@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/daemon/sanctuary-host-executor.js

@@ -0,0 +1,670 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SanctuaryHostPermitExecutor = void 0;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const sanctuary_authority_codec_1 = require("./sanctuary-authority-codec");
+const sanctuary_host_authority_1 = require("./sanctuary-host-authority");
+const PERMIT_DOMAIN = "ouro.sanctuary.host-permit.v1";
+const RECEIPT_DOMAIN = "ouro.sanctuary.host-receipt.v1";
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const PERMIT_ID = /^permit-[A-Za-z0-9_-]{43}$/u;
+const REGISTRATION_ID = /^hostreg-[A-Za-z0-9_-]{43}$/u;
+const NONCE = /^[A-Za-z0-9_-]{64}$/u;
+const PRINTABLE = /^[\x20-\x7e]+$/u;
+const SCRIPT_BYTES = /^[\x0a\x20-\x7e]+$/u;
+const OUTPUT_LIMIT = 64 * 1024;
+const EXCERPT_LIMIT = 4_096;
+const ACKNOWLEDGED_SUFFIX = ".acknowledged";
+const CLEAN_ENVIRONMENT = Object.freeze({
+    PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+});
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validTime(value) {
+    if (typeof value !== "string")
+        return false;
+    const instant = new Date(value);
+    return !Number.isNaN(instant.getTime()) && instant.toISOString() === value;
+}
+function printable(value, maximum) {
+    return typeof value === "string" && value.length > 0 && value.length <= maximum && PRINTABLE.test(value);
+}
+function digest(value) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(value).digest("hex")}`;
+}
+function absoluteExecutable(value) {
+    return printable(value, 512)
+        && path.posix.isAbsolute(value)
+        && path.posix.normalize(value) === value
+        && !value.includes("/../")
+        && !value.endsWith("/..");
+}
+function validateCommand(command, scriptDigest) {
+    if (!isObject(command)
+        || !Array.isArray(command.arguments)
+        || command.arguments.length > 64
+        || !command.arguments.every((argument) => printable(argument, 512))
+        || (0, sanctuary_host_authority_1.hasHostInlineCodeSwitch)(command.arguments, command.kind === "script" ? command.interpreter : command.executable)) {
+        throw new Error("Sanctuary host permit command is invalid");
+    }
+    if (command.kind === "executable") {
+        if (!exactKeys(command, ["kind", "executable", "arguments"])
+            || !absoluteExecutable(command.executable)
+            || scriptDigest !== null) {
+            throw new Error("Sanctuary host permit executable is invalid");
+        }
+        return;
+    }
+    if (command.kind !== "script"
+        || !exactKeys(command, ["kind", "interpreter", "arguments", "script"])
+        || !absoluteExecutable(command.interpreter)
+        || typeof command.script !== "string"
+        || Buffer.byteLength(command.script, "utf8") === 0
+        || Buffer.byteLength(command.script, "utf8") > 2_048
+        || !SCRIPT_BYTES.test(command.script)
+        || command.script.split("\n").some((line) => line.endsWith(" "))
+        || typeof scriptDigest !== "string"
+        || scriptDigest !== digest(command.script)) {
+        throw new Error("Sanctuary host permit script is invalid");
+    }
+}
+function validatePermit(value, options, now) {
+    if (!isObject(value) || !exactKeys(value, [
+        "targetHost",
+        "permitId",
+        "registrationId",
+        "registrationDigest",
+        "ownerUserId",
+        "ownerChatId",
+        "ownerObservationDigest",
+        "callbackObservationDigest",
+        "residentFriendId",
+        "relationshipProfileId",
+        "relationshipProfileVersion",
+        "requestId",
+        "sessionKey",
+        "sessionEventId",
+        "residentApprovalId",
+        "effectClass",
+        "executionProfile",
+        "targetResource",
+        "command",
+        "scriptDigest",
+        "workingDirectoryProfile",
+        "environmentProfile",
+        "environmentProfileDigest",
+        "timeoutMs",
+        "stewardPolicy",
+        "verification",
+        "issuedAt",
+        "expiresAt",
+        "nonce",
+        "publicKeyDigest",
+    ])) {
+        throw new Error("Sanctuary host permit payload is malformed");
+    }
+    if (value.targetHost !== options.expectedTargetHost
+        || value.ownerUserId !== options.expectedOwnerUserId
+        || value.ownerChatId !== options.expectedOwnerChatId
+        || !PERMIT_ID.test(String(value.permitId))
+        || !REGISTRATION_ID.test(String(value.registrationId))
+        || !DIGEST.test(String(value.registrationDigest))
+        || !DIGEST.test(String(value.ownerObservationDigest))
+        || !DIGEST.test(String(value.callbackObservationDigest))
+        || value.effectClass !== "owner_approved_arbitrary_host"
+        || value.executionProfile !== "host.owner_approved.v1"
+        || value.workingDirectoryProfile !== "host.root.v1"
+        || value.environmentProfile !== "host.clean.v1"
+        || value.environmentProfileDigest !== digest("host.clean.v1")
+        || value.publicKeyDigest !== options.expectedPublicKeyDigest
+        || !Number.isSafeInteger(value.timeoutMs)
+        || value.timeoutMs < 1_000
+        || value.timeoutMs > 900_000
+        || !validTime(value.issuedAt)
+        || !validTime(value.expiresAt)
+        || Date.parse(value.expiresAt) - Date.parse(value.issuedAt) > 120_000
+        || Date.parse(value.expiresAt) < Date.parse(now)
+        || Date.parse(value.issuedAt) > Date.parse(now)
+        || !NONCE.test(String(value.nonce))) {
+        throw new Error("Sanctuary host permit payload is invalid");
+    }
+    for (const [field, maximum] of [
+        ["ownerUserId", 64],
+        ["ownerChatId", 64],
+        ["residentFriendId", 512],
+        ["relationshipProfileId", 256],
+        ["requestId", 512],
+        ["sessionKey", 1_024],
+        ["sessionEventId", 512],
+        ["residentApprovalId", 512],
+        ["targetResource", 256],
+    ]) {
+        if (!printable(value[field], maximum))
+            throw new Error(`Sanctuary host permit ${field} is invalid`);
+    }
+    if (!Number.isSafeInteger(value.relationshipProfileVersion) || value.relationshipProfileVersion < 1) {
+        throw new Error("Sanctuary host permit relationship profile is invalid");
+    }
+    validateCommand(value.command, value.scriptDigest);
+    if (value.verification !== null && (!isObject(value.verification)
+        || !exactKeys(value.verification, ["profile", "expectedStateDigest"])
+        || !printable(value.verification.profile, 128)
+        || !DIGEST.test(String(value.verification.expectedStateDigest)))) {
+        throw new Error("Sanctuary host permit verification is invalid");
+    }
+    if (value.stewardPolicy !== null && (!isObject(value.stewardPolicy)
+        || !exactKeys(value.stewardPolicy, ["key", "version", "digest"])
+        || !printable(value.stewardPolicy.key, 256)
+        || !Number.isSafeInteger(value.stewardPolicy.version)
+        || value.stewardPolicy.version < 1
+        || !DIGEST.test(String(value.stewardPolicy.digest)))) {
+        throw new Error("Sanctuary host permit steward policy is invalid");
+    }
+}
+function validateAttempt(value) {
+    if (!isObject(value)
+        || !exactKeys(value, [
+            "startedAt",
+            "completedAt",
+            "exitCode",
+            "signal",
+            "timedOut",
+            "cancelled",
+            "outputOverflow",
+            "stdout",
+            "stderr",
+            "stdoutDigest",
+            "stderrDigest",
+            "stdoutBytes",
+            "stderrBytes",
+            "cleanup",
+            "containment",
+            "verificationBefore",
+            "verificationAfter",
+        ])
+        || !validTime(value.startedAt)
+        || !validTime(value.completedAt)
+        || Date.parse(value.completedAt) < Date.parse(value.startedAt)
+        || (value.exitCode !== null && !Number.isSafeInteger(value.exitCode))
+        || (value.signal !== null && !printable(value.signal, 32))
+        || typeof value.timedOut !== "boolean"
+        || typeof value.cancelled !== "boolean"
+        || typeof value.outputOverflow !== "boolean"
+        || typeof value.stdout !== "string"
+        || typeof value.stderr !== "string"
+        || !DIGEST.test(String(value.stdoutDigest))
+        || !DIGEST.test(String(value.stderrDigest))
+        || !Number.isSafeInteger(value.stdoutBytes)
+        || value.stdoutBytes < 0
+        || !Number.isSafeInteger(value.stderrBytes)
+        || value.stderrBytes < 0
+        || !["cgroup_empty", "cleanup_unproven"].includes(String(value.cleanup))
+        || !["approved_root_may_escape", "unprovable_after_approved_root_migration"].includes(String(value.containment))
+        || (value.verificationBefore !== null && (!isObject(value.verificationBefore)
+            || !exactKeys(value.verificationBefore, ["digest"])
+            || !DIGEST.test(String(value.verificationBefore.digest))))
+        || (value.verificationAfter !== null && (!isObject(value.verificationAfter)
+            || !exactKeys(value.verificationAfter, ["matches", "digest"])
+            || (value.verificationAfter.matches !== null && typeof value.verificationAfter.matches !== "boolean")
+            || !DIGEST.test(String(value.verificationAfter.digest))))) {
+        throw new Error("Sanctuary host supervisor attempt is invalid");
+    }
+}
+class SanctuaryHostPermitExecutor {
+    #options;
+    #active = false;
+    constructor(options) {
+        if (!path.isAbsolute(options.stagingRoot))
+            throw new Error("Sanctuary host staging root must be absolute");
+        if (!path.isAbsolute(options.stateRoot))
+            throw new Error("Sanctuary host execution state root must be absolute");
+        this.#options = options;
+    }
+    async execute(artifact) {
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_host_permit_submitted", message: "Sanctuary host permit submitted for verification" });
+        return this.#execute(artifact, false);
+    }
+    isHealthy() {
+        try {
+            this.#options.supervisor.verifyInstallation?.();
+            return true;
+        }
+        catch {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "daemon", event: "daemon.sanctuary_host_authority_unavailable", message: "Host execution is unavailable until root program pins are reviewed and refreshed", meta: { reason: "program_pin_verification" } });
+            return false;
+        }
+    }
+    async reconcile() {
+        let entries;
+        try {
+            entries = fs.readdirSync(this.#options.stateRoot);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                entries = [];
+            else
+                throw error;
+        }
+        const receipts = [];
+        const permitIds = [];
+        for (const entry of entries.sort()) {
+            if (entry.endsWith(ACKNOWLEDGED_SUFFIX)) {
+                const permitId = entry.slice(0, -ACKNOWLEDGED_SUFFIX.length);
+                if (!PERMIT_ID.test(permitId))
+                    throw new Error("Sanctuary host execution acknowledgement entry is invalid");
+                const ledger = this.#options.ledger.read(permitId);
+                if (!ledger || ledger.state === "reserved")
+                    throw new Error("Sanctuary host execution acknowledgement is not terminal");
+                this.#finishAcknowledgement(path.join(this.#options.stateRoot, entry));
+                continue;
+            }
+            const permitId = entry;
+            if (!PERMIT_ID.test(permitId))
+                throw new Error("Sanctuary host execution state entry is invalid");
+            const ledger = this.#options.ledger.read(permitId);
+            if (!ledger) {
+                this.#discardUnreservedPublication(permitId);
+                continue;
+            }
+            permitIds.push(permitId);
+            const artifact = this.#readArtifact(permitId, "permit.json");
+            const receiptPath = this.#statePath(permitId, "receipt.json");
+            const temporaryReceiptPath = `${receiptPath}.tmp`;
+            if (!fs.existsSync(receiptPath) && fs.existsSync(temporaryReceiptPath)) {
+                const receipt = this.#verifiedReceipt(this.#readTemporaryArtifact(temporaryReceiptPath), permitId, ledger.permitDigest);
+                fs.renameSync(temporaryReceiptPath, receiptPath);
+                this.#syncDirectory(path.dirname(receiptPath));
+                if (ledger.state === "reserved") {
+                    this.#options.ledger.terminalize({
+                        permitId,
+                        state: receipt.payload.state,
+                        outcomeDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(receipt.domain, receipt.payload),
+                        updatedAt: receipt.payload.completedAt,
+                    });
+                }
+                this.#cleanupStaged(permitId);
+                receipts.push(receipt);
+                continue;
+            }
+            if (fs.existsSync(receiptPath)) {
+                const receipt = this.#verifiedReceipt(this.#readArtifact(permitId, "receipt.json"), permitId, ledger.permitDigest);
+                if (ledger.state === "reserved") {
+                    this.#options.ledger.terminalize({
+                        permitId,
+                        state: receipt.payload.state,
+                        outcomeDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(receipt.domain, receipt.payload),
+                        updatedAt: receipt.payload.completedAt,
+                    });
+                }
+                this.#cleanupStaged(permitId);
+                receipts.push(receipt);
+                continue;
+            }
+            if (ledger.state !== "reserved")
+                throw new Error(`Sanctuary host execution receipt is missing for ${permitId}`);
+            receipts.push(await this.#execute(artifact, true));
+        }
+        await this.#options.supervisor.reconcileOrphans?.(permitIds);
+        return receipts;
+    }
+    acknowledge(permitId) {
+        if (!PERMIT_ID.test(permitId))
+            throw new Error("Sanctuary host permit id is invalid");
+        const ledger = this.#options.ledger.read(permitId);
+        if (!ledger || ledger.state === "reserved")
+            throw new Error("Sanctuary host execution is not terminal");
+        const root = path.join(this.#options.stateRoot, permitId);
+        const acknowledgedRoot = `${root}${ACKNOWLEDGED_SUFFIX}`;
+        if (fs.existsSync(acknowledgedRoot)) {
+            this.#finishAcknowledgement(acknowledgedRoot);
+            return;
+        }
+        if (!fs.existsSync(root))
+            return;
+        this.#options.supervisor.acknowledge?.(permitId);
+        fs.renameSync(root, acknowledgedRoot);
+        this.#syncStateRoot();
+        this.#finishAcknowledgement(acknowledgedRoot);
+    }
+    async #execute(artifact, resume) {
+        if (this.#active)
+            throw new Error("Sanctuary host execution is already active");
+        const permit = (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+            artifact,
+            expectedDomain: PERMIT_DOMAIN,
+            expectedKeyId: this.#options.expectedKeyId,
+            publicKey: this.#options.publicKey,
+        });
+        const permitDigest = (0, sanctuary_authority_codec_1.authorityArtifactDigest)(PERMIT_DOMAIN, permit);
+        const existing = resume ? this.#options.ledger.read(permit.permitId) : null;
+        if (resume && (existing.state !== "reserved" || existing.permitDigest !== permitDigest || existing.nonce !== permit.nonce)) {
+            throw new Error("Sanctuary host reserved permit binding changed");
+        }
+        const now = existing?.reservedAt ?? this.#now();
+        validatePermit(permit, this.#options, now);
+        if (!resume) {
+            this.#writeArtifact(permit.permitId, "permit.json", artifact);
+            this.#options.ledger.reserve({
+                permitId: permit.permitId,
+                nonce: permit.nonce,
+                permitDigest,
+                reservedAt: now,
+            });
+        }
+        this.#active = true;
+        let stagedPath = null;
+        try {
+            let executable;
+            let arguments_;
+            if (permit.command.kind === "script") {
+                stagedPath = resume
+                    ? this.#resumeScript(permit.permitId, permit.command)
+                    : this.#stageScript(permit.permitId, permit.command);
+                executable = permit.command.interpreter;
+                arguments_ = [...permit.command.arguments, stagedPath];
+            }
+            else {
+                executable = permit.command.executable;
+                arguments_ = [...permit.command.arguments];
+            }
+            let attempt;
+            let errorCategory = null;
+            try {
+                const operation = resume ? this.#options.supervisor.resume : this.#options.supervisor.execute;
+                if (!operation)
+                    throw new Error("Sanctuary host supervisor cannot resume reserved execution");
+                attempt = await operation.call(this.#options.supervisor, {
+                    permit,
+                    permitArtifact: artifact,
+                    executable,
+                    arguments: arguments_,
+                    cwd: "/",
+                    environment: CLEAN_ENVIRONMENT,
+                    timeoutMs: permit.timeoutMs,
+                });
+                validateAttempt(attempt);
+            }
+            catch {
+                const failedAt = this.#now();
+                attempt = {
+                    startedAt: now,
+                    completedAt: failedAt,
+                    exitCode: null,
+                    signal: null,
+                    timedOut: false,
+                    cancelled: false,
+                    outputOverflow: false,
+                    stdout: "",
+                    stderr: "",
+                    stdoutDigest: digest(""),
+                    stderrDigest: digest(""),
+                    stdoutBytes: 0,
+                    stderrBytes: 0,
+                    cleanup: "cleanup_unproven",
+                    containment: "approved_root_may_escape",
+                    verificationBefore: null,
+                    verificationAfter: null,
+                };
+                errorCategory = "supervisor_failure";
+            }
+            const outputOverflow = attempt.outputOverflow
+                || Buffer.byteLength(attempt.stdout, "utf8") > OUTPUT_LIMIT
+                || Buffer.byteLength(attempt.stderr, "utf8") > OUTPUT_LIMIT;
+            if (attempt.cleanup !== "cgroup_empty") {
+                throw new Error("Sanctuary host execution cleanup requires reconciliation");
+            }
+            const state = errorCategory
+                || attempt.timedOut
+                || attempt.cancelled
+                || outputOverflow
+                || attempt.exitCode !== 0
+                || attempt.signal !== null
+                ? "failed"
+                : permit.verification && attempt.verificationAfter?.matches !== true
+                    ? "ambiguous"
+                    : "verified";
+            const receipt = (0, sanctuary_authority_codec_1.signAuthorityPayload)({
+                domain: RECEIPT_DOMAIN,
+                keyId: this.#options.expectedKeyId,
+                privateKey: this.#options.privateKey,
+                payload: {
+                    targetHost: this.#options.expectedTargetHost,
+                    permitId: permit.permitId,
+                    permitDigest,
+                    registrationId: permit.registrationId,
+                    state,
+                    startedAt: attempt.startedAt,
+                    completedAt: attempt.completedAt,
+                    exitCode: attempt.exitCode,
+                    signal: attempt.signal,
+                    timedOut: attempt.timedOut,
+                    cancelled: attempt.cancelled,
+                    outputOverflow,
+                    stdoutDigest: attempt.stdoutDigest,
+                    stderrDigest: attempt.stderrDigest,
+                    stdoutBytes: attempt.stdoutBytes,
+                    stderrBytes: attempt.stderrBytes,
+                    stdoutExcerpt: attempt.stdout.slice(0, EXCERPT_LIMIT),
+                    stderrExcerpt: attempt.stderr.slice(0, EXCERPT_LIMIT),
+                    cleanup: attempt.cleanup,
+                    containment: attempt.containment,
+                    verificationBefore: attempt.verificationBefore,
+                    verificationAfter: attempt.verificationAfter,
+                    errorCategory,
+                    publicKeyDigest: this.#options.expectedPublicKeyDigest,
+                },
+            });
+            this.#writeArtifact(permit.permitId, "receipt.json", receipt);
+            this.#options.ledger.terminalize({
+                permitId: permit.permitId,
+                state,
+                outcomeDigest: (0, sanctuary_authority_codec_1.authorityArtifactDigest)(receipt.domain, receipt.payload),
+                updatedAt: attempt.completedAt,
+            });
+            if (stagedPath)
+                fs.unlinkSync(stagedPath);
+            return receipt;
+        }
+        finally {
+            this.#active = false;
+        }
+    }
+    #statePath(permitId, name) {
+        return path.join(this.#options.stateRoot, permitId, name);
+    }
+    #writeArtifact(permitId, name, value) {
+        const filePath = this.#statePath(permitId, name);
+        const bytes = `${JSON.stringify(value)}\n`;
+        const root = path.dirname(filePath);
+        fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+        fs.chmodSync(root, 0o700);
+        if (fs.existsSync(filePath)) {
+            if (fs.readFileSync(filePath, "utf8") !== bytes)
+                throw new Error(`Sanctuary host ${name} changed`);
+            return;
+        }
+        const temporaryPath = `${filePath}.tmp`;
+        if (fs.existsSync(temporaryPath))
+            throw new Error(`Sanctuary host ${name} temporary publication exists`);
+        const descriptor = fs.openSync(temporaryPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+        try {
+            fs.writeFileSync(descriptor, bytes, "utf8");
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        fs.renameSync(temporaryPath, filePath);
+        this.#syncDirectory(root);
+    }
+    #readArtifact(permitId, name) {
+        const filePath = this.#statePath(permitId, name);
+        const stat = fs.lstatSync(filePath);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o600) {
+            throw new Error(`Sanctuary host ${name} metadata is invalid`);
+        }
+        const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+            return JSON.parse(fs.readFileSync(descriptor, "utf8"));
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+    }
+    #readTemporaryArtifact(filePath) {
+        const stat = fs.lstatSync(filePath);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o600) {
+            throw new Error("Sanctuary host temporary artifact metadata is invalid");
+        }
+        const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+            return JSON.parse(fs.readFileSync(descriptor, "utf8"));
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+    }
+    #verifiedReceipt(artifact, permitId, permitDigest) {
+        const payload = (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+            artifact,
+            expectedDomain: RECEIPT_DOMAIN,
+            expectedKeyId: this.#options.expectedKeyId,
+            publicKey: this.#options.publicKey,
+        });
+        if (payload.permitId !== permitId
+            || payload.permitDigest !== permitDigest
+            || !["verified", "failed", "ambiguous"].includes(String(payload.state))
+            || !validTime(payload.completedAt)) {
+            throw new Error("Sanctuary host durable receipt binding changed");
+        }
+        return artifact;
+    }
+    #cleanupStaged(permitId) {
+        const stagedPath = path.join(this.#options.stagingRoot, `${permitId}.script`);
+        try {
+            fs.unlinkSync(stagedPath);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    #finishAcknowledgement(root) {
+        const entries = fs.readdirSync(root);
+        if (entries.some((name) => !["permit.json", "receipt.json"].includes(name))) {
+            throw new Error("Sanctuary host execution acknowledgement contents changed");
+        }
+        for (const name of entries)
+            fs.unlinkSync(path.join(root, name));
+        fs.rmdirSync(root);
+        this.#syncStateRoot();
+    }
+    #syncStateRoot() {
+        this.#syncDirectory(this.#options.stateRoot);
+    }
+    #syncDirectory(directory) {
+        const descriptor = fs.openSync(directory, fs.constants.O_RDONLY);
+        try {
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+    }
+    #discardUnreservedPublication(permitId) {
+        const root = path.join(this.#options.stateRoot, permitId);
+        const entries = fs.readdirSync(root);
+        if (entries.some((name) => !["permit.json", "permit.json.tmp"].includes(name))) {
+            throw new Error(`Sanctuary host execution ledger is missing for ${permitId}`);
+        }
+        for (const name of entries)
+            fs.unlinkSync(path.join(root, name));
+        fs.rmdirSync(root);
+        this.#syncStateRoot();
+    }
+    #stageScript(permitId, command) {
+        fs.mkdirSync(this.#options.stagingRoot, { recursive: true, mode: 0o700 });
+        const root = fs.lstatSync(this.#options.stagingRoot);
+        if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 0o777) !== 0o700) {
+            throw new Error("Sanctuary host staging root metadata is invalid");
+        }
+        const target = path.join(this.#options.stagingRoot, `${permitId}.script`);
+        const descriptor = fs.openSync(target, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o700);
+        try {
+            fs.writeFileSync(descriptor, command.script, "utf8");
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        return target;
+    }
+    #resumeScript(permitId, command) {
+        const target = path.join(this.#options.stagingRoot, `${permitId}.script`);
+        if (!fs.existsSync(target))
+            return this.#stageScript(permitId, command);
+        const stat = fs.lstatSync(target);
+        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o700) {
+            throw new Error("Sanctuary host staged script metadata is invalid");
+        }
+        const descriptor = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+        try {
+            if (fs.readFileSync(descriptor, "utf8") !== command.script) {
+                throw new Error("Sanctuary host staged script changed");
+            }
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        return target;
+    }
+    #now() {
+        const value = this.#options.now?.() ?? new Date().toISOString();
+        if (!validTime(value))
+            throw new Error("Sanctuary host executor time is invalid");
+        return value;
+    }
+}
+exports.SanctuaryHostPermitExecutor = SanctuaryHostPermitExecutor;