@atomic-chat/core 0.5.1 → 0.13.2

package/dist/runtime/environment/windows-probe.js

@@ -0,0 +1,261 @@
+/**
+ * What a Windows machine can already do, read without changing any of it (change
+ * `add-tensorrt-llm-windows`, task 2.3; spec `wsl-runtime-environment`, "Probe Windows-хоста без
+ * изменений на машине").
+ *
+ * Windows never adopts the user's own container setup: the engine runs inside a WSL distribution
+ * Atomic Chat imports and owns, so this probe answers a narrower question than Linux's — can this
+ * machine host one, what has to be turned on first, and is ours already there. What happens inside
+ * that distribution is the Linux probe's job, run in the guest (`guest-host.ts`, design D1).
+ *
+ * Every read here works for a standard user. `Get-WindowsOptionalFeature -Online` would say whether
+ * the WSL components are on, but it needs an administrator, and the core never runs elevated (design
+ * D2); `wsl.exe` itself says it instead — `--version` answers only once the WSL package is installed,
+ * `--status` only once its components can start a VM. The rest: firmware virtualization from CIM
+ * (`Win32_Processor`, or a hypervisor already running, which proves it), the driver and cards from the
+ * Windows `nvidia-smi`, this process's integrity level from `whoami /groups`, the network and memory
+ * settings from `%UserProfile%\.wslconfig` (read, never written).
+ *
+ * A fact that could not be read lands in `unknown` — never assumed present or absent — and the plan
+ * (`windows-plan.ts`) decides what that blocks. Every command `wsl.exe` writes may arrive as UTF-16;
+ * the transport decodes it (`decodeWslBytes`), and `decodeWslOutput` still copes with a caller that
+ * read it as UTF-8 and left a NUL between every character.
+ */
+import { parseNvidiaSmi } from './linux-probe.js';
+/** The CBS key Windows keeps while a component change (such as the VM platform) waits for a restart. */
+export const REBOOT_PENDING_KEY = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending';
+/** `reg.exe query` of the key: 0 when it exists (a restart is pending), 1 when it does not. */
+export function parseRebootPending(output) {
+    if (output === null || output.code === null)
+        return null;
+    if (output.code === 0)
+        return true;
+    if (output.code === 1)
+        return false;
+    return null;
+}
+const NUL = String.fromCharCode(0);
+const BOM = String.fromCharCode(0xfeff);
+/** `wsl.exe` speaks UTF-16; a caller that read it as UTF-8 leaves a NUL between every character. */
+export function decodeWslOutput(text) {
+    return text.split(NUL).join('').split(BOM).join('');
+}
+/** `os.machine()` in Linux's spelling: `x86_64` (Node may say `x86_64` or `AMD64`), `aarch64` for ARM. */
+export function normalizeWindowsArchitecture(machine) {
+    const raw = machine.trim().toLowerCase();
+    if (raw === 'x86_64' || raw === 'amd64' || raw === 'x64')
+        return 'x86_64';
+    if (raw === 'arm64' || raw === 'aarch64')
+        return 'aarch64';
+    return raw;
+}
+/** `os.release()` on Windows is `10.0.<build>`; the build is what minimum versions compare. */
+export function parseWindowsBuild(release) {
+    const match = /^\d+\.\d+\.(\d+)/.exec(release.trim());
+    return match === null ? null : Number(match[1]);
+}
+/**
+ * `wsl --version`: the package version is on the first line, whatever language its label is in
+ * (`WSL version: 2.4.4.0`, `Версия WSL: 2.4.4.0`). Four parts on the wire; the manifest compares three
+ * (conf ruling 1.1), so the build part is dropped here.
+ */
+export function parseWslVersion(output) {
+    if (output === null || output.code !== 0)
+        return null;
+    const first = decodeWslOutput(output.stdout)
+        .split(/\r?\n/)
+        .find((line) => line.trim() !== '');
+    const match = first === undefined ? null : /(\d+)\.(\d+)\.(\d+)(?:\.\d+)?\s*$/.exec(first.trim());
+    return match === null ? null : `${match[1]}.${match[2]}.${match[3]}`;
+}
+/**
+ * `wsl --list --verbose`: a header, then one line per distribution, the default marked with `*`.
+ * The header's own words change with the display language, so a row is recognised by shape instead:
+ * a real one ends in a version number. No distributions at all is a nonzero exit — an empty list.
+ */
+export function parseWslDistributions(output) {
+    if (output === null || output.code !== 0)
+        return [];
+    const rows = [];
+    for (const raw of decodeWslOutput(output.stdout).split(/\r?\n/)) {
+        const line = raw.trimEnd();
+        if (line.trim() === '')
+            continue;
+        const isDefault = line.trimStart().startsWith('*');
+        const cells = line
+            .trim()
+            .replace(/^\*/, '')
+            .trim()
+            .split(/\s{2,}|\t+/)
+            .filter(Boolean);
+        if (cells.length < 3)
+            continue;
+        const version = Number(cells[cells.length - 1]);
+        if (!Number.isInteger(version))
+            continue;
+        rows.push({
+            name: cells[0],
+            state: cells[1],
+            version,
+            is_default: isDefault,
+        });
+    }
+    return rows;
+}
+/**
+ * The CIM answer (`VirtualizationFirmwareEnabled`, `HypervisorPresent`): a running hypervisor proves
+ * virtualization is on — and then the processor reports the firmware flag as false, so it is checked
+ * first. Anything unreadable is null.
+ */
+export function parseVirtualization(output) {
+    if (output === null || output.code !== 0)
+        return null;
+    try {
+        const parsed = JSON.parse(output.stdout);
+        if (parsed['HypervisorPresent'] === true)
+            return true;
+        const firmware = parsed['VirtualizationFirmwareEnabled'];
+        return typeof firmware === 'boolean' ? firmware : null;
+    }
+    catch {
+        return null;
+    }
+}
+const HIGH_INTEGRITY = 'S-1-16-12288';
+const SYSTEM_INTEGRITY = 'S-1-16-16384';
+const MEDIUM_INTEGRITY = 'S-1-16-8192';
+/** `whoami /groups /fo csv /nh`: the mandatory label says whether this token is elevated. */
+export function parseElevation(output) {
+    if (output === null || output.code !== 0)
+        return null;
+    if (output.stdout.includes(HIGH_INTEGRITY) || output.stdout.includes(SYSTEM_INTEGRITY))
+        return true;
+    return output.stdout.includes(MEDIUM_INTEGRITY) ? false : null;
+}
+const truthy = (value) => {
+    const lower = value.trim().toLowerCase();
+    if (lower === 'true')
+        return true;
+    if (lower === 'false')
+        return false;
+    return null;
+};
+/** `.wslconfig` is INI; only `[wsl2]` matters, keys case-insensitive, `#`/`;` comments. */
+export function parseWslConfig(text) {
+    const facts = { networking_mode: null, localhost_forwarding: null, memory: null };
+    if (text === null)
+        return facts;
+    let section = '';
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/[#;].*$/, '').trim();
+        if (line === '')
+            continue;
+        const header = /^\[(.+)\]$/.exec(line);
+        if (header !== null) {
+            section = header[1].trim().toLowerCase();
+            continue;
+        }
+        if (section !== 'wsl2')
+            continue;
+        const pair = /^([^=]+)=(.*)$/.exec(line);
+        if (pair === null)
+            continue;
+        const key = pair[1].trim().toLowerCase();
+        const value = pair[2].trim().replace(/^"(.*)"$/, '$1');
+        if (key === 'networkingmode')
+            facts.networking_mode = value.toLowerCase();
+        else if (key === 'localhostforwarding')
+            facts.localhost_forwarding = truthy(value);
+        else if (key === 'memory')
+            facts.memory = value;
+    }
+    return facts;
+}
+const VIRTUALIZATION_QUERY = '$p = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; ' +
+    '$s = Get-CimInstance -ClassName Win32_ComputerSystem; ' +
+    '[pscustomobject]@{ VirtualizationFirmwareEnabled = $p.VirtualizationFirmwareEnabled; ' +
+    'HypervisorPresent = $s.HypervisorPresent } | ConvertTo-Json -Compress';
+/**
+ * Read the machine. Nothing here enables a component, imports, starts or stops a distribution, or
+ * writes a file — except that with `RebootPending` set it boots WSL's own system distribution once to
+ * see whether a VM can start (it idles out on its own). `wsl --status` and the firmware check are asked only when they can change the
+ * answer: a package that is not installed has no status, and a WSL that already starts VMs proves
+ * virtualization.
+ */
+export async function probeWindowsHost(deps) {
+    const unknown = [];
+    const system32 = `${deps.systemRoot.replace(/[\\/]+$/, '')}\\System32`;
+    const smiPath = `${system32}\\nvidia-smi.exe`;
+    // The driver installs `nvidia-smi.exe` into System32: no file there is no driver, not an unread fact.
+    const smiInstalled = await deps.pathExists(smiPath).catch(() => null);
+    const [version, smi, whoami, wslconfigText] = await Promise.all([
+        deps.wsl.command(['--version'], { timeoutMs: 30_000 }),
+        smiInstalled === false
+            ? Promise.resolve({ code: 127, stdout: '', stderr: 'no nvidia-smi.exe' })
+            : deps.exec(smiPath, [
+                '--query-gpu=uuid,name,compute_cap,memory.total,memory.free,driver_version',
+                '--format=csv,noheader,nounits',
+            ]),
+        deps.exec(`${system32}\\whoami.exe`, ['/groups', '/fo', 'csv', '/nh']),
+        deps.readWslConfig().then((text) => ({ text, unreadable: false }), () => ({ text: null, unreadable: true })),
+    ]);
+    const installed = version.code === null ? null : version.code === 0;
+    if (installed === null)
+        unknown.push('wsl');
+    const wslVersion = parseWslVersion(version);
+    if (installed === true && wslVersion === null)
+        unknown.push('wsl-version');
+    const [status, list] = installed === true
+        ? await Promise.all([
+            deps.wsl.command(['--status'], { timeoutMs: 30_000 }),
+            deps.wsl.command(['--list', '--verbose'], { timeoutMs: 30_000 }),
+        ])
+        : [null, null];
+    const rebootPending = installed === true
+        ? parseRebootPending(await deps.exec(`${system32}\\reg.exe`, ['query', REBOOT_PENDING_KEY]))
+        : null;
+    const answered = status === null ? null : status.code === null ? null : status.code === 0;
+    // A restart Windows waits for need not be WSL's: when the flag is up, a VM that boots settles it.
+    const vmBoots = answered === true && rebootPending === true
+        ? (await deps.wsl.command(['--system', '--exec', '/bin/true'], { timeoutMs: 60_000 })).code === 0
+        : false;
+    const ready = answered === null ? null : answered && (rebootPending !== true || vmBoots);
+    if (installed === true && answered === null)
+        unknown.push('wsl-status');
+    // Only a WSL that cannot start a VM leaves the question of firmware virtualization open.
+    let virtualization = ready === true ? true : null;
+    if (ready !== true) {
+        virtualization = parseVirtualization(await deps.exec(`${system32}\\WindowsPowerShell\\v1.0\\powershell.exe`, [
+            '-NoProfile',
+            '-NonInteractive',
+            '-Command',
+            VIRTUALIZATION_QUERY,
+        ]));
+    }
+    if (smiInstalled === null || (smiInstalled && smi.code === null))
+        unknown.push('nvidia-driver');
+    const nvidia = parseNvidiaSmi(smi);
+    const elevated = parseElevation(whoami);
+    if (elevated === null)
+        unknown.push('integrity-level');
+    if (wslconfigText.unreadable)
+        unknown.push('wslconfig');
+    const architecture = normalizeWindowsArchitecture(deps.machine());
+    const windowsBuild = parseWindowsBuild(deps.release());
+    if (windowsBuild === null)
+        unknown.push('windows-build');
+    return {
+        architecture,
+        windows_build: windowsBuild,
+        elevated,
+        wsl: { installed, version: wslVersion, ready, reboot_pending: rebootPending },
+        virtualization,
+        driver_installed: smiInstalled,
+        driver_version: nvidia.driver_version,
+        gpus: nvidia.gpus,
+        distributions: parseWslDistributions(list),
+        wslconfig: parseWslConfig(wslconfigText.text),
+        unknown,
+    };
+}
+//# sourceMappingURL=windows-probe.js.map

package/dist/runtime/environment/windows-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-probe.js","sourceRoot":"","sources":["../../../src/runtime/environment/windows-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAA;AAsCrE,wGAAwG;AACxG,MAAM,CAAC,MAAM,kBAAkB,GAC7B,8FAA8F,CAAA;AAEhG,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,IAAI,CAAA;AACb,CAAC;AAwCD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;AAClC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;AAEvC,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACxC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAA;IACzE,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA+B;IAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;SACzC,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACjG,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACnE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACnD,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAQ;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,IAAI;aACf,IAAI,EAAE;aACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;aAClB,IAAI,EAAE;aACN,KAAK,CAAC,YAAY,CAAC;aACnB,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,SAAQ;QACxC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW;YACxB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW;YACzB,OAAO;YACP,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAA;QACnE,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAA;QACxD,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,gBAAgB,GAAG,cAAc,CAAA;AACvC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAEtC,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAA;IACnG,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChE,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAkB,EAAE;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACxC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,KAAK,GAAmB,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACjG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,GAAI,MAAM,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACpD,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,KAAK,MAAM;YAAE,SAAQ;QAChC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3B,MAAM,GAAG,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,KAAK,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAClE,IAAI,GAAG,KAAK,gBAAgB;YAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;aACpE,IAAI,GAAG,KAAK,qBAAqB;YAAE,KAAK,CAAC,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;aAC7E,IAAI,GAAG,KAAK,QAAQ;YAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,oBAAoB,GACxB,4EAA4E;IAC5E,wDAAwD;IACxD,uFAAuF;IACvF,uEAAuE,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAA;IACtE,MAAM,OAAO,GAAG,GAAG,QAAQ,kBAAkB,CAAA;IAC7C,sGAAsG;IACtG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACrE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACtD,YAAY,KAAK,KAAK;YACpB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjB,2EAA2E;gBAC3E,+BAA+B;aAChC,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,cAAc,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EACvC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CACzC;KACF,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAA;IACnE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAE1E,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAClB,SAAS,KAAK,IAAI;QAChB,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;SACjE,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAClB,MAAM,aAAa,GACjB,SAAS,KAAK,IAAI;QAChB,CAAC,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAA;IACzF,kGAAkG;IAClG,MAAM,OAAO,GACX,QAAQ,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI;QACzC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACjG,CAAC,CAAC,KAAK,CAAA;IACX,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,CAAA;IACxF,IAAI,SAAS,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAEvE,yFAAyF;IACzF,IAAI,cAAc,GAAmB,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACjE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,cAAc,GAAG,mBAAmB,CAClC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,2CAA2C,EAAE;YACtE,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oBAAoB;SACrB,CAAC,CACH,CAAA;IACH,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC/F,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACtD,IAAI,aAAa,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAEvD,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAExD,OAAO;QACL,YAAY;QACZ,aAAa,EAAE,YAAY;QAC3B,QAAQ;QACR,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE;QAC7E,cAAc;QACd,gBAAgB,EAAE,YAAY;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,qBAAqB,CAAC,IAAI,CAAC;QAC1C,SAAS,EAAE,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC;QAC7C,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/runtime/environment/windows-provisioner.d.ts

@@ -0,0 +1,113 @@
+import type { ContainerRuntimeStepParameters, ManagedBlocker, Sha256Digest, WslRootfs } from '../../contracts/index.js';
+import { type ExecutionRecord } from '../container/index.js';
+import { type DistributionKeeper, type WslDistributionTransport } from '../wsl/index.js';
+import type { RuntimeDescriptorProvider } from './descriptor-provider.js';
+import type { EnvironmentManifestProvider } from './environment-manifest-provider.js';
+import { type GuestExtras } from './guest-host.js';
+import type { InstallationStore } from './installations.js';
+import { type HostRecipeBinding, type HostView, type UnloadEngineSessions } from './linux-provisioner.js';
+import { type LinuxFacts } from './linux-probe.js';
+import type { EnvironmentProvisioner } from './service.js';
+import type { WindowsEnvironmentRecord } from './windows-environment-record.js';
+import { type WindowsHost } from './windows-host.js';
+import { type WindowsBlocker } from './windows-plan.js';
+import { type WindowsHostFacts, type WslDistribution } from './windows-probe.js';
+/** The elevated recipe's identity: what a `windows.enable-wsl` step and its receipt are bound to. */
+export interface EnableWslBinding {
+    recipe_id: string;
+    recipe_digest: Sha256Digest;
+    /** The digest of its (empty) parameters. */
+    parameters_digest: Sha256Digest;
+}
+/** What the guest recipe is run with: the Linux recipe's identity and its validated parameters. */
+export interface GuestRecipeRequest {
+    recipe_id: string;
+    recipe_digest: Sha256Digest;
+    parameters: ContainerRuntimeStepParameters;
+    parameters_digest: Sha256Digest;
+}
+/**
+ * Runs `linux.install-container-runtime` in the guest as its root (design D1, D3): the same executor
+ * the Linux host step runs, over the WSL transport. Built in `src/host/recipes` and injected, like the
+ * Linux recipe binding, so this module never imports the host module.
+ */
+export type GuestRecipeRunner = (transport: WslDistributionTransport, request: GuestRecipeRequest, signal: AbortSignal) => Promise<{
+    outcome: 'completed' | 'reboot-required' | 'failed';
+    log_tail: string;
+}>;
+/** The environment record store, as far as the provisioner needs it. */
+export interface WindowsEnvironmentRecords {
+    read(): Promise<WindowsEnvironmentRecord | null>;
+    write(record: WindowsEnvironmentRecord): Promise<void>;
+    remove(): Promise<void>;
+}
+export interface WindowsProvisionerDeps {
+    host: WindowsHost;
+    descriptors: RuntimeDescriptorProvider;
+    /** The Windows environment manifest: the rootfs, the minimum versions, the guest recipe. */
+    environmentManifests: EnvironmentManifestProvider<'windows'>;
+    records: WindowsEnvironmentRecords;
+    /** `linux.install-container-runtime`, run in the guest as its root (design D3). */
+    guestRecipe: HostRecipeBinding;
+    /** `windows.enable-wsl`, the one elevated step (design D2), as `src/host/recipes` builds it. */
+    enableWsl: EnableWslBinding;
+    installations: InstallationStore;
+    environmentId: string;
+    /** Downloads the manifest's rootfs to `destination` and checks its sha256; on a mismatch deletes it and throws. */
+    downloadRootfs: (rootfs: WslRootfs, destination: string, signal: AbortSignal) => Promise<void>;
+    /** Deletes one file core downloaded (the rootfs after the import). */
+    removeFile: (path: string) => Promise<void>;
+    runGuestRecipe: GuestRecipeRunner;
+    sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    /** This scope's execution journal (Windows-side, core's own state): the engine's containers to remove. */
+    journal: {
+        list(): ExecutionRecord[];
+        remove(containerId: string): Promise<void>;
+    };
+    /** Removes this scope's engine caches of one descriptor, in the guest. */
+    removeEngineCaches: (descriptorId: string) => Promise<void>;
+    /**
+     * Removes this scope's managed model store, in the guest; only for `retain_models: false`, and only
+     * when no other managed engine's installation is left (change `add-vllm-runtime`, D13).
+     */
+    removeStoreModels: () => Promise<void>;
+    unloadEngineSessions?: UnloadEngineSessions;
+    /** What the forwarding check reaches the guest's test listener from Windows with; the global `fetch` by default. */
+    fetch?: typeof fetch;
+    /**
+     * Keeps Atomic Chat's distribution running while a step of an operation works in it (design D8):
+     * every effect below holds it, and lets go when done. Absent: nothing is held (tests, and a core
+     * that has no distribution yet keeps nothing).
+     */
+    keeper?: DistributionKeeper;
+    onAssessment?: (view: HostView) => void;
+    newId?: () => string;
+    now?: () => Date;
+}
+/**
+ * The image platform of Atomic Chat's distribution: the machine's own architecture, which is also the
+ * architecture of the rootfs its manifest imports (`windows.json` x86_64, `windows-arm64.json`
+ * aarch64). An x86_64 constant here pulled the amd64 GPU-check image onto Windows on Arm, where its
+ * `nvidia-smi` cannot run (NVIDIA RTX Spark N1X, 2026-10-06). Another architecture never gets this
+ * far: the plan blocks it as `unsupported-architecture`.
+ */
+export declare function windowsGuestPlatform(machine: string): 'linux/amd64' | 'linux/arm64';
+/** A `WindowsBlocker` on the wire, the same shape a Linux blocker takes (`toManagedBlocker`). */
+export declare function toWindowsManagedBlocker(entry: WindowsBlocker): ManagedBlocker;
+/** What a Windows probe found, all of it: the plan and the steps after it read this, never the machine twice. */
+export interface WindowsLook {
+    facts: WindowsHostFacts;
+    record: WindowsEnvironmentRecord | null;
+    /** Ours, registered under the recorded name. */
+    owned: WslDistribution | null;
+    foreign: boolean;
+    distribution: {
+        name: string;
+        path: string;
+    };
+    guest: {
+        facts: LinuxFacts;
+        extras: GuestExtras;
+    } | null;
+}
+export declare function createWindowsProvisioner(deps: WindowsProvisionerDeps): EnvironmentProvisioner;