+    const manifest = JSON.parse(bytes.toString("utf8"));
+    if (!object(manifest) || Object.keys(manifest).sort().join(",") !== "files,schemaVersion" || manifest.schemaVersion !== 1 || !object(manifest.files) || Object.keys(manifest.files).length === 0) {
+        throw new Error("Sanctuary authority package manifest is invalid");
+    }
+    const expected = Object.keys(manifest.files).sort();
+    for (const relative of expected) {
+        const pin = manifest.files[relative];
+        if (!/^[A-Za-z0-9_@.-]+(?:\/[A-Za-z0-9_@.-]+)*$/u.test(relative) || relative.split("/").some((part) => part === "." || part === "..")
+            || !object(pin) || Object.keys(pin).sort().join(",") !== "digest,mode"
+            || typeof pin.digest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(pin.digest) || ![0o600, 0o644, 0o700, 0o755].includes(pin.mode)) {
+            throw new Error("Sanctuary authority package file pin is invalid");
+        }
+        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode)) !== pin.digest)
+            throw new Error("Sanctuary authority package file digest changed");
+    }
+    const actual = [];
+    const walk = (relative) => {
+        for (const entry of fs.readdirSync(path.join(input.packageRoot, relative), { withFileTypes: true })) {
+            const name = path.join(relative, entry.name);
+            const filePath = path.join(input.packageRoot, name);
+            if (entry.isDirectory()) {
+                const stat = fs.lstatSync(filePath);
+                canonical(filePath);
+                if (stat.uid !== uid || stat.gid !== gid || ![0o700, 0o755].includes(stat.mode & 0o7777))
+                    throw new Error("Sanctuary authority package directory is unsafe");
+                walk(name);
+            }
+            else {
+                actual.push(name);
+            }
+        }
+    };
+    walk("");
+    if (JSON.stringify(actual.sort()) !== JSON.stringify(expected))
+        throw new Error("Sanctuary authority package inventory changed");
+    const controllers = ["cpu", "memory", "pids"];
+    const readControl = (name) => fs.readFileSync(path.join(input.cgroupRoot, name), "utf8").trim();
+    for (const name of ["cgroup.controllers", "cgroup.subtree_control"]) {
+        const enabled = readControl(name).split(/\s+/u);
+        if (!controllers.every((controller) => enabled.includes(controller)))
+            throw new Error("Sanctuary authority cgroup controllers are unavailable");
+    }
+    if (readControl("cgroup.type") !== "domain" || readControl("cgroup.procs") !== "")
+        throw new Error("Sanctuary authority cgroup domain is invalid");
+    const mounts = (input.mountInfo ?? fs.readFileSync("/proc/self/mountinfo", "utf8")).trim().split("\n").map((line) => {
+        const fields = line.split(" ");
+        const separator = fields.indexOf("-");
+        if (fields.length < 10 || separator < 6)
+            throw new Error("Sanctuary authority mount inventory is invalid");
+        return { target: fields[4].replace(/\\([0-7]{3})/gu, (_match, octal) => String.fromCharCode(parseInt(octal, 8))), options: fields[5].split(","), type: fields[separator + 1] };
+    });
+    const mountFor = (filePath) => mounts.filter(({ target }) => target === "/" || filePath === target || filePath.startsWith(`${target}/`)).sort((a, b) => b.target.length - a.target.length)[0];
+    const stagingMount = mountFor(input.stagingRoot);
+    const cgroupMount = mountFor(input.cgroupRoot);
+    if (!stagingMount || stagingMount.options.includes("noexec") || stagingMount.options.includes("ro") || cgroupMount?.type !== "cgroup2" || cgroupMount.options.includes("ro")) {
+        throw new Error("Sanctuary authority staging or cgroup mount prerequisites are unavailable");
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_installation_verified", message: "Sanctuary authority installation prerequisites verified", meta: { packageDigest: input.manifestDigest } });
+    return { packageDigest: input.manifestDigest, controllers };
+}

package/dist/heart/daemon/sanctuary-authority-ledger.js

@@ -0,0 +1,241 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSanctuaryAuthorityLedger = void 0;
+exports.sanctuaryAuthorityLedgerPath = sanctuaryAuthorityLedgerPath;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const session_transaction_1 = require("../../mind/session-transaction");
+const SCHEMA_VERSION = 1;
+const TERMINAL_STATES = new Set(["verified", "failed", "ambiguous", "refused"]);
+const PERMIT_ID = /^permit-[A-Za-z0-9_-]+$/;
+const NONCE = /^[A-Za-z0-9_-]{64}$/;
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+function sanctuaryAuthorityLedgerPath(agentRoot) {
+    return path.join(agentRoot, "authority", "replay-ledger.json");
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validTime(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        return new Date(value).toISOString() === value;
+    }
+    catch {
+        return false;
+    }
+}
+function assertPermitId(value) {
+    if (typeof value !== "string" || !PERMIT_ID.test(value)) {
+        throw new Error("Sanctuary authority permit id is invalid");
+    }
+}
+function assertNonce(value) {
+    if (typeof value !== "string" || !NONCE.test(value)) {
+        throw new Error("Sanctuary authority nonce is invalid");
+    }
+}
+function assertDigest(value) {
+    if (typeof value !== "string" || !DIGEST.test(value)) {
+        throw new Error("Sanctuary authority digest is invalid");
+    }
+}
+function assertTime(value) {
+    if (!validTime(value)) {
+        throw new Error("Sanctuary authority time is invalid");
+    }
+}
+function validateReservation(value) {
+    if (!isObject(value) || !hasExactKeys(value, ["permitId", "nonce", "permitDigest", "reservedAt"])) {
+        throw new Error("Sanctuary authority ledger reservation is malformed");
+    }
+    assertPermitId(value.permitId);
+    assertNonce(value.nonce);
+    assertDigest(value.permitDigest);
+    assertTime(value.reservedAt);
+}
+function validateRecord(value, permitId) {
+    if (!isObject(value) || !hasExactKeys(value, [
+        "schemaVersion",
+        "permitId",
+        "nonce",
+        "permitDigest",
+        "reservedAt",
+        "state",
+        "updatedAt",
+        "outcomeDigest",
+    ])) {
+        throw new Error(`Sanctuary authority ledger record ${permitId} is malformed`);
+    }
+    if (value.schemaVersion !== SCHEMA_VERSION || value.permitId !== permitId) {
+        throw new Error(`Sanctuary authority ledger record ${permitId} has invalid identity`);
+    }
+    assertPermitId(value.permitId);
+    assertNonce(value.nonce);
+    assertDigest(value.permitDigest);
+    assertTime(value.reservedAt);
+    assertTime(value.updatedAt);
+    if (value.state === "reserved") {
+        if (value.outcomeDigest !== null || value.updatedAt !== value.reservedAt) {
+            throw new Error(`Sanctuary authority ledger record ${permitId} has ambiguous reserved state`);
+        }
+        return;
+    }
+    if (!TERMINAL_STATES.has(String(value.state))) {
+        throw new Error(`Sanctuary authority ledger record ${permitId} has invalid state`);
+    }
+    assertDigest(value.outcomeDigest);
+}
+function validateState(value) {
+    if (!isObject(value)
+        || !hasExactKeys(value, ["schemaVersion", "records", "nonces"])
+        || value.schemaVersion !== SCHEMA_VERSION
+        || !isObject(value.records)
+        || !isObject(value.nonces)) {
+        throw new Error("Sanctuary authority ledger state is malformed");
+    }
+    const records = {};
+    for (const [permitId, record] of Object.entries(value.records)) {
+        validateRecord(record, permitId);
+        records[permitId] = record;
+        if (value.nonces[record.nonce] !== permitId) {
+            throw new Error(`Sanctuary authority ledger nonce index is ambiguous for ${permitId}`);
+        }
+    }
+    for (const [nonce, permitId] of Object.entries(value.nonces)) {
+        assertNonce(nonce);
+        if (typeof permitId !== "string" || records[permitId]?.nonce !== nonce) {
+            throw new Error(`Sanctuary authority ledger nonce index is ambiguous for ${nonce}`);
+        }
+    }
+}
+function initialState() {
+    return { schemaVersion: SCHEMA_VERSION, records: {}, nonces: {} };
+}
+function transactionState(transaction) {
+    if (transaction.value === null) {
+        if (transaction.bytes)
+            throw new Error("Sanctuary authority ledger state is malformed");
+        return initialState();
+    }
+    validateState(transaction.value);
+    return transaction.value;
+}
+class FileSanctuaryAuthorityLedger {
+    #ledgerPath;
+    constructor(agentRoot) {
+        if (typeof agentRoot !== "string" || agentRoot.length === 0) {
+            throw new Error("Sanctuary authority ledger root is invalid");
+        }
+        this.#ledgerPath = sanctuaryAuthorityLedgerPath(agentRoot);
+    }
+    reserve(reservation) {
+        validateReservation(reservation);
+        return (0, session_transaction_1.withImmediateSessionTurnLease)(this.#ledgerPath, (lease) => {
+            const transaction = (0, session_transaction_1.readSessionTransaction)(this.#ledgerPath, lease);
+            const state = transactionState(transaction);
+            if (state.records[reservation.permitId]) {
+                throw new Error(`Sanctuary authority permit id ${reservation.permitId} already exists`);
+            }
+            if (state.nonces[reservation.nonce]) {
+                throw new Error(`Sanctuary authority nonce ${reservation.nonce} already exists`);
+            }
+            const record = {
+                schemaVersion: SCHEMA_VERSION,
+                ...reservation,
+                state: "reserved",
+                updatedAt: reservation.reservedAt,
+                outcomeDigest: null,
+            };
+            state.records[record.permitId] = record;
+            state.nonces[record.nonce] = record.permitId;
+            this.#write(state, transaction.revision, lease);
+            (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_permit_reserved", message: "Sanctuary host permit durably reserved", meta: { permitDigest: record.permitDigest } });
+            return record;
+        });
+    }
+    read(permitId) {
+        assertPermitId(permitId);
+        return (0, session_transaction_1.withImmediateSessionTurnLease)(this.#ledgerPath, (lease) => {
+            const transaction = (0, session_transaction_1.readSessionTransaction)(this.#ledgerPath, lease);
+            const state = transactionState(transaction);
+            return state.records[permitId] ?? null;
+        });
+    }
+    terminalize(transition) {
+        if (!isObject(transition) || !hasExactKeys(transition, ["permitId", "state", "outcomeDigest", "updatedAt"])) {
+            throw new Error("Sanctuary authority ledger terminal transition is malformed");
+        }
+        assertPermitId(transition.permitId);
+        if (!TERMINAL_STATES.has(String(transition.state))) {
+            throw new Error("Sanctuary authority terminal state is invalid");
+        }
+        assertDigest(transition.outcomeDigest);
+        assertTime(transition.updatedAt);
+        return (0, session_transaction_1.withImmediateSessionTurnLease)(this.#ledgerPath, (lease) => {
+            const transaction = (0, session_transaction_1.readSessionTransaction)(this.#ledgerPath, lease);
+            const state = transactionState(transaction);
+            const current = state.records[transition.permitId];
+            if (!current) {
+                throw new Error(`Sanctuary authority permit ${transition.permitId} is missing`);
+            }
+            if (current.state !== "reserved") {
+                throw new Error(`Sanctuary authority permit ${transition.permitId} state changed`);
+            }
+            const record = {
+                ...current,
+                state: transition.state,
+                outcomeDigest: transition.outcomeDigest,
+                updatedAt: transition.updatedAt,
+            };
+            state.records[record.permitId] = record;
+            this.#write(state, transaction.revision, lease);
+            return record;
+        });
+    }
+    #write(state, expectedRevision, lease) {
+        fs.chmodSync(path.dirname(this.#ledgerPath), 0o700);
+        (0, session_transaction_1.writeSessionTransaction)(this.#ledgerPath, state, { lease, expectedRevision });
+    }
+}
+exports.FileSanctuaryAuthorityLedger = FileSanctuaryAuthorityLedger;