@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/daemon/bluebubbles-health-diagnostics.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stringifyBlueBubblesHealthError = stringifyBlueBubblesHealthError;
+exports.redactBlueBubblesHealthDetailForNerves = redactBlueBubblesHealthDetailForNerves;
+exports.formatBlueBubblesHealthcheckFailure = formatBlueBubblesHealthcheckFailure;
+exports.probeBlueBubblesHealth = probeBlueBubblesHealth;
+const runtime_1 = require("../../nerves/runtime");
+const error_classification_1 = require("../providers/error-classification");
+function buildBlueBubblesApiUrl(baseUrl, endpoint, password) {
+    const root = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+    const url = new URL(endpoint.replace(/^\//, ""), root);
+    url.searchParams.set("password", password);
+    return url.toString();
+}
+function stringifyBlueBubblesHealthError(error) {
+    if (error instanceof Error) {
+        const message = error.message.trim();
+        if (message)
+            return message;
+        return error.name || "unknown";
+    }
+    const value = String(error).trim();
+    return value || "unknown";
+}
+function redactBlueBubblesHealthDetailForNerves(detail) {
+    return detail
+        .replace(/\bbluebubbles\.password\b/gi, "bluebubbles credential")
+        .replace(/\bpassword\b/gi, "credential");
+}
+function blueBubblesHealthStatus(error) {
+    return error instanceof Error && typeof error.status === "number"
+        ? error.status
+        : null;
+}
+function blueBubblesHealthClassification(error) {
+    return error instanceof Error ? (0, error_classification_1.classifyHttpError)(error) : "unknown";
+}
+function formatBlueBubblesHealthcheckFailure(serverUrlInput, error) {
+    const serverUrl = serverUrlInput.trim() || "configured BlueBubbles server";
+    const rawReason = stringifyBlueBubblesHealthError(error);
+    const status = blueBubblesHealthStatus(error);
+    if (!(error instanceof Error)) {
+        return `BlueBubbles health check failed at ${serverUrl}. Check \`bluebubbles.serverUrl\`, confirm the BlueBubbles app/API is running, and inspect daemon logs. Raw error: ${rawReason}`;
+    }
+    switch (blueBubblesHealthClassification(error)) {
+        case "network-error":
+            return `Cannot reach BlueBubbles at ${serverUrl}. Check \`bluebubbles.serverUrl\`, confirm the BlueBubbles app/API is running, and verify this machine can reach it. Raw error: ${rawReason}`;
+        case "auth-failure":
+            return `BlueBubbles auth failed at ${serverUrl} (HTTP ${status}). Check this machine's BlueBubbles attachment with \`ouro connect bluebubbles --agent <agent>\` and confirm the server accepts the password. Raw error: ${rawReason}`;
+        case "server-error":
+            return `BlueBubbles upstream returned HTTP ${status} at ${serverUrl}. Check the BlueBubbles app/server logs and confirm the upstream API is healthy. Raw error: ${rawReason}`;
+        default:
+            return `BlueBubbles health check failed at ${serverUrl}${status === null ? "" : ` (HTTP ${status})`}. Check \`bluebubbles.serverUrl\`, the BlueBubbles server configuration, and daemon logs. Raw error: ${rawReason}`;
+    }
+}
+async function probeBlueBubblesHealth(input) {
+    try {
+        const url = buildBlueBubblesApiUrl(input.serverUrl, "/api/v1/message/count", input.password);
+        const response = await input.fetchImpl(url, {
+            method: "GET",
+            signal: AbortSignal.timeout(input.requestTimeoutMs),
+        });
+        if (!response.ok) {
+            const errorText = await response.text().catch(() => "");
+            const error = new Error(errorText || "unknown");
+            error.status = response.status;
+            throw error;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "daemon",
+            event: "daemon.bluebubbles_health_probe_checked",
+            message: "checked bluebubbles upstream health",
+            meta: {
+                serverUrl: input.serverUrl,
+                ok: true,
+                status: response.status,
+            },
+        });
+        return {
+            ok: true,
+            detail: "upstream reachable",
+            reason: null,
+            status: response.status,
+            classification: null,
+        };
+    }
+    catch (error) {
+        const detail = formatBlueBubblesHealthcheckFailure(input.serverUrl, error);
+        const reason = stringifyBlueBubblesHealthError(error);
+        const status = blueBubblesHealthStatus(error);
+        const classification = blueBubblesHealthClassification(error);
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.bluebubbles_health_probe_checked",
+            message: "checked bluebubbles upstream health",
+            meta: {
+                serverUrl: input.serverUrl,
+                ok: false,
+                status,
+                reason,
+                classification,
+                detail: redactBlueBubblesHealthDetailForNerves(detail),
+            },
+        });
+        return {
+            ok: false,
+            detail,
+            reason,
+            status,
+            classification,
+        };
+    }
+}
+/* v8 ignore start -- module load observability event */
+(0, runtime_1.emitNervesEvent)({
+    component: "daemon",
+    event: "daemon.bluebubbles_health_diagnostics_loaded",
+    message: "bluebubbles health diagnostics loaded",
+    meta: {},
+});
+/* v8 ignore stop */

package/dist/heart/daemon/bluebubbles-host-protocol.js

@@ -0,0 +1,433 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEBUBBLES_HOST_RECEIPTS_DIRECTORY = exports.BLUEBUBBLES_HOST_REQUESTS_DIRECTORY = exports.BLUEBUBBLES_HOST_SHARED_HELPER = exports.BLUEBUBBLES_HOST_SHARED_ROOT = exports.BLUEBUBBLES_HOST_FRESHNESS_MS = exports.BLUEBUBBLES_HOST_HELPER_VERSION = exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION = void 0;
+exports.installBlueBubblesHostSharedHelper = installBlueBubblesHostSharedHelper;
+exports.blueBubblesHostAttemptPath = blueBubblesHostAttemptPath;
+exports.requestCrossUserBlueBubblesHostAction = requestCrossUserBlueBubblesHostAction;
+exports.validateBlueBubblesHostHelperRequest = validateBlueBubblesHostHelperRequest;
+exports.publishBlueBubblesHostReceipt = publishBlueBubblesHostReceipt;
+exports.collectCrossUserBlueBubblesHostAction = collectCrossUserBlueBubblesHostAction;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const bluebubbles_host_1 = require("./bluebubbles-host");
+exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION = 1;
+exports.BLUEBUBBLES_HOST_HELPER_VERSION = 1;
+exports.BLUEBUBBLES_HOST_FRESHNESS_MS = 300_000;
+exports.BLUEBUBBLES_HOST_SHARED_ROOT = "/Users/Shared/Ouro";
+exports.BLUEBUBBLES_HOST_SHARED_HELPER = `${exports.BLUEBUBBLES_HOST_SHARED_ROOT}/bluebubbles-host`;
+exports.BLUEBUBBLES_HOST_REQUESTS_DIRECTORY = `${exports.BLUEBUBBLES_HOST_SHARED_ROOT}/bluebubbles-host-requests`;
+exports.BLUEBUBBLES_HOST_RECEIPTS_DIRECTORY = `${exports.BLUEBUBBLES_HOST_SHARED_ROOT}/bluebubbles-host-receipts`;
+function protocolDeps(overrides = {}) {
+    return {
+        now: Date.now,
+        randomBytes: crypto_1.randomBytes,
+        currentUid: () => process.getuid?.() ?? 0,
+        expectedHelperBytes: () => fs.readFileSync(path.resolve(__dirname, "../../../assets/bluebubbles-host")),
+        existsSync: fs.existsSync,
+        readFileSync: fs.readFileSync,
+        mkdirSync: fs.mkdirSync,
+        chmodSync: fs.chmodSync,
+        writeFileSync: fs.writeFileSync,
+        linkSync: fs.linkSync,
+        unlinkSync: fs.unlinkSync,
+        renameSync: fs.renameSync,
+        lstatSync: fs.lstatSync,
+        ...overrides,
+    };
+}
+function sharedPaths(sharedRoot) {
+    return {
+        helper: path.join(sharedRoot, "bluebubbles-host"),
+        requests: path.join(sharedRoot, "bluebubbles-host-requests"),
+        receipts: path.join(sharedRoot, "bluebubbles-host-receipts"),
+    };
+}
+function fileMode(deps, filePath) {
+    return deps.existsSync(filePath) ? deps.lstatSync(filePath).mode & 0o7777 : null;
+}
+function validateManagedPath(deps, filePath, label, kind, expectedUid) {
+    const stat = deps.lstatSync(filePath);
+    if (stat.isSymbolicLink?.())
+        throw new Error(`${label} must not be a symbolic link`);
+    if (kind === "directory" && stat.isDirectory?.() !== true)
+        throw new Error(`${label} must be a directory`);
+    if (kind === "file" && stat.isFile?.() !== true)
+        throw new Error(`${label} must be a regular file`);
+    if (stat.uid !== expectedUid)
+        throw new Error(`${label} must be owned by uid ${expectedUid}`);
+}
+function ensureDirectory(deps, directoryPath, mode, label, expectedUid) {
+    const priorMode = fileMode(deps, directoryPath);
+    if (priorMode !== null)
+        validateManagedPath(deps, directoryPath, label, "directory", expectedUid);
+    if (priorMode === null)
+        deps.mkdirSync(directoryPath, { recursive: true, mode });
+    validateManagedPath(deps, directoryPath, label, "directory", expectedUid);
+    deps.chmodSync(directoryPath, mode);
+    return priorMode !== mode;
+}
+function writeAtomicReplacement(deps, filePath, content, mode) {
+    const temporaryPath = `${filePath}.${process.pid}.tmp`;
+    try {
+        deps.writeFileSync(temporaryPath, content, { mode, flag: "wx" });
+        deps.chmodSync(temporaryPath, mode);
+        deps.renameSync(temporaryPath, filePath);
+        deps.chmodSync(filePath, mode);
+    }
+    catch (error) {
+        if (deps.existsSync(temporaryPath))
+            deps.unlinkSync(temporaryPath);
+        throw error;
+    }
+}
+function isAlreadyExists(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+function publishNoClobberJson(deps, filePath, value, mode, token, label) {
+    const temporaryPath = `${filePath}.${token}.tmp`;
+    try {
+        deps.writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: "utf8",
+            mode,
+            flag: "wx",
+        });
+        deps.chmodSync(temporaryPath, mode);
+        deps.linkSync(temporaryPath, filePath);
+        deps.chmodSync(filePath, mode);
+    }
+    catch (error) {
+        if (isAlreadyExists(error))
+            throw new Error(`${label} already exists`);
+        throw error;
+    }
+    finally {
+        if (deps.existsSync(temporaryPath))
+            deps.unlinkSync(temporaryPath);
+    }
+}
+function readJson(deps, filePath, label) {
+    try {
+        return JSON.parse(deps.readFileSync(filePath).toString("utf8"));
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`${label} is invalid: ${detail}`);
+    }
+}
+function parseTime(value, label) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new Error(`${label} is invalid`);
+    return parsed;
+}
+function validateUsername(username) {
+    if (!/^[A-Za-z_][A-Za-z0-9._-]*$/.test(username)) {
+        throw new Error("invalid BlueBubbles host username");
+    }
+}
+function validateUid(uid) {
+    if (!Number.isInteger(uid) || uid < 500)
+        throw new Error("BlueBubbles host uid must be at least 500");
+}
+function validateAction(action) {
+    if (!["install", "status", "repair", "remove"].includes(action)) {
+        throw new Error("unsupported host action");
+    }
+}
+function validateRequestShape(request) {
+    if (request.schemaVersion !== exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION) {
+        throw new Error("unsupported request schema");
+    }
+    if (request.helperVersion !== exports.BLUEBUBBLES_HOST_HELPER_VERSION) {
+        throw new Error("unsupported helper version");
+    }
+    validateUsername(request.username);
+    validateUid(request.uid);
+    validateAction(request.action);
+    if (!/^[0-9a-f]{64}$/.test(request.nonce))
+        throw new Error("invalid request nonce");
+    if (request.requestId !== `${request.uid}-${request.nonce}`)
+        throw new Error("request id does not match uid and nonce");
+    const requestedAtMs = parseTime(request.requestedAt, "request timestamp");
+    const expiresAtMs = parseTime(request.expiresAt, "request expiry");
+    if (expiresAtMs - requestedAtMs > exports.BLUEBUBBLES_HOST_FRESHNESS_MS) {
+        throw new Error("request freshness window exceeds 300000 ms");
+    }
+    return { requestedAtMs, expiresAtMs };
+}
+function installBlueBubblesHostSharedHelper(input, overrides = {}) {
+    const deps = protocolDeps(overrides);
+    const root = input.sharedRoot ?? exports.BLUEBUBBLES_HOST_SHARED_ROOT;
+    const paths = sharedPaths(root);
+    const asset = deps.readFileSync(input.assetPath);
+    const expectedUid = deps.currentUid();
+    let changed = false;
+    changed = ensureDirectory(deps, root, 0o755, "shared root", expectedUid) || changed;
+    changed = ensureDirectory(deps, paths.requests, 0o755, "shared request directory", expectedUid) || changed;
+    changed = ensureDirectory(deps, paths.receipts, 0o1777, "shared receipt directory", expectedUid) || changed;
+    if (deps.existsSync(paths.helper))
+        validateManagedPath(deps, paths.helper, "shared helper", "file", expectedUid);
+    const helperCurrent = deps.existsSync(paths.helper) && deps.readFileSync(paths.helper).equals(asset);
+    const helperModeCurrent = fileMode(deps, paths.helper) === 0o755;
+    if (!helperCurrent) {
+        writeAtomicReplacement(deps, paths.helper, asset, 0o755);
+        changed = true;
+    }
+    else {
+        deps.chmodSync(paths.helper, 0o755);
+        changed = !helperModeCurrent || changed;
+    }
+    validateManagedPath(deps, paths.helper, "shared helper", "file", expectedUid);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bluebubbles_host_helper_installed",
+        message: "installed shared BlueBubbles host helper state",
+        meta: { changed, helperPath: paths.helper },
+    });
+    return { changed, helperPath: paths.helper };
+}
+function blueBubblesHostAttemptPath(originHomeDir, requestId) {
+    return path.join(originHomeDir, ".ouro-cli", "bluebubbles-host", "attempts", `${requestId}.json`);
+}
+function requestCrossUserBlueBubblesHostAction(input, overrides = {}) {
+    const deps = protocolDeps(overrides);
+    validateUsername(input.username);
+    validateUid(input.uid);
+    validateAction(input.action);
+    if (!path.isAbsolute(input.targetHomeDir))
+        throw new Error("target home must be absolute");
+    if (!deps.existsSync(input.targetHomeDir))
+        throw new Error(`target home does not exist: ${input.targetHomeDir}`);
+    validateManagedPath(deps, input.targetHomeDir, "target home", "directory", input.uid);
+    const nonceBytes = deps.randomBytes(32);
+    if (nonceBytes.length !== 32)
+        throw new Error("BlueBubbles host nonce source must return 32 bytes");
+    const nonce = nonceBytes.toString("hex");
+    const requestId = `${input.uid}-${nonce}`;
+    const requestedAtMs = deps.now();
+    const request = {
+        schemaVersion: exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION,
+        helperVersion: exports.BLUEBUBBLES_HOST_HELPER_VERSION,
+        requestId,
+        nonce,
+        action: input.action,
+        username: input.username,
+        uid: input.uid,
+        requestedAt: new Date(requestedAtMs).toISOString(),
+        expiresAt: new Date(requestedAtMs + exports.BLUEBUBBLES_HOST_FRESHNESS_MS).toISOString(),
+    };
+    const root = input.sharedRoot ?? exports.BLUEBUBBLES_HOST_SHARED_ROOT;
+    const paths = sharedPaths(root);
+    const expectedUid = deps.currentUid();
+    validateManagedPath(deps, root, "shared root", "directory", expectedUid);
+    validateManagedPath(deps, paths.requests, "shared request directory", "directory", expectedUid);
+    validateManagedPath(deps, paths.helper, "shared helper", "file", expectedUid);
+    if (fileMode(deps, root) !== 0o755)
+        throw new Error("shared root mode must be 0755");
+    if (fileMode(deps, paths.requests) !== 0o755)
+        throw new Error("shared request directory mode must be 0755");
+    if (fileMode(deps, paths.helper) !== 0o755)
+        throw new Error("shared helper mode must be 0755");
+    if (!deps.readFileSync(paths.helper).equals(deps.expectedHelperBytes())) {
+        throw new Error("shared helper bytes do not match the packaged helper");
+    }
+    const requestPath = path.join(paths.requests, `${requestId}.json`);
+    const attemptPath = blueBubblesHostAttemptPath(input.originHomeDir, requestId);
+    const attempt = {
+        schemaVersion: exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION,
+        status: "pending",
+        request,
+        targetHomeDir: input.targetHomeDir,
+    };
+    deps.mkdirSync(path.dirname(attemptPath), { recursive: true, mode: 0o700 });
+    deps.chmodSync(path.dirname(attemptPath), 0o700);
+    publishNoClobberJson(deps, attemptPath, attempt, 0o600, nonce, "attempt");
+    try {
+        publishNoClobberJson(deps, requestPath, request, 0o444, nonce, "request");
+    }
+    catch (error) {
+        deps.unlinkSync(attemptPath);
+        throw error;
+    }
+    const result = {
+        classification: "human-required",
+        requestId,
+        requestPath,
+        helperCommand: `${paths.helper} --request ${requestPath}`,
+        collectCommand: `ouro bluebubbles host collect --request-id ${requestId}`,
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bluebubbles_host_handoff_created",
+        message: "created nonce-bound cross-user BlueBubbles host handoff",
+        meta: { requestId, uid: input.uid, action: input.action },
+    });
+    return result;
+}
+function validateBlueBubblesHostHelperRequest(input) {
+    const { requestedAtMs, expiresAtMs } = validateRequestShape(input.request);
+    if (input.currentUsername !== input.request.username)
+        throw new Error("target username mismatch");
+    if (input.currentUid !== input.request.uid)
+        throw new Error("target uid mismatch");
+    if (!input.launchdDomainAvailable) {
+        throw new Error(`logged-in gui/${input.request.uid} session is unavailable`);
+    }
+    if (requestedAtMs > input.nowMs)
+        throw new Error("request timestamp is in the future");
+    if (input.nowMs > expiresAtMs)
+        throw new Error("request expired");
+    return { request: input.request, launchdDomain: `gui/${input.request.uid}` };
+}
+function publishBlueBubblesHostReceipt(receipt, input = {}, overrides = {}) {
+    const deps = protocolDeps(overrides);
+    if (!/^\d+-[0-9a-f]{64}$/.test(receipt.requestId))
+        throw new Error("invalid BlueBubbles host receipt request id");
+    const root = input.sharedRoot ?? exports.BLUEBUBBLES_HOST_SHARED_ROOT;
+    const receiptPath = path.join(sharedPaths(root).receipts, `${receipt.requestId}.json`);
+    publishNoClobberJson(deps, receiptPath, receipt, 0o444, receipt.nonce, "receipt");
+    return receiptPath;
+}
+function expectedPlistPath(targetHomeDir) {
+    return path.join(targetHomeDir, "Library", "LaunchAgents", `${bluebubbles_host_1.BLUEBUBBLES_LAUNCH_AGENT_LABEL}.plist`);
+}
+function requireReceiptMatch(request, targetHomeDir, receipt) {
+    const exactFields = [
+        "schemaVersion",
+        "helperVersion",
+        "requestId",
+        "nonce",
+        "action",
+        "username",
+        "uid",
+        "requestedAt",
+        "expiresAt",
+    ];
+    for (const field of exactFields) {
+        if (receipt[field] !== request[field])
+            throw new Error(`receipt ${field} does not match request`);
+    }
+    if (receipt.appPath !== bluebubbles_host_1.BLUEBUBBLES_APP_PATH)
+        throw new Error("receipt app path does not match");
+    if (receipt.plistPath !== expectedPlistPath(targetHomeDir))
+        throw new Error("receipt plist path does not match");
+    if (receipt.launchAgentLabel !== bluebubbles_host_1.BLUEBUBBLES_LAUNCH_AGENT_LABEL) {
+        throw new Error("receipt launch agent label does not match");
+    }
+    if (receipt.launchdDomain !== `gui/${request.uid}`)
+        throw new Error("receipt launchd domain does not match");
+    if (receipt.result !== "verified" && receipt.result !== "failed")
+        throw new Error("receipt result is invalid");
+    if (typeof receipt.detail !== "string" || receipt.detail.length === 0)
+        throw new Error("receipt detail is invalid");
+    const verifiedAtMs = parseTime(receipt.verifiedAt, "receipt verification timestamp");
+    const requestedAtMs = parseTime(request.requestedAt, "request timestamp");
+    const expiresAtMs = parseTime(request.expiresAt, "request expiry");
+    if (verifiedAtMs < requestedAtMs || verifiedAtMs > expiresAtMs) {
+        throw new Error("receipt verification is outside request freshness");
+    }
+}
+function collectCrossUserBlueBubblesHostAction(input, overrides = {}) {
+    const deps = protocolDeps(overrides);
+    if (!/^\d+-[0-9a-f]{64}$/.test(input.requestId))
+        throw new Error("invalid BlueBubbles host request id");
+    const attemptPath = blueBubblesHostAttemptPath(input.originHomeDir, input.requestId);
+    if (!deps.existsSync(attemptPath))
+        throw new Error("BlueBubbles host attempt is missing");
+    const attempt = readJson(deps, attemptPath, "BlueBubbles host attempt");
+    if (attempt.schemaVersion !== exports.BLUEBUBBLES_HOST_PROTOCOL_SCHEMA_VERSION) {
+        throw new Error("BlueBubbles host attempt state is invalid");
+    }
+    const request = attempt.request;
+    validateRequestShape(request);
+    if (request.requestId !== input.requestId)
+        throw new Error("attempt request id does not match collection request");
+    if (typeof attempt.targetHomeDir !== "string" || !path.isAbsolute(attempt.targetHomeDir)) {
+        throw new Error("BlueBubbles host attempt target home is invalid");
+    }
+    if (attempt.status === "collected" && attempt.collection) {
+        if (attempt.collection.requestId !== request.requestId || attempt.collection.status !== "collected") {
+            throw new Error("stored collection request id does not match");
+        }
+        requireReceiptMatch(request, attempt.targetHomeDir, attempt.collection.receipt);
+        const expectedDetail = attempt.collection.receipt.result === "verified"
+            ? `launchd verified at ${attempt.collection.receipt.verifiedAt}; current service state requires a fresh helper run`
+            : `launchd helper reported failure at ${attempt.collection.receipt.verifiedAt}; current service state requires a fresh helper run`;
+        if (attempt.collection.detail !== expectedDetail)
+            throw new Error("stored collection detail does not match receipt");
+        return attempt.collection;
+    }
+    if (attempt.status !== "pending")
+        throw new Error("BlueBubbles host attempt state is invalid");
+    const root = input.sharedRoot ?? exports.BLUEBUBBLES_HOST_SHARED_ROOT;
+    const paths = sharedPaths(root);
+    const expectedUid = deps.currentUid();
+    validateManagedPath(deps, root, "shared root", "directory", expectedUid);
+    validateManagedPath(deps, paths.receipts, "shared receipt directory", "directory", expectedUid);
+    const receiptPath = path.join(paths.receipts, `${input.requestId}.json`);
+    if (!deps.existsSync(receiptPath))
+        throw new Error("BlueBubbles host receipt is missing");
+    const receiptStat = deps.lstatSync(receiptPath);
+    if (receiptStat.isSymbolicLink?.())
+        throw new Error("BlueBubbles host receipt must not be a symbolic link");
+    if (receiptStat.isFile?.() !== true)
+        throw new Error("BlueBubbles host receipt must be a regular file");
+    if (receiptStat.uid !== request.uid)
+        throw new Error(`receipt owner uid ${receiptStat.uid} does not match target uid ${request.uid}`);
+    if ((receiptStat.mode & 0o7777) !== 0o444)
+        throw new Error("BlueBubbles host receipt mode must be 0444");
+    const receipt = readJson(deps, receiptPath, "BlueBubbles host receipt");
+    requireReceiptMatch(request, attempt.targetHomeDir, receipt);
+    const detail = receipt.result === "verified"
+        ? `launchd verified at ${receipt.verifiedAt}; current service state requires a fresh helper run`
+        : `launchd helper reported failure at ${receipt.verifiedAt}; current service state requires a fresh helper run`;
+    const collection = {
+        requestId: request.requestId,
+        status: "collected",
+        detail,
+        receipt,
+    };
+    writeAtomicReplacement(deps, attemptPath, `${JSON.stringify({ ...attempt, status: "collected", collection }, null, 2)}\n`, 0o600);
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.bluebubbles_host_receipt_collected",
+        message: "collected ownership-bound BlueBubbles host receipt",
+        meta: { requestId: request.requestId, uid: request.uid, result: receipt.result },
+    });
+    return collection;
+}