@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/daemon/sanctuary-host-authority.js

@@ -0,0 +1,1008 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSanctuaryHostAuthority = void 0;
+exports.hasHostInlineCodeSwitch = hasHostInlineCodeSwitch;
+exports.validateHostProposalRequest = validateHostProposalRequest;
+exports.hostProposalCommitment = hostProposalCommitment;
+exports.sanctuaryHostAuthorityStatePath = sanctuaryHostAuthorityStatePath;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const session_transaction_1 = require("../../mind/session-transaction");
+const sanctuary_authority_codec_1 = require("./sanctuary-authority-codec");
+const SCHEMA_VERSION = 1;
+const PROPOSAL_DOMAIN = "ouro.sanctuary.host-proposal.v1";
+const REGISTRATION_DOMAIN = "ouro.sanctuary.host-registration.v1";
+const DECISION_DOMAIN = "ouro.sanctuary.host-decision.v1";
+const PERMIT_DOMAIN = "ouro.sanctuary.host-permit.v1";
+const RECEIPT_DOMAIN = "ouro.sanctuary.host-receipt.v1";
+const RETIREMENT_DOMAIN = "ouro.sanctuary.host-retirement.v1";
+const ROOT_HOST_PREFIX = "<b>OURO ROOT HOST APPROVAL</b>";
+const APPROVAL_TTL_MS = 300_000;
+const MAX_TIMEOUT_MS = 900_000;
+const MAX_SCRIPT_BYTES = 2_048;
+const MAX_ARGUMENTS = 64;
+const MAX_ARGUMENT_BYTES = 512;
+const PRINTABLE_ASCII = /^[\x20-\x7e]+$/u;
+const SCRIPT_BYTES = /^[\x0a\x20-\x7e]+$/u;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const DECIMAL_ID = /^[1-9][0-9]*$/u;
+const REGISTRATION_ID = /^hostreg-[A-Za-z0-9_-]{43}$/u;
+const CALLBACK_ID = /^[\x20-\x7e]{1,256}$/u;
+const INLINE_CODE_SWITCHES = new Set(["-c", "-e", "--eval", "--evaluate"]);
+const CARD_STATUS = {
+    committed: "Awaiting owner decision.",
+    approved: "Approved. Root execution is pending.",
+    denied: "Denied. This approval is consumed and cannot be reused.",
+    expired: "Expired. This approval is consumed and cannot be reused.",
+    executed_verified: "Execution completed and verification succeeded.",
+    executed_failed: "Execution failed or was interrupted.",
+    executed_ambiguous: "Execution finished, but verification is ambiguous.",
+    retired: "Authority retired before execution. This permit is refused.",
+};
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validTime(value) {
+    if (typeof value !== "string")
+        return false;
+    const instant = new Date(value);
+    return !Number.isNaN(instant.getTime()) && instant.toISOString() === value;
+}
+function printable(value, maximum) {
+    return typeof value === "string" && value.length > 0 && value.length <= maximum && PRINTABLE_ASCII.test(value);
+}
+function absoluteExecutable(value) {
+    return printable(value, 512)
+        && path.posix.isAbsolute(value)
+        && path.posix.normalize(value) === value
+        && !value.includes("/../")
+        && !value.endsWith("/..");
+}
+function validArguments(value) {
+    return Array.isArray(value)
+        && value.length <= MAX_ARGUMENTS
+        && value.every((argument) => printable(argument, MAX_ARGUMENT_BYTES));
+}
+function hasHostInlineCodeSwitch(arguments_, program) {
+    const name = typeof program === "string" ? path.posix.basename(program) : "";
+    return arguments_.some((argument) => INLINE_CODE_SWITCHES.has(argument)
+        || [...INLINE_CODE_SWITCHES].some((flag) => argument.startsWith(`${flag}=`))
+        || /^-[A-Za-z]*c/u.test(argument)
+        || (/^(node|nodejs)$/u.test(name) && (/^-[A-Za-z]*[ep]/u.test(argument) || /^--print(?:=|$)/u.test(argument)))
+        || (name === "perl" && /^-[A-Za-z]*[eE]/u.test(argument))
+        || (name === "ruby" && /^-[A-Za-z]*e/u.test(argument)));
+}
+function validateCommand(value) {
+    if (!isObject(value) || typeof value.kind !== "string")
+        throw new Error("Sanctuary host command is invalid");
+    if (value.kind === "executable") {
+        if (!exactKeys(value, ["kind", "executable", "arguments"])
+            || !absoluteExecutable(value.executable)
+            || !validArguments(value.arguments)
+            || hasHostInlineCodeSwitch(value.arguments, value.executable)) {
+            throw new Error("Sanctuary host executable command is invalid");
+        }
+        return;
+    }
+    if (value.kind !== "script"
+        || !exactKeys(value, ["kind", "interpreter", "arguments", "script"])
+        || !absoluteExecutable(value.interpreter)
+        || !validArguments(value.arguments)
+        || hasHostInlineCodeSwitch(value.arguments, value.interpreter)
+        || typeof value.script !== "string"
+        || Buffer.byteLength(value.script, "utf8") === 0
+        || Buffer.byteLength(value.script, "utf8") > MAX_SCRIPT_BYTES
+        || !SCRIPT_BYTES.test(value.script)
+        || value.script.split("\n").some((line) => line.endsWith(" "))) {
+        throw new Error("Sanctuary host script command is invalid");
+    }
+}
+function validateHostProposalRequest(value, expectedHost) {
+    if (!isObject(value) || !exactKeys(value, [
+        "targetHost",
+        "targetResource",
+        "command",
+        "workingDirectoryProfile",
+        "environmentProfile",
+        "timeoutMs",
+        "verification",
+        "ownerObservation",
+    ])) {
+        throw new Error("Sanctuary host proposal is malformed");
+    }
+    if (value.targetHost !== expectedHost
+        || !printable(value.targetResource, 256)
+        || value.workingDirectoryProfile !== "host.root.v1"
+        || value.environmentProfile !== "host.clean.v1"
+        || !Number.isSafeInteger(value.timeoutMs)
+        || value.timeoutMs < 1_000
+        || value.timeoutMs > MAX_TIMEOUT_MS) {
+        throw new Error("Sanctuary host proposal fields are invalid");
+    }
+    validateCommand(value.command);
+    if (value.verification !== null) {
+        if (!isObject(value.verification)
+            || !exactKeys(value.verification, ["profile", "expectedStateDigest"])
+            || value.verification.profile !== "file.digest.v1"
+            || typeof value.verification.expectedStateDigest !== "string"
+            || !DIGEST.test(value.verification.expectedStateDigest)
+            || !absoluteExecutable(value.targetResource)) {
+            throw new Error("Sanctuary host verification is invalid");
+        }
+    }
+    if (!isObject(value.ownerObservation)
+        || !exactKeys(value.ownerObservation, ["digest", "updateId", "userId", "chatId", "messageId"])
+        || typeof value.ownerObservation.digest !== "string"
+        || !DIGEST.test(value.ownerObservation.digest)
+        || !Number.isSafeInteger(value.ownerObservation.updateId)
+        || value.ownerObservation.updateId < 0
+        || typeof value.ownerObservation.userId !== "string"
+        || !DECIMAL_ID.test(value.ownerObservation.userId)
+        || typeof value.ownerObservation.chatId !== "string"
+        || !DECIMAL_ID.test(value.ownerObservation.chatId)
+        || typeof value.ownerObservation.messageId !== "string"
+        || !DECIMAL_ID.test(value.ownerObservation.messageId)) {
+        throw new Error("Sanctuary host owner observation is invalid");
+    }
+}
+function html(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll("\"", "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function digestText(value) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(value, "utf8").digest("hex")}`;
+}
+function hostProposalCommitment(proposal) {
+    return (0, sanctuary_authority_codec_1.authorityArtifactDigest)(PROPOSAL_DOMAIN, proposal);
+}
+function renderProposal(proposal, proposalDigest) {
+    const command = proposal.command.kind === "executable"
+        ? [
+            `<b>Executable:</b> <code>${html(proposal.command.executable)}</code>`,
+            `<b>Arguments:</b> <code>${html((0, sanctuary_authority_codec_1.canonicalAuthorityJson)(proposal.command.arguments))}</code>`,
+        ]
+        : [
+            `<b>Interpreter:</b> <code>${html(proposal.command.interpreter)}</code>`,
+            `<b>Arguments:</b> <code>${html((0, sanctuary_authority_codec_1.canonicalAuthorityJson)(proposal.command.arguments))}</code>`,
+            `<b>Complete script bytes:</b>\n<pre>${html(proposal.command.script)}</pre>`,
+        ];
+    return [
+        ROOT_HOST_PREFIX,
+        "",
+        "<b>Effect:</b> unrestricted root, potentially destructive and persistent",
+        "<b>Namespaces:</b> real Sanctuary host namespaces",
+        `<b>Target:</b> ${html(proposal.targetHost)} / ${html(proposal.targetResource)}`,
+        ...command,
+        `<b>Working directory profile:</b> ${html(proposal.workingDirectoryProfile)} (resolved path <code>/</code>)`,
+        `<b>Environment profile:</b> ${html(proposal.environmentProfile)}`,
+        `<b>Timeout:</b> ${proposal.timeoutMs} ms`,
+        `<b>Verification:</b> ${proposal.verification ? `${html(proposal.verification.profile)} / ${proposal.verification.expectedStateDigest}` : "none"}`,
+        `<b>Proposal commitment:</b> <code>${proposalDigest}</code>`,
+        "",
+        "Approved uid-0 code can read or change this gateway, its token and signing key; escape process controls; survive the receipt; install persistence; and invalidate future authority. Approval prevents an unapproved start. It cannot contain malicious code after approval.",
+    ].join("\n");
+}
+function initialState() {
+    return { schemaVersion: SCHEMA_VERSION, records: {}, callbackIds: {}, messageIds: {} };
+}
+function requireState(condition) {
+    if (!condition)
+        throw new Error("Sanctuary host authority state is malformed");
+}
+function validateStoredProposal(value, expectedHost) {
+    requireState(isObject(value));
+    const proposal = value;
+    requireState(exactKeys(proposal, [
+        "targetHost",
+        "targetResource",
+        "command",
+        "workingDirectoryProfile",
+        "environmentProfile",
+        "timeoutMs",
+        "verification",
+        "ownerObservation",
+        "expiresAt",
+    ]));
+    const { expiresAt, ...request } = proposal;
+    validateHostProposalRequest(request, expectedHost);
+    requireState(validTime(expiresAt));
+}
+function validateStoredArtifact(value, domain, options) {
+    return (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+        artifact: value,
+        expectedDomain: domain,
+        expectedKeyId: options.keyId,
+        publicKey: options.publicKey,
+    });
+}
+function validateStoredRecord(registrationId, value, options) {
+    requireState(REGISTRATION_ID.test(registrationId));
+    requireState(isObject(value));
+    const record = value;
+    requireState(typeof record.state === "string");
+    const preparedKeys = [
+        "schemaVersion",
+        "state",
+        "registrationId",
+        "proposal",
+        "proposalDigest",
+        "prompt",
+        "promptDigest",
+        "approveHandle",
+        "denyHandle",
+        "approveHandleDigest",
+        "denyHandleDigest",
+        "preparedAt",
+        "expiresAt",
+        "nonce",
+    ];
+    const committedKeys = [
+        ...preparedKeys,
+        "telegramMessageId",
+        "registration",
+        "callbackQueryId",
+        "callbackObservationDigest",
+        "decidedAt",
+        "decision",
+        "permit",
+        "receipt",
+        "cardRevision",
+        "cardRenderedRevision",
+    ];
+    if (record.state === "orphaned") {
+        requireState(exactKeys(record, [...preparedKeys.filter((key) => key !== "approveHandle" && key !== "denyHandle"), "orphanedAt"]));
+    }
+    else if (record.state === "prepared") {
+        requireState(exactKeys(record, preparedKeys));
+    }
+    else {
+        requireState(["committed", "approved", "denied", "expired", "permitted", "executed", "retired"].includes(record.state));
+        requireState(exactKeys(record, committedKeys));
+    }
+    requireState(record.schemaVersion === SCHEMA_VERSION);
+    requireState(record.registrationId === registrationId);
+    validateStoredProposal(record.proposal, options.targetHost);
+    const proposal = record.proposal;
+    requireState(record.proposalDigest === hostProposalCommitment(proposal));
+    requireState(record.prompt === renderProposal(proposal, record.proposalDigest));
+    requireState(record.promptDigest === digestText(record.prompt));
+    requireState(validTime(record.preparedAt));
+    requireState(record.expiresAt === proposal.expiresAt);
+    requireState(Date.parse(record.expiresAt) === Date.parse(record.preparedAt) + APPROVAL_TTL_MS);
+    requireState(typeof record.nonce === "string");
+    requireState(/^[A-Za-z0-9_-]{43}$/u.test(record.nonce));
+    requireState(typeof record.approveHandleDigest === "string");
+    requireState(typeof record.denyHandleDigest === "string");
+    if (record.state === "orphaned") {
+        requireState(validTime(record.orphanedAt));
+        return;
+    }
+    requireState(printable(record.approveHandle, 256));
+    requireState(printable(record.denyHandle, 256));
+    requireState(record.approveHandleDigest === digestText(record.approveHandle));
+    requireState(record.denyHandleDigest === digestText(record.denyHandle));
+    if (record.state === "prepared")
+        return;
+    requireState(Number.isSafeInteger(record.telegramMessageId));
+    requireState(record.telegramMessageId > 0);
+    const registration = validateStoredArtifact(record.registration, REGISTRATION_DOMAIN, options);
+    requireState(registration.registrationId === registrationId);
+    requireState(registration.proposalDigest === record.proposalDigest);
+    requireState(registration.telegramMessageId === record.telegramMessageId);
+    requireState(registration.targetHost === options.targetHost);
+    requireState(registration.publicKeyDigest === options.publicKeyDigest);
+    const validCardRevisions = Object.keys(CARD_STATUS);
+    requireState(validCardRevisions.includes(record.cardRevision));
+    requireState(validCardRevisions.includes(record.cardRenderedRevision));
+    if (record.state === "committed") {
+        requireState(record.callbackQueryId === null);
+        requireState(record.callbackObservationDigest === null);
+        requireState(record.decidedAt === null);
+        requireState(record.decision === null);
+        requireState(record.permit === null);
+        requireState(record.receipt === null);
+        requireState(record.cardRevision === record.state);
+        return;
+    }
+    if (record.state === "expired" && record.callbackQueryId === null) {
+        requireState(record.callbackObservationDigest === null);
+        requireState(record.decidedAt === null);
+        requireState(record.decision === null);
+        requireState(record.permit === null);
+        requireState(record.receipt === null);
+        requireState(record.cardRevision === "expired");
+        return;
+    }
+    requireState(printable(record.callbackQueryId, 256));
+    requireState(typeof record.callbackObservationDigest === "string");
+    requireState(DIGEST.test(record.callbackObservationDigest));
+    requireState(validTime(record.decidedAt));
+    const decision = validateStoredArtifact(record.decision, DECISION_DOMAIN, options);
+    requireState(decision.registrationId === registrationId);
+    requireState(decision.callbackQueryId === record.callbackQueryId);
+    requireState(decision.callbackObservationDigest === record.callbackObservationDigest);
+    requireState(decision.decidedAt === record.decidedAt);
+    requireState(decision.decision === (record.state === "denied" ? "deny" : "approve"));
+    if (record.state === "approved" || record.state === "denied" || record.state === "expired") {
+        requireState(record.permit === null);
+        requireState(record.receipt === null);
+        requireState(record.cardRevision === (record.state === "expired" ? "expired" : record.state));
+        return;
+    }
+    const permit = validateStoredArtifact(record.permit, PERMIT_DOMAIN, options);
+    requireState(permit.registrationId === registrationId);
+    requireState(permit.targetHost === options.targetHost);
+    requireState(permit.publicKeyDigest === options.publicKeyDigest);
+    if (record.state === "permitted") {
+        requireState(record.receipt === null);
+        requireState(record.cardRevision === "approved");
+        return;
+    }
+    const receipt = validateStoredArtifact(record.receipt, record.state === "retired" ? RETIREMENT_DOMAIN : RECEIPT_DOMAIN, options);
+    requireState(receipt.registrationId === registrationId);
+    requireState(receipt.permitId === permit.permitId);
+    requireState(receipt.permitDigest === (0, sanctuary_authority_codec_1.authorityArtifactDigest)(PERMIT_DOMAIN, permit));
+    requireState(receipt.targetHost === options.targetHost);
+    requireState(receipt.publicKeyDigest === options.publicKeyDigest);
+    requireState(record.cardRevision === (record.state === "retired" ? "retired" : `executed_${String(receipt.state)}`));
+}
+function validateHostAuthorityState(value, options) {
+    requireState(isObject(value));
+    const state = value;
+    requireState(exactKeys(state, ["schemaVersion", "records", "callbackIds", "messageIds"]));
+    requireState(state.schemaVersion === SCHEMA_VERSION);
+    requireState(isObject(state.records));
+    requireState(isObject(state.callbackIds));
+    requireState(isObject(state.messageIds));
+    const records = state.records;
+    for (const [registrationId, record] of Object.entries(records)) {
+        validateStoredRecord(registrationId, record, options);
+    }
+    const expectedCallbackIds = {};
+    const expectedMessageIds = {};
+    for (const [registrationId, record] of Object.entries(records)) {
+        if ("telegramMessageId" in record)
+            expectedMessageIds[String(record.telegramMessageId)] = registrationId;
+        if ("callbackQueryId" in record && record.callbackQueryId)
+            expectedCallbackIds[record.callbackQueryId] = registrationId;
+    }
+    requireState((0, sanctuary_authority_codec_1.canonicalAuthorityJson)(state.callbackIds) === (0, sanctuary_authority_codec_1.canonicalAuthorityJson)(expectedCallbackIds));
+    requireState((0, sanctuary_authority_codec_1.canonicalAuthorityJson)(state.messageIds) === (0, sanctuary_authority_codec_1.canonicalAuthorityJson)(expectedMessageIds));
+    return state;
+}
+function sanctuaryHostAuthorityStatePath(agentRoot) {
+    return path.join(agentRoot, "authority", "host-authority.json");
+}
+class FileSanctuaryHostAuthority {
+    #statePath;
+    #options;
+    constructor(agentRoot, options) {
+        if (!path.isAbsolute(agentRoot))
+            throw new Error("Sanctuary host authority root must be absolute");
+        this.#statePath = sanctuaryHostAuthorityStatePath(agentRoot);
+        this.#options = options;
+    }
+    prepare(request) {
+        const now = this.#now();
+        validateHostProposalRequest(request, this.#options.targetHost);
+        const proposal = {
+            ...request,
+            expiresAt: new Date(Date.parse(now) + APPROVAL_TTL_MS).toISOString(),
+        };
+        const observation = this.#options.resolveOwnerObservation({
+            updateId: proposal.ownerObservation.updateId,
+            observationDigest: proposal.ownerObservation.digest,
+        });
+        if (!observation
+            || (0, sanctuary_authority_codec_1.authorityArtifactDigest)(observation.domain, observation.payload) !== proposal.ownerObservation.digest
+            || observation.payload.targetHost !== this.#options.targetHost
+            || observation.payload.botId !== this.#options.botId
+            || observation.payload.publicKeyDigest !== this.#options.publicKeyDigest
+            || !observation.payload.ownerEligible
+            || observation.payload.userId !== this.#options.ownerUserId
+            || observation.payload.chatId !== this.#options.ownerChatId
+            || observation.payload.updateId !== proposal.ownerObservation.updateId
+            || observation.payload.userId !== proposal.ownerObservation.userId
+            || observation.payload.chatId !== proposal.ownerObservation.chatId
+            || observation.payload.messageId !== proposal.ownerObservation.messageId) {
+            throw new Error("Sanctuary host owner observation is not root-authorized");
+        }
+        const proposalDigest = hostProposalCommitment(proposal);
+        const registrationNonce = this.#nonce();
+        const registrationId = `hostreg-${registrationNonce}`;
+        const approveHandle = `ouh:a:${this.#nonce()}`;
+        const denyHandle = `ouh:d:${this.#nonce()}`;
+        const prompt = renderProposal(proposal, proposalDigest);
+        if (prompt.length > 4_096)
+            throw new Error("Sanctuary host approval prompt is too large");
+        const record = {
+            schemaVersion: SCHEMA_VERSION,
+            state: "prepared",
+            registrationId,
+            proposal,
+            proposalDigest,
+            prompt,
+            promptDigest: digestText(prompt),
+            approveHandle,
+            denyHandle,
+            approveHandleDigest: digestText(approveHandle),
+            denyHandleDigest: digestText(denyHandle),
+            preparedAt: now,
+            expiresAt: proposal.expiresAt,
+            nonce: registrationNonce,
+        };
+        this.#transaction((state) => {
+            if (Object.values(state.records).some((record) => record.state === "prepared" || record.state === "committed" || record.state === "approved" || record.state === "permitted")) {
+                throw new Error("Sanctuary host approval is already active");
+            }
+            if (state.records[registrationId])
+                throw new Error("Sanctuary host registration id already exists");
+            state.records[registrationId] = record;
+        });
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_host_approval_prepared", message: "Sanctuary host approval intent durably prepared", meta: { proposalDigest } });
+        return {
+            registrationId,
+            proposalDigest,
+            prompt,
+            expiresAt: proposal.expiresAt,
+            replyMarkup: {
+                inline_keyboard: [[
+                        { text: "Approve root execution", callback_data: approveHandle },
+                        { text: "Deny", callback_data: denyHandle },
+                    ]],
+            },
+        };
+    }
+    commit(input) {
+        if (!REGISTRATION_ID.test(input.registrationId)
+            || !Number.isSafeInteger(input.telegramMessageId)
+            || input.telegramMessageId <= 0) {
+            throw new Error("Sanctuary host registration commit is invalid");
+        }
+        let registration;
+        this.#transaction((state) => {
+            const current = state.records[input.registrationId];
+            if (!current || current.state !== "prepared")
+                throw new Error("Sanctuary host registration is not prepared");
+            if (state.messageIds[String(input.telegramMessageId)])
+                throw new Error("Sanctuary host approval message already exists");
+            registration = (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                domain: REGISTRATION_DOMAIN,
+                keyId: this.#options.keyId,
+                privateKey: this.#options.privateKey,
+                payload: {
+                    targetHost: this.#options.targetHost,
+                    botId: this.#options.botId,
+                    targetResource: current.proposal.targetResource,
+                    registrationId: current.registrationId,
+                    proposalDigest: current.proposalDigest,
+                    ownerObservationDigest: current.proposal.ownerObservation.digest,
+                    ownerUpdateId: current.proposal.ownerObservation.updateId,
+                    ownerUserId: current.proposal.ownerObservation.userId,
+                    ownerChatId: current.proposal.ownerObservation.chatId,
+                    ownerMessageId: current.proposal.ownerObservation.messageId,
+                    command: current.proposal.command,
+                    workingDirectoryProfile: current.proposal.workingDirectoryProfile,
+                    environmentProfile: current.proposal.environmentProfile,
+                    timeoutMs: current.proposal.timeoutMs,
+                    verification: current.proposal.verification,
+                    prompt: current.prompt,
+                    promptDigest: current.promptDigest,
+                    displayedProposalDigest: current.proposalDigest,
+                    marker: ROOT_HOST_PREFIX,
+                    telegramMessageId: input.telegramMessageId,
+                    approveHandleDigest: current.approveHandleDigest,
+                    denyHandleDigest: current.denyHandleDigest,
+                    registeredAt: this.#now(),
+                    expiresAt: current.expiresAt,
+                    nonce: current.nonce,
+                    publicKeyDigest: this.#options.publicKeyDigest,
+                },
+            });
+            const committed = {
+                ...current,
+                state: "committed",
+                telegramMessageId: input.telegramMessageId,
+                registration,
+                callbackQueryId: null,
+                callbackObservationDigest: null,
+                decidedAt: null,
+                decision: null,
+                permit: null,
+                receipt: null,
+                cardRevision: "committed",
+                cardRenderedRevision: "committed",
+            };
+            state.records[current.registrationId] = committed;
+            state.messageIds[String(input.telegramMessageId)] = current.registrationId;
+        });
+        return registration;
+    }
+    decide(input) {
+        if (!CALLBACK_ID.test(input.callbackQueryId)
+            || !printable(input.callbackData, 256)
+            || !Number.isSafeInteger(input.telegramMessageId)
+            || input.telegramMessageId <= 0
+            || input.userId !== this.#options.ownerUserId
+            || input.chatId !== this.#options.ownerChatId
+            || !DIGEST.test(input.callbackObservationDigest)
+            || !validTime(input.decidedAt)) {
+            throw new Error("Sanctuary host decision is invalid");
+        }
+        let decision = null;
+        this.#transaction((state) => {
+            if (state.callbackIds[input.callbackQueryId])
+                throw new Error("Sanctuary host callback is already consumed");
+            const registrationId = state.messageIds[String(input.telegramMessageId)];
+            const current = registrationId ? state.records[registrationId] : null;
+            if (!current || !("approveHandle" in current))
+                throw new Error("Sanctuary host registration state changed");
+            const approved = input.callbackData === current.approveHandle;
+            const denied = input.callbackData === current.denyHandle;
+            if (!approved && !denied)
+                throw new Error("Sanctuary host callback handle is invalid");
+            if (current.state !== "committed")
+                return false;
+            if (Date.parse(input.decidedAt) > Date.parse(current.expiresAt))
+                throw new Error("Sanctuary host approval expired");
+            const outcome = approved ? "approve" : "deny";
+            decision = (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                domain: DECISION_DOMAIN,
+                keyId: this.#options.keyId,
+                privateKey: this.#options.privateKey,
+                payload: {
+                    targetHost: this.#options.targetHost,
+                    registrationId: current.registrationId,
+                    registrationDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(current.registration.domain, current.registration.payload),
+                    decision: outcome,
+                    callbackQueryId: input.callbackQueryId,
+                    callbackObservationDigest: input.callbackObservationDigest,
+                    decidedAt: input.decidedAt,
+                    nonce: this.#nonce(),
+                    publicKeyDigest: this.#options.publicKeyDigest,
+                },
+            });
+            state.records[current.registrationId] = {
+                ...current,
+                state: approved ? "approved" : "denied",
+                callbackQueryId: input.callbackQueryId,
+                callbackObservationDigest: input.callbackObservationDigest,
+                decidedAt: input.decidedAt,
+                decision,
+                cardRevision: approved ? "approved" : "denied",
+            };
+            state.callbackIds[input.callbackQueryId] = current.registrationId;
+        });
+        return decision;
+    }
+    reconcilePrepared() {
+        const orphaned = [];
+        this.#transaction((state) => {
+            const now = this.#now();
+            for (const [registrationId, record] of Object.entries(state.records)) {
+                if (record.state !== "prepared")
+                    continue;
+                const { approveHandle: _approveHandle, denyHandle: _denyHandle, ...safe } = record;
+                state.records[registrationId] = { ...safe, state: "orphaned", orphanedAt: now };
+                orphaned.push(registrationId);
+            }
+        });
+        return orphaned;
+    }
+    // Caller has fenced ingress. Journal refusal intent in the registration before
+    // reserving its replay tombstone, so interruption cannot turn it into execution.
+    retireRegistrations(ledger) {
+        this.reconcilePrepared();
+        const pending = [];
+        this.#transaction((state) => {
+            for (const [id, record] of Object.entries(state.records)) {
+                if (record.state === "committed" || record.state === "approved") {
+                    state.records[id] = { ...record, state: "expired", cardRevision: "expired" };
+                }
+                else if (record.state === "permitted") {
+                    const permit = record.permit;
+                    if (ledger.read(String(permit.payload.permitId))) {
+                        pending.push(id);
+                        continue;
+                    }
+                    const receipt = (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                        domain: RETIREMENT_DOMAIN, keyId: this.#options.keyId, privateKey: this.#options.privateKey,
+                        payload: {
+                            registrationId: id, permitId: permit.payload.permitId,
+                            permitDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(permit.domain, permit.payload),
+                            targetHost: this.#options.targetHost, publicKeyDigest: this.#options.publicKeyDigest,
+                            state: "refused", reason: "epoch_retired_before_reservation", retiredAt: this.#now(),
+                        },
+                    });
+                    state.records[id] = { ...record, state: "retired", cardRevision: "retired", receipt };
+                }
+            }
+        });
+        for (const record of Object.values(this.#read().records)) {
+            if (record.state !== "retired")
+                continue;
+            const permit = record.permit;
+            const permitId = String(permit.payload.permitId);
+            const permitDigest = (0, sanctuary_authority_codec_1.authorityArtifactDigest)(permit.domain, permit.payload);
+            const outcomeDigest = (0, sanctuary_authority_codec_1.authorityArtifactDigest)(record.receipt.domain, record.receipt.payload);
+            const retiredAt = String(record.receipt.payload.retiredAt);
+            const current = ledger.read(permitId);
+            if (current && (current.permitDigest !== permitDigest || (current.state !== "reserved" && (current.state !== "refused" || current.outcomeDigest !== outcomeDigest))))
+                throw new Error("Sanctuary retired permit ledger changed");
+            if (!current)
+                ledger.reserve({ permitId, nonce: String(permit.payload.nonce), permitDigest, reservedAt: retiredAt });
+            if (!current || current.state === "reserved")
+                ledger.terminalize({ permitId, state: "refused", outcomeDigest, updatedAt: retiredAt });
+        }
+        return pending;
+    }
+    issuePermit(input) {
+        if (!isObject(input)
+            || !exactKeys(input, [
+                "registrationId",
+                "residentFriendId",
+                "relationshipProfileId",
+                "relationshipProfileVersion",
+                "requestId",
+                "sessionKey",
+                "sessionEventId",
+                "residentApprovalId",
+                "stewardPolicy",
+            ])
+            || !REGISTRATION_ID.test(input.registrationId)
+            || !printable(input.residentFriendId, 512)
+            || !printable(input.relationshipProfileId, 256)
+            || !Number.isSafeInteger(input.relationshipProfileVersion)
+            || input.relationshipProfileVersion < 1
+            || !printable(input.requestId, 512)
+            || !printable(input.sessionKey, 1_024)
+            || !printable(input.sessionEventId, 512)
+            || !printable(input.residentApprovalId, 512)) {
+            throw new Error("Sanctuary host permit correlation is invalid");
+        }
+        if (input.stewardPolicy !== null && (!isObject(input.stewardPolicy)
+            || !exactKeys(input.stewardPolicy, ["key", "version", "digest"])
+            || !printable(input.stewardPolicy.key, 256)
+            || !Number.isSafeInteger(input.stewardPolicy.version)
+            || input.stewardPolicy.version < 1
+            || typeof input.stewardPolicy.digest !== "string"
+            || !DIGEST.test(input.stewardPolicy.digest))) {
+            throw new Error("Sanctuary host permit steward policy is invalid");
+        }
+        let permit;
+        let issueWindowExpired = false;
+        this.#transaction((state) => {
+            const current = state.records[input.registrationId];
+            if (!current || current.state !== "approved" || !current.decision || !current.decidedAt || !current.callbackObservationDigest) {
+                throw new Error("Sanctuary host approval state cannot issue a permit");
+            }
+            const issuedAt = this.#now();
+            if (Date.parse(issuedAt) < Date.parse(current.decidedAt)) {
+                throw new Error("Sanctuary host permit issue window expired");
+            }
+            if (Date.parse(issuedAt) > Date.parse(current.decidedAt) + 120_000) {
+                state.records[current.registrationId] = { ...current, state: "expired", cardRevision: "expired" };
+                issueWindowExpired = true;
+                return;
+            }
+            const permitSeed = this.#nonce();
+            const permitId = `permit-${permitSeed}`;
+            const permitNonce = (0, node_crypto_1.createHash)("sha256").update(`permit-nonce\0${permitSeed}`, "utf8").digest("hex");
+            permit = (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                domain: PERMIT_DOMAIN,
+                keyId: this.#options.keyId,
+                privateKey: this.#options.privateKey,
+                payload: {
+                    targetHost: this.#options.targetHost,
+                    permitId,
+                    registrationId: current.registrationId,
+                    registrationDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(current.registration.domain, current.registration.payload),
+                    ownerUserId: this.#options.ownerUserId,
+                    ownerChatId: this.#options.ownerChatId,
+                    ownerObservationDigest: current.proposal.ownerObservation.digest,
+                    callbackObservationDigest: current.callbackObservationDigest,
+                    residentFriendId: input.residentFriendId,
+                    relationshipProfileId: input.relationshipProfileId,
+                    relationshipProfileVersion: input.relationshipProfileVersion,
+                    requestId: input.requestId,
+                    sessionKey: input.sessionKey,
+                    sessionEventId: input.sessionEventId,
+                    residentApprovalId: input.residentApprovalId,
+                    effectClass: "owner_approved_arbitrary_host",
+                    executionProfile: "host.owner_approved.v1",
+                    targetResource: current.proposal.targetResource,
+                    command: current.proposal.command,
+                    scriptDigest: current.proposal.command.kind === "script" ? digestText(current.proposal.command.script) : null,
+                    workingDirectoryProfile: current.proposal.workingDirectoryProfile,
+                    environmentProfile: current.proposal.environmentProfile,
+                    environmentProfileDigest: digestText(current.proposal.environmentProfile),
+                    timeoutMs: current.proposal.timeoutMs,
+                    // Resident-supplied audit correlation, like the session IDs above; never a root authorization input.
+                    stewardPolicy: input.stewardPolicy,
+                    verification: current.proposal.verification,
+                    issuedAt,
+                    expiresAt: new Date(Date.parse(issuedAt) + 120_000).toISOString(),
+                    nonce: permitNonce,
+                    publicKeyDigest: this.#options.publicKeyDigest,
+                },
+            });
+            state.records[current.registrationId] = { ...current, state: "permitted", permit };
+        });
+        if (issueWindowExpired)
+            throw new Error("Sanctuary host permit issue window expired");
+        return permit;
+    }
+    completeExecution(registrationId, receipt) {
+        if (!REGISTRATION_ID.test(registrationId)) {
+            throw new Error("Sanctuary host execution receipt is invalid");
+        }
+        const receiptPayload = (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+            artifact: receipt,
+            expectedDomain: RECEIPT_DOMAIN,
+            expectedKeyId: this.#options.keyId,
+            publicKey: this.#options.publicKey,
+        });
+        const receiptState = receiptPayload.state;
+        if (!["verified", "failed", "ambiguous"].includes(String(receiptState))) {
+            throw new Error("Sanctuary host execution receipt state is invalid");
+        }
+        this.#transaction((state) => {
+            const current = state.records[registrationId];
+            if (!current || current.state !== "permitted" || !current.permit) {
+                throw new Error("Sanctuary host execution state changed");
+            }
+            if (receiptPayload.targetHost !== this.#options.targetHost
+                || receiptPayload.registrationId !== registrationId
+                || receiptPayload.permitId !== current.permit.payload.permitId
+                || receiptPayload.permitDigest !== (0, sanctuary_authority_codec_1.authorityArtifactDigest)(current.permit.domain, current.permit.payload)
+                || receiptPayload.publicKeyDigest !== this.#options.publicKeyDigest
+                || !validTime(receiptPayload.startedAt)
+                || !validTime(receiptPayload.completedAt)
+                || Date.parse(receiptPayload.completedAt) < Date.parse(receiptPayload.startedAt)) {
+                throw new Error("Sanctuary host execution receipt permit changed");
+            }
+            state.records[registrationId] = {
+                ...current,
+                state: "executed",
+                receipt,
+                cardRevision: `executed_${receiptState}`,
+            };
+        });
+    }
+    expireRegistrations() {
+        const now = Date.parse(this.#now());
+        const expired = [];
+        this.#transaction((state) => {
+            for (const [registrationId, record] of Object.entries(state.records)) {
+                const committedExpired = record.state === "committed" && Date.parse(record.expiresAt) < now;
+                const approvedExpired = record.state === "approved"
+                    && record.decidedAt !== null
+                    && Date.parse(record.decidedAt) + 120_000 < now;
+                if (!committedExpired && !approvedExpired)
+                    continue;
+                state.records[registrationId] = {
+                    ...record,
+                    state: "expired",
+                    cardRevision: "expired",
+                };
+                expired.push(registrationId);
+            }
+            return expired.length > 0;
+        });
+        return expired;
+    }
+    pendingCardEdit(registrationId) {
+        if (!REGISTRATION_ID.test(registrationId))
+            throw new Error("Sanctuary host registration id is invalid");
+        const record = this.#read().records[registrationId];
+        if (!record || !("telegramMessageId" in record) || record.cardRevision === record.cardRenderedRevision)
+            return null;
+        return {
+            telegramMessageId: record.telegramMessageId,
+            text: `${ROOT_HOST_PREFIX}\n\n<b>Status:</b> ${CARD_STATUS[record.cardRevision]}\n<b>Proposal commitment:</b> <code>${record.proposalDigest}</code>`,
+            revision: record.cardRevision,
+        };
+    }
+    markCardEdited(registrationId, revision) {
+        this.#transaction((state) => {
+            const record = state.records[registrationId];
+            if (!record || !("cardRevision" in record) || record.cardRevision !== revision) {
+                throw new Error("Sanctuary host approval card revision changed");
+            }
+            state.records[registrationId] = { ...record, cardRenderedRevision: revision };
+        });
+    }
+    ownsMessage(telegramMessageId) {
+        if (!Number.isSafeInteger(telegramMessageId) || telegramMessageId <= 0)
+            return false;
+        return this.#read().messageIds[String(telegramMessageId)] !== undefined;
+    }
+    ownsPrompt(text) {
+        return typeof text === "string"
+            && (text.startsWith(ROOT_HOST_PREFIX) || text.startsWith("OURO ROOT HOST APPROVAL"));
+    }
+    ownsHandle(callbackData) {
+        if (typeof callbackData !== "string")
+            return false;
+        return Object.values(this.#read().records).some((record) => "approveHandle" in record && (record.approveHandle === callbackData || record.denyHandle === callbackData));
+    }
+    ownerMutationFrozen() {
+        return Object.values(this.#read().records).some((record) => record.state === "prepared");
+    }
+    decisionForCallback(callbackQueryId) {
+        if (!CALLBACK_ID.test(callbackQueryId))
+            return null;
+        const state = this.#read();
+        const registrationId = state.callbackIds[callbackQueryId];
+        if (!registrationId)
+            return null;
+        return state.records[registrationId].decision;
+    }
+    claimCallback(input) {
+        const callbackDigest = digestText(input.callbackData);
+        const record = Object.values(this.#read().records).find((record) => record.approveHandleDigest === callbackDigest || record.denyHandleDigest === callbackDigest
+            || ("telegramMessageId" in record && record.telegramMessageId === input.telegramMessageId && input.chatId === this.#options.ownerChatId));
+        if (!record)
+            return null;
+        let decision = null;
+        const previous = this.decisionForCallback(input.callbackQueryId);
+        if (previous) {
+            if (previous.payload.callbackObservationDigest === input.callbackObservationDigest)
+                decision = previous;
+        }
+        else if (record.state === "committed"
+            && record.telegramMessageId === input.telegramMessageId
+            && (record.approveHandle === input.callbackData || record.denyHandle === input.callbackData)
+            && input.userId === this.#options.ownerUserId
+            && input.chatId === this.#options.ownerChatId
+            && Date.parse(input.decidedAt) <= Date.parse(record.expiresAt)) {
+            decision = this.decide(input);
+        }
+        return (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+            domain: "ouro.sanctuary.host-callback.v1",
+            keyId: this.#options.keyId,
+            privateKey: this.#options.privateKey,
+            payload: {
+                ...this.#identity(),
+                handled: true,
+                registrationId: record.registrationId,
+                callbackQueryId: input.callbackQueryId,
+                observationDigest: input.callbackObservationDigest,
+                decision,
+            },
+        });
+    }
+    attestStatus(status) {
+        return (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+            domain: `ouro.sanctuary.host-${typeof status === "boolean" ? "health" : "status"}.v1`,
+            keyId: this.#options.keyId,
+            privateKey: this.#options.privateKey,
+            payload: {
+                ...this.#identity(),
+                observedAt: this.#now(),
+                ...(typeof status === "boolean" ? { healthy: status } : { status }),
+            },
+        });
+    }
+    #identity() {
+        return {
+            targetHost: this.#options.targetHost,
+            botId: this.#options.botId,
+            ownerUserId: this.#options.ownerUserId,
+            ownerChatId: this.#options.ownerChatId,
+            publicKeyDigest: this.#options.publicKeyDigest,
+        };
+    }
+    status(registrationId) {
+        if (!REGISTRATION_ID.test(registrationId))
+            throw new Error("Sanctuary host registration id is invalid");
+        const record = this.#read().records[registrationId];
+        if (!record)
+            return null;
+        return {
+            registrationId: record.registrationId,
+            state: record.state,
+            proposalDigest: record.proposalDigest,
+            expiresAt: record.expiresAt,
+            ...("telegramMessageId" in record ? { telegramMessageId: record.telegramMessageId } : {}),
+            ...("decision" in record && record.decision ? { decision: record.decision } : {}),
+            ...("permit" in record && record.permit ? {
+                permit: (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                    domain: "ouro.sanctuary.host-attempt.v1",
+                    keyId: this.#options.keyId,
+                    privateKey: this.#options.privateKey,
+                    payload: { ...record.permit.payload, permitDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(record.permit.domain, record.permit.payload) },
+                }),
+            } : {}),
+            ...("receipt" in record && record.receipt ? { receipt: record.receipt } : {}),
+            ...("cardRevision" in record ? { cardPending: record.cardRevision !== record.cardRenderedRevision } : {}),
+        };
+    }
+    #now() {
+        const value = this.#options.now?.() ?? new Date().toISOString();
+        if (!validTime(value))
+            throw new Error("Sanctuary host authority time is invalid");
+        return value;
+    }
+    #nonce() {
+        const value = this.#options.nonce?.() ?? (0, node_crypto_1.randomBytes)(32).toString("base64url");
+        if (!/^[A-Za-z0-9_-]{43}$/u.test(value))
+            throw new Error("Sanctuary host authority nonce is invalid");
+        return value;
+    }
+    #read() {
+        return (0, session_transaction_1.withImmediateSessionTurnLease)(this.#statePath, (lease) => {
+            const transaction = (0, session_transaction_1.readSessionTransaction)(this.#statePath, lease);
+            if (transaction.value === null) {
+                if (transaction.bytes)
+                    throw new Error("Sanctuary host authority state is malformed");
+                return initialState();
+            }
+            return validateHostAuthorityState(transaction.value, this.#options);
+        });
+    }
+    #transaction(mutate) {
+        (0, session_transaction_1.withImmediateSessionTurnLease)(this.#statePath, (lease) => {
+            const transaction = (0, session_transaction_1.readSessionTransaction)(this.#statePath, lease);
+            let state;
+            if (transaction.value === null) {
+                if (transaction.bytes)
+                    throw new Error("Sanctuary host authority state is malformed");
+                state = initialState();
+            }
+            else {
+                state = validateHostAuthorityState(transaction.value, this.#options);
+            }
+            if (mutate(state) === false)
+                return;
+            this.#options.beforeWrite?.();
+            fs.chmodSync(path.dirname(this.#statePath), 0o700);
+            (0, session_transaction_1.writeSessionTransaction)(this.#statePath, state, { lease, expectedRevision: transaction.revision });
+        });
+    }
+}
+exports.FileSanctuaryHostAuthority = FileSanctuaryHostAuthority;