@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/heart/daemon/sanctuary-authority-codec.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalAuthorityJson = canonicalAuthorityJson;
+exports.authorityArtifactDigest = authorityArtifactDigest;
+exports.signAuthorityPayload = signAuthorityPayload;
+exports.verifyAuthorityPayload = verifyAuthorityPayload;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../../nerves/runtime");
+const ARTIFACT_KEYS = ["domain", "keyId", "payload", "schemaVersion", "signature"];
+const BASE64URL_SIGNATURE = /^[A-Za-z0-9_-]{86}$/u;
+function invalidCanonicalJson() {
+    throw new Error("canonical authority JSON value is invalid");
+}
+function canonicalAuthorityJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isSafeInteger(value) || Object.is(value, -0))
+            return invalidCanonicalJson();
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        const entries = [];
+        for (let index = 0; index < value.length; index += 1) {
+            if (!(index in value))
+                return invalidCanonicalJson();
+            entries.push(canonicalAuthorityJson(value[index]));
+        }
+        return `[${entries.join(",")}]`;
+    }
+    if (typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype)
+        return invalidCanonicalJson();
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalAuthorityJson(record[key])}`).join(",")}}`;
+}
+function signingBytes(domain, payload) {
+    if (!domain)
+        throw new Error("authority domain is invalid");
+    return Buffer.from(`ouro.sanctuary.authority.v1\0${domain}\0${canonicalAuthorityJson(payload)}`, "utf8");
+}
+function authorityArtifactDigest(domain, payload) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(signingBytes(domain, payload)).digest("hex")}`;
+}
+function signAuthorityPayload(input) {
+    if (!input.keyId)
+        throw new Error("authority key id is invalid");
+    return {
+        schemaVersion: 1,
+        domain: input.domain,
+        keyId: input.keyId,
+        payload: input.payload,
+        signature: (0, node_crypto_1.sign)(null, signingBytes(input.domain, input.payload), input.privateKey).toString("base64url"),
+    };
+}
+function authorityArtifact(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("authority artifact shape is invalid");
+    const record = value;
+    if (JSON.stringify(Object.keys(record).sort()) !== JSON.stringify([...ARTIFACT_KEYS]))
+        throw new Error("authority artifact shape is invalid");
+    if (record.schemaVersion !== 1)
+        throw new Error("authority artifact schema is invalid");
+    if (typeof record.domain !== "string" || !record.domain)
+        throw new Error("authority artifact domain is invalid");
+    if (typeof record.keyId !== "string" || !record.keyId)
+        throw new Error("authority artifact key id is invalid");
+    if (typeof record.signature !== "string" || !BASE64URL_SIGNATURE.test(record.signature)
+        || Buffer.from(record.signature, "base64url").length !== 64
+        || Buffer.from(record.signature, "base64url").toString("base64url") !== record.signature) {
+        throw new Error("authority artifact signature is invalid");
+    }
+    canonicalAuthorityJson(record.payload);
+    return record;
+}
+function verifyAuthorityPayload(input) {
+    const artifact = authorityArtifact(input.artifact);
+    if (artifact.domain !== input.expectedDomain)
+        throw new Error("authority artifact domain changed");
+    if (artifact.keyId !== input.expectedKeyId)
+        throw new Error("authority artifact key id changed");
+    if (!(0, node_crypto_1.verify)(null, signingBytes(artifact.domain, artifact.payload), input.publicKey, Buffer.from(artifact.signature, "base64url"))) {
+        throw new Error("authority artifact signature is invalid");
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_signature_verified", message: "Sanctuary authority signature verified" });
+    return artifact.payload;
+}

package/dist/heart/daemon/sanctuary-authority-epoch.js

@@ -0,0 +1,281 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSanctuaryAuthorityEpoch = readSanctuaryAuthorityEpoch;
+exports.prepareSanctuaryAuthorityEpoch = prepareSanctuaryAuthorityEpoch;
+exports.releaseSanctuaryAuthorityToken = releaseSanctuaryAuthorityToken;
+exports.rebindSanctuaryAuthorityEpochPackage = rebindSanctuaryAuthorityEpochPackage;
+exports.retireSanctuaryAuthorityEpoch = retireSanctuaryAuthorityEpoch;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const session_transaction_1 = require("../../mind/session-transaction");
+const runtime_1 = require("../../nerves/runtime");
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const TOKEN = /^[1-9][0-9]*:[A-Za-z0-9_-]{20,}$/u;
+const sha = (bytes) => `sha256:${(0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex")}`;
+function assertRoot(root, owner) {
+    const stat = fs.lstatSync(root);
+    if (!stat.isDirectory() || fs.realpathSync(root) !== root || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o700)
+        throw new Error("Sanctuary authority epoch root is unsafe");
+}
+function privateBytes(filePath, owner) {
+    if (!path.isAbsolute(filePath) || fs.realpathSync(filePath) !== filePath)
+        throw new Error("Sanctuary authority epoch path is unsafe");
+    const fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o600 || stat.size < 1 || stat.size > 65536)
+            throw new Error("Sanctuary authority epoch file metadata is unsafe");
+        return fs.readFileSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function issuer(root, owner) {
+    const key = (0, node_crypto_1.createPrivateKey)(privateBytes(path.join(root, "issuer.pem"), owner));
+    const publicKey = (0, node_crypto_1.createPublicKey)(key);
+    if (publicKey.asymmetricKeyType !== "ed25519")
+        throw new Error("Sanctuary authority issuer is not Ed25519");
+    return { publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(), publicKeyDigest: sha(publicKey.export({ type: "spki", format: "der" })) };
+}
+function validate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Sanctuary authority epoch is invalid");
+    const epoch = value;
+    if (Object.keys(epoch).sort().join(",") !== "botId,createdAt,epochId,ownerChatId,ownerUserId,packageDigest,predecessorCursor,previousTokenDigest,publicKeyDigest,publicKeyPem,revokedTokenStatus,schemaVersion,state,terminalCursor,tokenDigest,tokenPath"
+        || epoch.schemaVersion !== 1 || !["prepared", "retired"].includes(epoch.state)
+        || typeof epoch.epochId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(epoch.epochId)
+        || ![epoch.botId, epoch.ownerUserId, epoch.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id)) || epoch.ownerUserId !== epoch.ownerChatId
+        || !Number.isSafeInteger(epoch.predecessorCursor) || epoch.predecessorCursor < 0
+        || ![epoch.packageDigest, epoch.tokenDigest, epoch.previousTokenDigest, epoch.publicKeyDigest].every((value) => typeof value === "string" && DIGEST.test(value))
+        || epoch.tokenDigest === epoch.previousTokenDigest || typeof epoch.tokenPath !== "string" || !path.isAbsolute(epoch.tokenPath)
+        || typeof epoch.publicKeyPem !== "string" || epoch.revokedTokenStatus !== 401
+        || typeof epoch.createdAt !== "string" || !Number.isFinite(Date.parse(epoch.createdAt)) || new Date(epoch.createdAt).toISOString() !== epoch.createdAt
+        || (epoch.state === "prepared" ? epoch.terminalCursor !== null : !Number.isSafeInteger(epoch.terminalCursor) || epoch.terminalCursor < epoch.predecessorCursor))
+        throw new Error("Sanctuary authority epoch is invalid");
+    return epoch;
+}
+function syncRoot(root) {
+    const fd = fs.openSync(root, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY);
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function writeRecord(filePath, record) {
+    (0, session_transaction_1.withImmediateSessionTurnLease)(filePath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(filePath, lease);
+        (0, session_transaction_1.writeSessionTransaction)(filePath, record, { lease, expectedRevision: transaction.revision });
+    });
+}
+function writeIssuer(root, key, owner) {
+    const temporary = path.join(root, "issuer.pem.tmp");
+    const fd = fs.openSync(temporary, fs.constants.O_CREAT | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+    let owned = false;
+    try {
+        try {
+            const stat = fs.fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== owner.expectedUid || stat.gid !== owner.expectedGid || (stat.mode & 0o7777) !== 0o600)
+                throw new Error("Sanctuary issuer temporary is unsafe");
+            owned = true;
+            fs.ftruncateSync(fd, 0);
+            fs.writeFileSync(fd, key);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temporary, path.join(root, "issuer.pem"));
+    }
+    catch (error) {
+        if (owned)
+            fs.unlinkSync(temporary);
+        throw error;
+    }
+    syncRoot(root);
+}
+function readSanctuaryAuthorityEpoch(root, owner) {
+    assertRoot(root, owner);
+    const epoch = validate(JSON.parse(privateBytes(path.join(root, "epoch.json"), owner).toString("utf8")));
+    const publicKey = issuer(root, owner);
+    if (publicKey.publicKeyDigest !== epoch.publicKeyDigest || publicKey.publicKeyPem !== epoch.publicKeyPem)
+        throw new Error("Sanctuary authority epoch key or token changed");
+    if (epoch.state === "retired" && fs.existsSync(path.join(root, "handoff.json"))) {
+        const handoff = JSON.parse(privateBytes(path.join(root, "handoff.json"), owner).toString("utf8"));
+        if (JSON.stringify(handoff) !== JSON.stringify({ schemaVersion: 1, epochId: epoch.epochId, tokenDigest: epoch.tokenDigest, cursor: epoch.terminalCursor }))
+            throw new Error("Sanctuary authority token handoff changed");
+        if (fs.existsSync(epoch.tokenPath) && sha(privateBytes(epoch.tokenPath, owner).toString("utf8").trim()) !== epoch.tokenDigest)
+            throw new Error("Sanctuary authority epoch key or token changed");
+    }
+    else if (sha(privateBytes(epoch.tokenPath, owner).toString("utf8").trim()) !== epoch.tokenDigest)
+        throw new Error("Sanctuary authority epoch key or token changed");
+    return epoch;
+}
+async function prepareSanctuaryAuthorityEpoch(input, options) {
+    assertRoot(input.root, options);
+    if (typeof input.epochId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(input.epochId)
+        || ![input.botId, input.ownerUserId, input.ownerChatId].every((id) => typeof id === "string" && /^[1-9][0-9]*$/u.test(id)) || input.ownerUserId !== input.ownerChatId
+        || !Number.isSafeInteger(input.predecessorCursor) || input.predecessorCursor < 0 || !DIGEST.test(input.packageDigest))
+        throw new Error("Sanctuary authority epoch input is invalid");
+    const token = privateBytes(input.tokenPath, options).toString("utf8").trim();
+    const previousToken = privateBytes(input.previousTokenPath, options).toString("utf8").trim();
+    if (!TOKEN.test(token) || !TOKEN.test(previousToken) || token.split(":")[0] !== input.botId || previousToken.split(":")[0] !== input.botId || token === previousToken)
+        throw new Error("Sanctuary authority requires a fresh same-bot token");
+    const previous = await options.probe(previousToken);
+    if (previous.status !== 401 || previous.botId !== null)
+        throw new Error("Sanctuary previous Telegram token is not proven revoked");
+    const current = await options.probe(token);
+    if (current.status !== 200 || current.botId !== input.botId)
+        throw new Error("Sanctuary new Telegram token identity is invalid");
+    const epochPath = path.join(input.root, "epoch.json");
+    const keyPath = path.join(input.root, "issuer.pem");
+    const intentPath = path.join(input.root, "issuer-intent.json");
+    const inputDigest = sha(JSON.stringify({ ...input, tokenDigest: sha(token), previousTokenDigest: sha(previousToken) }));
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        let existing = false;
+        try {
+            fs.lstatSync(epochPath);
+            existing = true;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (existing) {
+            const epoch = readSanctuaryAuthorityEpoch(input.root, options);
+            if (epoch.state === "retired")
+                throw new Error("Sanctuary authority epoch is retired; a fresh token and key epoch are required");
+            for (const key of ["epochId", "botId", "ownerUserId", "ownerChatId", "predecessorCursor", "packageDigest", "tokenPath"]) {
+                if (epoch[key] !== input[key])
+                    throw new Error("Sanctuary authority epoch input changed");
+            }
+            if (epoch.previousTokenDigest !== sha(previousToken))
+                throw new Error("Sanctuary authority predecessor token changed");
+            if (fs.existsSync(intentPath)) {
+                const intent = JSON.parse(privateBytes(intentPath, options).toString("utf8"));
+                if (intent.inputDigest !== inputDigest || intent.key !== privateBytes(keyPath, options).toString("utf8"))
+                    throw new Error("Sanctuary issuer cleanup identity changed");
+                fs.unlinkSync(intentPath);
+                syncRoot(input.root);
+            }
+            return epoch;
+        }
+        let intent;
+        if (fs.existsSync(intentPath)) {
+            intent = JSON.parse(privateBytes(intentPath, options).toString("utf8"));
+            if (!intent || Object.keys(intent).sort().join(",") !== "createdAt,inputDigest,key" || intent.inputDigest !== inputDigest || typeof intent.key !== "string")
+                throw new Error("Sanctuary issuer preparation identity changed");
+        }
+        else {
+            if (fs.existsSync(keyPath))
+                throw new Error("Sanctuary authority issuer is orphaned; a fresh epoch is required");
+            intent = { inputDigest, key: (0, node_crypto_1.generateKeyPairSync)("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString(), createdAt: options.now() };
+            writeRecord(intentPath, intent);
+        }
+        if (fs.existsSync(keyPath)) {
+            if (privateBytes(keyPath, options).toString("utf8") !== intent.key)
+                throw new Error("Sanctuary prepared issuer changed");
+        }
+        else {
+            writeIssuer(input.root, intent.key, options);
+        }
+        const epoch = validate({
+            schemaVersion: 1, state: "prepared", epochId: input.epochId, botId: input.botId, ownerUserId: input.ownerUserId, ownerChatId: input.ownerChatId,
+            predecessorCursor: input.predecessorCursor, packageDigest: input.packageDigest, tokenPath: input.tokenPath, tokenDigest: sha(token), previousTokenDigest: sha(previousToken),
+            ...issuer(input.root, options), revokedTokenStatus: 401, createdAt: intent.createdAt, terminalCursor: null,
+        });
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, epoch, { lease, expectedRevision: transaction.revision });
+        fs.unlinkSync(intentPath);
+        syncRoot(input.root);
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_epoch_prepared", message: "Sanctuary authority epoch prepared", meta: { epochId: epoch.epochId, publicKeyDigest: epoch.publicKeyDigest } });
+        return epoch;
+    });
+}
+function releaseSanctuaryAuthorityToken(root, options) {
+    const epoch = readSanctuaryAuthorityEpoch(root, options);
+    if (epoch.state !== "retired")
+        throw new Error("Sanctuary authority token cannot leave an unretired epoch");
+    if (epoch.tokenDigest !== options.tokenDigest || epoch.terminalCursor !== options.cursor || path.dirname(epoch.tokenPath) !== root)
+        throw new Error("Sanctuary authority token handoff is invalid");
+    writeRecord(path.join(root, "handoff.json"), { schemaVersion: 1, epochId: epoch.epochId, tokenDigest: epoch.tokenDigest, cursor: epoch.terminalCursor });
+    if (fs.existsSync(epoch.tokenPath))
+        fs.unlinkSync(epoch.tokenPath);
+    syncRoot(root);
+}
+/**
+ * Move a live epoch to a new reviewed package without replacing its token, issuer
+ * or cursor. An in-place upgrade (and its rollback) rebinds the package the epoch
+ * trusts; the gateway still refuses any config whose package differs from the epoch's.
+ */
+function rebindSanctuaryAuthorityEpochPackage(root, options) {
+    if (!DIGEST.test(options.from) || !DIGEST.test(options.to))
+        throw new Error("Sanctuary authority package rebind is invalid");
+    const epochPath = path.join(root, "epoch.json");
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        const epoch = readSanctuaryAuthorityEpoch(root, options);
+        if (epoch.state !== "prepared")
+            throw new Error("Sanctuary authority epoch is retired");
+        if (epoch.packageDigest === options.to)
+            return epoch;
+        if (epoch.packageDigest !== options.from)
+            throw new Error("Sanctuary authority epoch package changed");
+        const rebound = { ...epoch, packageDigest: options.to };
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, rebound, { lease, expectedRevision: transaction.revision });
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_epoch_package_rebound", message: "Sanctuary authority epoch rebound to a reviewed package", meta: { epochId: epoch.epochId, from: options.from, to: options.to } });
+        return rebound;
+    });
+}
+function retireSanctuaryAuthorityEpoch(root, options) {
+    if (options.quiescent !== true)
+        throw new Error("Sanctuary authority execution state is not quiescent");
+    const epochPath = path.join(root, "epoch.json");
+    return (0, session_transaction_1.withImmediateSessionTurnLease)(epochPath, (lease) => {
+        const transaction = (0, session_transaction_1.readSessionTransaction)(epochPath, lease);
+        const epoch = readSanctuaryAuthorityEpoch(root, options);
+        if (!Number.isSafeInteger(options.cursor) || options.cursor < epoch.predecessorCursor || (epoch.state === "retired" && options.cursor !== epoch.terminalCursor))
+            throw new Error("Sanctuary authority terminal cursor is invalid");
+        if (epoch.state === "retired")
+            return epoch;
+        const retired = { ...epoch, state: "retired", terminalCursor: options.cursor };
+        (0, session_transaction_1.writeSessionTransaction)(epochPath, retired, { lease, expectedRevision: transaction.revision });
+        return retired;
+    });
+}

package/dist/heart/daemon/sanctuary-authority-installation.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_CGROUP_KEEP = void 0;
+exports.sanctuaryCgroupChildren = sanctuaryCgroupChildren;
+exports.verifySanctuaryAuthorityInstallation = verifySanctuaryAuthorityInstallation;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function digest(bytes) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex")}`;
+}
+function canonical(filePath) {
+    if (!path.isAbsolute(filePath) || path.normalize(filePath) !== filePath || fs.realpathSync(filePath) !== filePath) {
+        throw new Error("Sanctuary authority installation path is not canonical");
+    }
+}
+function directory(filePath, uid, gid, mode) {
+    canonical(filePath);
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isDirectory() || stat.uid !== uid || stat.gid !== gid || (stat.mode & 0o7777) !== mode) {
+        throw new Error("Sanctuary authority installation directory metadata changed");
+    }
+}
+/** `trustedParent`: the caller already walked every parent directory without following
+ * symlinks, so only the leaf needs guarding, and O_NOFOLLOW does that. Resolving each
+ * package file's real path cost two-thirds of every verification on Unraid (D-036). */
+function readOwned(filePath, uid, gid, mode, trustedParent = false) {
+    if (!trustedParent)
+        canonical(filePath);
+    const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        const stat = fs.fstatSync(descriptor);
+        if (!stat.isFile() || stat.uid !== uid || stat.gid !== gid || (stat.mode & 0o7777) !== mode || stat.nlink !== 1) {
+            throw new Error("Sanctuary authority installation file metadata changed");
+        }
+        return fs.readFileSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+/**
+ * Unraid's cgroup2-unraid removes every top-level cgroup that reports `populated 0`,
+ * and the kernel refuses to remove a cgroup that has child cgroups. So the authority
+ * keeps one permanent empty child, and every reader of its cgroup ignores it (D-026).
+ */
+exports.SANCTUARY_CGROUP_KEEP = "ouro-keep";
+/** The authority cgroup's execution children: directories other than the keep child. */
+function sanctuaryCgroupChildren(cgroupRoot) {
+    return fs.readdirSync(cgroupRoot).filter((name) => name !== exports.SANCTUARY_CGROUP_KEEP && fs.lstatSync(path.join(cgroupRoot, name)).isDirectory());
+}
+function verifySanctuaryAuthorityInstallation(input) {
+    const { expectedUid: uid, expectedGid: gid } = input;
+    for (const root of [input.packageRoot, input.stateRoot, input.stagingRoot, input.cgroupRoot])
+        directory(root, uid, gid, 0o700);
+    directory(input.socketRoot, uid, input.socketGroupId, 0o750);
+    const bytes = readOwned(input.manifestPath, uid, gid, 0o600);
+    if (digest(bytes) !== input.manifestDigest)
+        throw new Error("Sanctuary authority package manifest digest changed");
+    const manifest = JSON.parse(bytes.toString("utf8"));
+    if (!object(manifest) || Object.keys(manifest).sort().join(",") !== "files,schemaVersion" || manifest.schemaVersion !== 1 || !object(manifest.files) || Object.keys(manifest.files).length === 0) {
+        throw new Error("Sanctuary authority package manifest is invalid");
+    }
+    const expected = Object.keys(manifest.files).sort();
+    for (const relative of expected) {
+        const pin = manifest.files[relative];
+        if (!/^[A-Za-z0-9_@.-]+(?:\/[A-Za-z0-9_@.-]+)*$/u.test(relative) || relative.split("/").some((part) => part === "." || part === "..")
+            || !object(pin) || Object.keys(pin).sort().join(",") !== "digest,mode"
+            || typeof pin.digest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(pin.digest) || ![0o600, 0o644, 0o700, 0o755].includes(pin.mode)) {
+            throw new Error("Sanctuary authority package file pin is invalid");
+        }
+    }
+    const actual = [];
+    const walk = (relative) => {
+        for (const entry of fs.readdirSync(path.join(input.packageRoot, relative), { withFileTypes: true })) {
+            const name = path.join(relative, entry.name);
+            const filePath = path.join(input.packageRoot, name);
+            if (entry.isDirectory()) {
+                const stat = fs.lstatSync(filePath);
+                canonical(filePath);
+                if (stat.uid !== uid || stat.gid !== gid || ![0o700, 0o755].includes(stat.mode & 0o7777))
+                    throw new Error("Sanctuary authority package directory is unsafe");
+                walk(name);
+            }
+            else {
+                actual.push(name);
+            }
+        }
+    };
+    walk("");
+    if (JSON.stringify(actual.sort()) !== JSON.stringify(expected))
+        throw new Error("Sanctuary authority package inventory changed");
+    // The walk above reached every file through real (not symlinked) directories, so a
+    // file read only needs to refuse a symlinked leaf.
+    for (const relative of expected) {
+        const pin = manifest.files[relative];
+        if (digest(readOwned(path.join(input.packageRoot, relative), uid, gid, pin.mode, true)) !== pin.digest)
+            throw new Error("Sanctuary authority package file digest changed");
+    }
+    const controllers = ["cpu", "memory", "pids"];
+    const readControl = (name) => fs.readFileSync(path.join(input.cgroupRoot, name), "utf8").trim();
+    for (const name of ["cgroup.controllers", "cgroup.subtree_control"]) {
+        const enabled = readControl(name).split(/\s+/u);
+        if (!controllers.every((controller) => enabled.includes(controller)))
+            throw new Error("Sanctuary authority cgroup controllers are unavailable");
+    }
+    if (readControl("cgroup.type") !== "domain" || readControl("cgroup.procs") !== "")
+        throw new Error("Sanctuary authority cgroup domain is invalid");
+    const mounts = (input.mountInfo ?? fs.readFileSync("/proc/self/mountinfo", "utf8")).trim().split("\n").map((line) => {
+        const fields = line.split(" ");
+        const separator = fields.indexOf("-");
+        if (fields.length < 10 || separator < 6)
+            throw new Error("Sanctuary authority mount inventory is invalid");
+        return { target: fields[4].replace(/\\([0-7]{3})/gu, (_match, octal) => String.fromCharCode(parseInt(octal, 8))), options: fields[5].split(","), type: fields[separator + 1] };
+    });
+    const mountFor = (filePath) => mounts.filter(({ target }) => target === "/" || filePath === target || filePath.startsWith(`${target}/`)).sort((a, b) => b.target.length - a.target.length)[0];
+    const stagingMount = mountFor(input.stagingRoot);
+    const cgroupMount = mountFor(input.cgroupRoot);
+    if (!stagingMount || stagingMount.options.includes("noexec") || stagingMount.options.includes("ro") || cgroupMount?.type !== "cgroup2" || cgroupMount.options.includes("ro")) {
+        throw new Error("Sanctuary authority staging or cgroup mount prerequisites are unavailable");
+    }
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_authority_installation_verified", message: "Sanctuary authority installation prerequisites verified", meta: { packageDigest: input.manifestDigest } });
+    return { packageDigest: input.manifestDigest, controllers };
+}