@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/linux-runtime-source.js

@@ -0,0 +1,237 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { TextDecoder } from 'node:util';
+import { parse as parseYaml } from 'yaml';
+const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const ROOTS = ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'];
+const MANIFEST = /^(?:plugins|packages)\/[a-z0-9-]+\/package\.json$/u;
+const MAX_OUTPUT = 4_194_304;
+const OFFICIAL = 'https://github.com/22-ai-00/dsh-enhanced.git';
+function fail(reason) { throw new Error(`rsi Linux runtime: ${reason}`); }
+const decode = (bytes) => new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const PACKAGE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$/u;
+function packageConfiguration(value) {
+    if (!record(value) || Object.hasOwn(value, 'pnpm') || Object.hasOwn(value, 'devEngines')
+        || value.engines !== undefined && (!record(value.engines) || Object.hasOwn(value.engines, 'runtime'))) {
+        fail('frozen package configuration unsupported');
+    }
+}
+/** Workspace YAML is executable pnpm configuration, even with ignore-scripts.
+ * Accept only the reviewed declarative fields, leaving every original byte intact. */
+function workspaceConfiguration(value) {
+    const allowed = new Set(['packages', 'catalog', 'linkWorkspacePackages', 'allowBuilds', 'minimumReleaseAgeExclude']);
+    if (!record(value) || Object.keys(value).some(key => !allowed.has(key)))
+        fail('frozen workspace configuration unsupported');
+    if (value.catalog !== undefined && (!record(value.catalog) || Object.entries(value.catalog).some(([name, version]) => !PACKAGE.test(name) || typeof version !== 'string' || !EXACT_VERSION.test(version))))
+        fail('frozen workspace configuration catalog invalid');
+    if (value.linkWorkspacePackages !== undefined && typeof value.linkWorkspacePackages !== 'boolean')
+        fail('frozen workspace configuration links invalid');
+    if (value.allowBuilds !== undefined && (!record(value.allowBuilds) || Object.entries(value.allowBuilds).some(([name, enabled]) => !PACKAGE.test(name) || typeof enabled !== 'boolean')))
+        fail('frozen workspace configuration builds invalid');
+    if (value.minimumReleaseAgeExclude !== undefined && (!Array.isArray(value.minimumReleaseAgeExclude)
+        || value.minimumReleaseAgeExclude.some(entry => {
+            if (typeof entry !== 'string')
+                return true;
+            const split = entry.lastIndexOf('@');
+            return split < 1 || !PACKAGE.test(entry.slice(0, split)) || !EXACT_VERSION.test(entry.slice(split + 1));
+        })))
+        fail('frozen workspace configuration release exclusions invalid');
+}
+/** Copy every caller-owned byte before any asynchronous boundary. No caller digest is trusted. */
+export function copyLinuxRuntimeManifests(source) {
+    if (!source || !VERSION.test(source.version) || !COMMIT.test(source.sourceCommit)
+        || !Array.isArray(source.manifests) || source.manifests.length < 3 || source.manifests.length > 256)
+        fail('frozen manifest inventory incomplete');
+    const files = new Map();
+    let size = 0;
+    for (const entry of source.manifests) {
+        if (!entry || typeof entry.path !== 'string' || (!ROOTS.includes(entry.path) && !MANIFEST.test(entry.path))
+            || files.has(entry.path) || !(entry.bytes instanceof Uint8Array) || entry.bytes.byteLength > MAX_OUTPUT)
+            fail('frozen manifest inventory invalid');
+        const bytes = Buffer.from(entry.bytes);
+        size += bytes.length;
+        if (size > 8_388_608)
+            fail('frozen manifest bytes exceed bound');
+        files.set(entry.path, bytes);
+    }
+    if (!ROOTS.every(name => files.has(name)))
+        fail('frozen manifest inventory incomplete');
+    const sorted = new Map([...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+    let root;
+    try {
+        root = JSON.parse(decode(sorted.get('package.json')));
+    }
+    catch {
+        return fail('frozen root manifest invalid');
+    }
+    if (root?.name !== 'dsh-enhanced' || root.version !== source.version || root.packageManager !== 'pnpm@11.7.0')
+        fail('frozen root manifest identity differs');
+    packageConfiguration(root);
+    const workspaces = new Set([...sorted.keys()].filter(name => MANIFEST.test(name)).map(dirname));
+    const packageNames = new Set();
+    for (const name of workspaces) {
+        try {
+            const manifest = JSON.parse(decode(sorted.get(`${name}/package.json`)));
+            if (!manifest || typeof manifest.name !== 'string' || !manifest.name || packageNames.has(manifest.name)
+                || manifest.version !== source.version || manifest.packageManager !== undefined && manifest.packageManager !== 'pnpm@11.7.0')
+                fail('frozen workspace manifest identity differs');
+            packageConfiguration(manifest);
+            packageNames.add(manifest.name);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('frozen package configuration'))
+                throw error;
+            fail('frozen workspace manifest invalid');
+        }
+    }
+    let workspace;
+    try {
+        workspace = parseYaml(decode(sorted.get('pnpm-workspace.yaml')));
+    }
+    catch {
+        return fail('frozen workspace inventory invalid');
+    }
+    workspaceConfiguration(workspace);
+    if (!workspace || !Array.isArray(workspace.packages)
+        || workspace.packages.some((pattern) => !['plugins/*', 'packages/*'].includes(pattern))
+        || new Set(workspace.packages).size !== workspace.packages.length
+        || [...workspaces].some(name => !workspace.packages.includes(name.split('/')[0] + '/*')))
+        fail('frozen workspace inventory invalid');
+    const lock = decode(sorted.get('pnpm-lock.yaml'));
+    if (!lock.startsWith("lockfileVersion: '9.0'\n") || /(?:https?:\/\/(?!registry\.npmjs\.org\/)|git\+|\b(?:git|tarball):|(?:^|[\s'"])(?:file:))/imu.test(lock))
+        fail('frozen lockfile unsupported resolution');
+    let parsed;
+    try {
+        parsed = parseYaml(lock);
+    }
+    catch {
+        return fail('frozen lockfile invalid');
+    }
+    if (!record(parsed) || Object.keys(parsed).some(key => !['lockfileVersion', 'settings', 'catalogs', 'importers', 'packages', 'snapshots'].includes(key)))
+        fail('frozen lockfile configuration unsupported');
+    if (parsed.settings !== undefined && (!record(parsed.settings)
+        || Object.entries(parsed.settings).some(([key, value]) => !['autoInstallPeers', 'excludeLinksFromLockfile'].includes(key) || typeof value !== 'boolean')))
+        fail('frozen lockfile configuration settings unsupported');
+    if (!parsed?.importers || typeof parsed.importers !== 'object' || !Object.hasOwn(parsed.importers, '.')
+        || [...workspaces].some(name => !Object.hasOwn(parsed.importers, name)))
+        fail('frozen lockfile importers missing');
+    for (const [importer, groups] of Object.entries(parsed.importers)) {
+        if (importer !== '.' && !workspaces.has(importer))
+            fail('frozen importer outside manifest inventory');
+        if (!record(groups) || Object.keys(groups).some(key => !['dependencies', 'devDependencies', 'optionalDependencies'].includes(key)))
+            fail('frozen importer configuration unsupported');
+        for (const group of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+            for (const value of Object.values(groups[group] ?? {})) {
+                if (typeof value?.specifier !== 'string' || typeof value.version !== 'string')
+                    fail('frozen dependency invalid');
+                if (/^(?:file:|git\+|github:|https?:)/iu.test(value.specifier))
+                    fail('frozen dependency source unsupported');
+                if (value.version.startsWith('link:')) {
+                    const target = resolve('/frozen', importer === '.' ? '' : importer, value.version.slice(5));
+                    if (!target.startsWith('/frozen/') || !workspaces.has(target.slice(8)))
+                        fail('frozen workspace link escapes manifests');
+                }
+            }
+        }
+    }
+    return sorted;
+}
+async function git(repository, args, signal, network = false) {
+    signal?.throwIfAborted();
+    const env = { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C',
+        GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null', GIT_CONFIG_COUNT: '0',
+        GIT_TERMINAL_PROMPT: '0', GIT_NO_LAZY_FETCH: '1', GIT_NO_REPLACE_OBJECTS: '1', GIT_ALLOW_PROTOCOL: network ? 'https' : 'file' };
+    if (network)
+        for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy', 'NO_PROXY', 'no_proxy', 'GIT_SSL_CAINFO', 'GIT_SSL_CAPATH', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'CURL_CA_BUNDLE'])
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+    const bounded = AbortSignal.any([signal ?? new AbortController().signal, AbortSignal.timeout(60_000)]);
+    return new Promise((resolveOutput, reject) => {
+        const child = spawn('/usr/bin/git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false',
+            '-c', 'credential.helper=', '-c', 'gc.auto=0', ...args], { cwd: repository, env,
+            stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+        let size = 0, failed = false;
+        const chunks = [];
+        const stop = () => {
+            if (child.pid)
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                }
+                catch {
+                    child.kill('SIGKILL');
+                }
+        };
+        bounded.addEventListener('abort', stop, { once: true });
+        if (bounded.aborted)
+            stop();
+        child.stdout.on('data', (data) => { size += data.length; if (size > MAX_OUTPUT)
+            stop();
+        else
+            chunks.push(data); });
+        child.stderr.on('data', (data) => { size += data.length; if (size > MAX_OUTPUT)
+            stop(); });
+        child.once('error', () => { failed = true; });
+        child.once('close', code => {
+            bounded.removeEventListener('abort', stop);
+            if (failed || code !== 0 || size > MAX_OUTPUT || bounded.aborted)
+                reject(new Error('rsi Linux runtime: frozen Git object unavailable'));
+            else
+                resolveOutput(Buffer.concat(chunks));
+        });
+    });
+}
+/** Only fixed Git blobs are read. No checkout, package script, repair branch or RSI workspace is created. */
+export async function freezeLinuxRuntimeSource(input) {
+    input.signal?.throwIfAborted();
+    if (!VERSION.test(input.version) || !['git-object', 'local-head', 'official-tag'].includes(input.kind))
+        fail('invalid source version or kind');
+    // Snapshot selection before asynchronous work; caller mutation never changes the selected object.
+    input = { ...input };
+    let temporary;
+    try {
+        let repository, commit;
+        if (input.kind === 'official-tag') {
+            temporary = await mkdtemp(join(await realpath(tmpdir()), 'dsh-native-source-'));
+            repository = temporary;
+            await git(repository, ['init', '--bare', '--object-format=sha1', '.'], input.signal);
+            await git(repository, ['fetch', '--depth=1', '--no-tags', '--no-write-fetch-head', '--no-recurse-submodules', OFFICIAL,
+                `+refs/tags/v${input.version}:refs/dsh-native/source`], input.signal, true);
+            commit = (await git(repository, ['rev-parse', 'refs/dsh-native/source^{commit}'], input.signal)).toString('utf8').trim();
+        }
+        else {
+            repository = input.repository;
+            if (typeof repository !== 'string' || !isAbsolute(repository) || resolve(repository) !== repository
+                || repository.includes('\r') || repository.includes('\n') || repository.includes('\0') || await realpath(repository) !== repository)
+                fail('source repository noncanonical');
+            commit = input.kind === 'local-head' ? (await git(repository, ['rev-parse', 'HEAD'], input.signal)).toString('utf8').trim() : input.commit;
+        }
+        if (!COMMIT.test(commit) || (await git(repository, ['cat-file', '-t', commit], input.signal)).toString('utf8').trim() !== 'commit')
+            fail('source is not a SHA-1 commit');
+        const listing = decode(await git(repository, ['ls-tree', '-r', '--name-only', '-z', commit], input.signal)).split('\0');
+        const names = listing.filter(path => ROOTS.includes(path) || MANIFEST.test(path));
+        if (names.length < 3 || names.length > 256)
+            fail('frozen manifest inventory incomplete');
+        const manifests = [];
+        let size = 0;
+        for (const path of names) {
+            const bytes = await git(repository, ['show', `${commit}:${path}`], input.signal);
+            size += bytes.length;
+            if (size > 8_388_608)
+                fail('frozen manifest bytes exceed bound');
+            manifests.push({ path, bytes });
+        }
+        const source = { version: input.version, sourceCommit: commit, manifests };
+        const checked = copyLinuxRuntimeManifests(source);
+        return { version: source.version, sourceCommit: commit, manifests: [...checked].map(([path, bytes]) => ({ path, bytes })) };
+    }
+    finally {
+        if (temporary)
+            await rm(temporary, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=linux-runtime-source.js.map

package/lib/linux-runtime-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-runtime-source.js","sourceRoot":"","sources":["../src/linux-runtime-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAA;AAEzC,MAAM,OAAO,GAAG,kEAAkE,CAAA;AAClF,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;AACvE,MAAM,QAAQ,GAAG,oDAAoD,CAAA;AACrE,MAAM,UAAU,GAAG,SAAS,CAAA;AAC5B,MAAM,QAAQ,GAAG,8CAA8C,CAAA;AAU/D,SAAS,IAAI,CAAC,MAAc,IAAW,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC;AACxF,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAEtH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAClI,MAAM,OAAO,GAAG,qDAAqD,CAAA;AACrE,MAAM,aAAa,GAAG,kEAAkE,CAAA;AACxF,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC;WACnF,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QACxG,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED;sFACsF;AACtF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,uBAAuB,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC,CAAA;IACpH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC3H,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACnH,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC9I,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;IACvJ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAC/H,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC9G,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;WAC9F,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YACpC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QACzG,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;AAC1E,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,yBAAyB,CAAC,MAAgC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;WAC5E,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACnJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,CAAA;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;eACtG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU;YAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;QACpJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;QAC5D,IAAI,IAAI,GAAG,SAAS;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAChE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjF,IAAI,IAAkE,CAAA;IACtE,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAAC,CAAC;IACpH,IAAI,IAAI,EAAE,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,aAAa;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAC5J,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,eAAe,CAAE,CAAC,CAAC,CAAA;YACxE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;mBAClG,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,aAAa;gBAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;YAClL,oBAAoB,CAAC,QAAQ,CAAC,CAAA;YAC9B,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAAE,MAAM,KAAK,CAAA;YACjG,IAAI,CAAC,mCAAmC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,IAAI,SAAiC,CAAA;IACrC,IAAI,CAAC;QAAC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAE,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAAC,CAAC;IACrI,sBAAsB,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;WAC/C,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAiB,CAAC,CAAC;WACvG,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM;WAC9D,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAE,SAAS,CAAC,QAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACrJ,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,6FAA6F,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;IAC5M,IAAI,MAAoI,CAAA;IACxI,IAAI,CAAC;QAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAC3M,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;WACzD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACvN,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;WAClG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAU,EAAE,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACrH,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;QACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;QACrL,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAChF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBAChH,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBAC5G,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC3F,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;gBACzH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,UAAkB,EAAE,IAAc,EAAE,MAAoB,EAAE,OAAO,GAAG,KAAK;IAC1F,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;QAClG,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG;QAC/G,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACjI,IAAI,OAAO;QAAE,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,CAAC;YAAE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnS,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACtG,OAAO,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB;YACjG,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;YAC/E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAA;QAC9E,IAAI,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,KAAK,CAAC,GAAG;gBAAE,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAAC,CAAC;QAC5F,CAAC,CAAA;QACD,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,IAAI,OAAO,CAAC,OAAO;YAAE,IAAI,EAAE,CAAA;QAC3B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,UAAU;YAAE,IAAI,EAAE,CAAC;;YAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACzH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,UAAU;YAAE,IAAI,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACjG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,UAAU,IAAI,OAAO,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAA;;gBAClI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAyD;IACtG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC9I,kGAAkG;IAClG,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAA;IACpB,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,UAAkB,EAAE,MAAc,CAAA;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAA;YAC/E,UAAU,GAAG,SAAS,CAAA;YACtB,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACpF,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,QAAQ;gBACpH,eAAe,KAAK,CAAC,OAAO,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7E,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,iCAAiC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1H,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;YAC7B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU;mBAC9F,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,UAAU;gBAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;YAC7K,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;QAC5I,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACxK,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACjF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;QACxF,MAAM,SAAS,GAA0C,EAAE,CAAA;QAC3D,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAChF,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;YACpB,IAAI,IAAI,GAAG,SAAS;gBAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;YAChE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC1E,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAA;IAC7H,CAAC;YAAS,CAAC;QAAC,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACpF,CAAC"}

package/lib/linux-runtime.d.ts

@@ -0,0 +1,37 @@
+/** A frozen, owner-private Linux toolchain. No Docker identity is part of this contract. */
+export interface LinuxRuntime {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    platform: 'linux-x64' | 'linux-arm64';
+    sourceCommit: string;
+    lockSha256: string;
+    root: {
+        path: string;
+        dev: number;
+        ino: number;
+        sha256: string;
+    };
+    nodePath: string;
+    nodeSha256: string;
+    pnpmPath: string;
+    nativePnpmPath: string;
+    nativePnpmRoot: string;
+    modulesPath: string;
+    storePath: string;
+    cachePath: string;
+    versions: {
+        node: 'v22.23.2';
+        pnpm: '11.7.0';
+        typescript: string;
+        cordis: string;
+        tools: string;
+        systemPrompt: string;
+    };
+}
+export declare function validateLinuxRuntime(value: unknown): LinuxRuntime;
+/** Hash paths, metadata and bytes; links are recorded but never followed during traversal. */
+export declare function hashLinuxRuntimeTree(root: string, signal?: AbortSignal): Promise<string>;
+export declare function linuxRuntimeDigest(value: LinuxRuntime): string;
+/** Perform the full tree check before giving a candidate access to the toolchain. */
+export declare function verifyLinuxRuntime(value: LinuxRuntime, signal?: AbortSignal): Promise<LinuxRuntime>;
+//# sourceMappingURL=linux-runtime.d.ts.map

package/lib/linux-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-runtime.d.ts","sourceRoot":"","sources":["../src/linux-runtime.ts"],"names":[],"mappings":"AAOA,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,WAAW,GAAG,aAAa,CAAA;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAC/E,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC;AAaD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CA6BjE;AAED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAuD9F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE9D;AAED,qFAAqF;AACrF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAuDzG"}

package/lib/linux-runtime.js

@@ -0,0 +1,192 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, open, readFile, readdir, realpath } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+const HEX = /^[a-f0-9]{64}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const MAX_ENTRIES = 500_000;
+const MAX_BYTES = 8 * 1024 * 1024 * 1024;
+const execFileAsync = promisify(execFile);
+const canonical = (value) => typeof value === 'string'
+    && isAbsolute(value) && resolve(value) === value && !value.includes('\r')
+    && !value.includes('\n') && !value.includes('\0');
+const within = (path, root) => path === root || path.startsWith(root + sep);
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function validateLinuxRuntime(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid Linux runtime');
+    const item = value;
+    if (Object.keys(item).sort().join() !== 'backend,cachePath,lockSha256,modulesPath,nativePnpmPath,nativePnpmRoot,nodePath,nodeSha256,platform,pnpmPath,root,schemaVersion,sourceCommit,storePath,versions'
+        || item.schemaVersion !== 1 || item.backend !== 'linux-native'
+        || item.platform !== `linux-${process.arch}` || !COMMIT.test(item.sourceCommit)
+        || item.sourceCommit === '0'.repeat(40)
+        || !HEX.test(item.lockSha256) || !HEX.test(item.nodeSha256)
+        || !item.root || Object.keys(item.root).sort().join() !== 'dev,ino,path,sha256'
+        || !canonical(item.root.path) || item.root.path === '/'
+        || !Number.isSafeInteger(item.root.dev) || item.root.dev < 0
+        || !Number.isSafeInteger(item.root.ino) || item.root.ino < 0 || !HEX.test(item.root.sha256)
+        || [item.nodePath, item.pnpmPath, item.nativePnpmPath, item.nativePnpmRoot,
+            item.modulesPath, item.storePath, item.cachePath]
+            .some(path => !canonical(path) || !within(path, item.root.path) || path === item.root.path)
+        || item.nodePath !== join(item.root.path, 'bin', 'node')
+        || item.pnpmPath !== join(item.root.path, 'pnpm', 'bin', 'pnpm.mjs')
+        || item.nativePnpmRoot !== join(item.root.path, 'pnpm-native')
+        || item.nativePnpmPath !== join(item.nativePnpmRoot, 'pnpm')
+        || item.modulesPath !== join(item.root.path, 'node_modules')
+        || item.storePath !== join(item.root.path, 'store')
+        || item.cachePath !== join(item.root.path, 'cache')
+        || !item.versions || Object.keys(item.versions).sort().join() !== 'cordis,node,pnpm,systemPrompt,tools,typescript'
+        || item.versions.node !== 'v22.23.2' || item.versions.pnpm !== '11.7.0'
+        || ['typescript', 'cordis', 'tools', 'systemPrompt'].some(key => {
+            const version = item.versions[key];
+            return typeof version !== 'string' || version.length < 1 || version.length > 128;
+        }))
+        throw new Error('invalid Linux runtime');
+    return Object.freeze({ ...item, root: Object.freeze({ ...item.root }), versions: Object.freeze({ ...item.versions }) });
+}
+/** Hash paths, metadata and bytes; links are recorded but never followed during traversal. */
+export async function hashLinuxRuntimeTree(root, signal) {
+    signal?.throwIfAborted();
+    if (!canonical(root) || await realpath(root) !== root)
+        throw new Error('noncanonical Linux runtime root');
+    const base = await lstat(root);
+    if (!base.isDirectory() || base.isSymbolicLink() || base.uid !== process.getuid?.())
+        throw new Error('unsafe Linux runtime root');
+    let count = 0, bytes = 0;
+    const hash = createHash('sha256');
+    // Traversal is sequential, so one bounded buffer suffices for the whole tree.
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const visit = async (path) => {
+        signal?.throwIfAborted();
+        if (++count > MAX_ENTRIES)
+            throw new Error('Linux runtime entry limit');
+        const item = await lstat(path);
+        if (item.uid !== process.getuid?.())
+            throw new Error('Linux runtime owner mismatch');
+        const name = relative(root, path).split(sep).join('/');
+        if (item.isSymbolicLink()) {
+            const target = await realpath(path);
+            if (!within(target, root))
+                throw new Error('Linux runtime link escaped root');
+            hash.update(JSON.stringify(['link', name, relative(root, target).split(sep).join('/')]) + '\n');
+        }
+        else if (item.isDirectory()) {
+            if (item.mode & 0o022)
+                throw new Error('Linux runtime writable directory');
+            hash.update(JSON.stringify(['dir', name, item.mode & 0o777]) + '\n');
+            for (const child of (await readdir(path)).sort())
+                await visit(join(path, child));
+            const after = await lstat(path);
+            if (after.dev !== item.dev || after.ino !== item.ino || !after.isDirectory())
+                throw new Error('Linux runtime directory changed');
+        }
+        else if (item.isFile() && item.nlink === 1) {
+            if (item.mode & 0o022 || (bytes += item.size) > MAX_BYTES)
+                throw new Error('Linux runtime file bound');
+            const descriptor = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            let fileDigest;
+            try {
+                const opened = await descriptor.stat();
+                if (!opened.isFile() || opened.dev !== item.dev || opened.ino !== item.ino || opened.size !== item.size)
+                    throw new Error('Linux runtime file changed');
+                const fileHash = createHash('sha256');
+                // Keep the FileHandle as the sole descriptor owner. A signal can abort
+                // during the metadata awaits above; constructing a ReadStream with that
+                // already-aborted signal can emit an unhandled error before iteration.
+                while (true) {
+                    signal?.throwIfAborted();
+                    const { bytesRead } = await descriptor.read(buffer, 0, buffer.length, null);
+                    signal?.throwIfAborted();
+                    if (bytesRead === 0)
+                        break;
+                    fileHash.update(buffer.subarray(0, bytesRead));
+                }
+                const after = await descriptor.stat();
+                if (after.dev !== item.dev || after.ino !== item.ino || after.size !== item.size || after.mtimeMs !== item.mtimeMs)
+                    throw new Error('Linux runtime file changed');
+                fileDigest = fileHash.digest('hex');
+            }
+            finally {
+                await descriptor.close();
+            }
+            const named = await lstat(path);
+            if (named.dev !== item.dev || named.ino !== item.ino || !named.isFile())
+                throw new Error('Linux runtime path changed');
+            hash.update(JSON.stringify(['file', name, item.mode & 0o777, item.size, fileDigest]) + '\n');
+        }
+        else
+            throw new Error('Linux runtime special or linked file');
+    };
+    await visit(root);
+    signal?.throwIfAborted();
+    return hash.digest('hex');
+}
+export function linuxRuntimeDigest(value) {
+    return digest(JSON.stringify(validateLinuxRuntime(value)));
+}
+/** Perform the full tree check before giving a candidate access to the toolchain. */
+export async function verifyLinuxRuntime(value, signal) {
+    signal?.throwIfAborted();
+    const runtime = validateLinuxRuntime(value);
+    if (process.platform !== 'linux')
+        throw new Error('Linux runtime requires Linux');
+    if (await realpath(runtime.root.path) !== runtime.root.path)
+        throw new Error('Linux runtime root moved');
+    const root = await lstat(runtime.root.path);
+    if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.()
+        || root.dev !== runtime.root.dev || root.ino !== runtime.root.ino
+        || await hashLinuxRuntimeTree(runtime.root.path, signal) !== runtime.root.sha256)
+        throw new Error('Linux runtime root differs');
+    const node = await lstat(runtime.nodePath);
+    if (!node.isFile() || node.isSymbolicLink() || node.nlink !== 1 || node.mode & 0o022
+        || await realpath(runtime.nodePath) !== runtime.nodePath
+        || digest(await readFile(runtime.nodePath, { signal })) !== runtime.nodeSha256)
+        throw new Error('Linux runtime Node differs');
+    for (const [key, name] of [['typescript', 'typescript'], ['cordis', '@deepseek-ai/cordis'],
+        ['tools', '@deepseek-ai/dsh-tools'], ['systemPrompt', '@deepseek-ai/dsh-system-prompt']]) {
+        signal?.throwIfAborted();
+        const path = join(runtime.modulesPath, name, 'package.json');
+        if (!within(await realpath(path), runtime.root.path))
+            throw new Error('Linux runtime package escaped root');
+        const manifest = JSON.parse(await readFile(path, { encoding: 'utf8', signal }));
+        if (manifest.version !== runtime.versions[key])
+            throw new Error('Linux runtime package version differs');
+    }
+    const nativePnpm = await lstat(runtime.nativePnpmPath);
+    if (!nativePnpm.isFile() || nativePnpm.isSymbolicLink() || nativePnpm.nlink !== 1
+        || nativePnpm.mode & 0o022 || await realpath(runtime.nativePnpmPath) !== runtime.nativePnpmPath) {
+        throw new Error('Linux runtime native pnpm differs');
+    }
+    const releaseNodePath = join(runtime.nativePnpmRoot, 'node');
+    const releaseNode = await lstat(releaseNodePath);
+    if (!releaseNode.isFile() || releaseNode.isSymbolicLink() || releaseNode.nlink !== 1
+        || releaseNode.mode & 0o022 || await realpath(releaseNodePath) !== releaseNodePath
+        || digest(await readFile(releaseNodePath, { signal })) !== runtime.nodeSha256) {
+        throw new Error('Linux runtime release Node differs');
+    }
+    const nativeManifest = JSON.parse(await readFile(join(runtime.nativePnpmRoot, 'package.json'), { encoding: 'utf8', signal }));
+    if (nativeManifest.name !== '@pnpm/exe' || nativeManifest.version !== runtime.versions.pnpm) {
+        throw new Error('Linux runtime native pnpm package differs');
+    }
+    const lock = await readFile(join(runtime.root.path, 'pnpm-lock.yaml'), { signal });
+    if (digest(lock) !== runtime.lockSha256)
+        throw new Error('Linux runtime lock differs');
+    const env = { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C' };
+    const [observedNode, observedPnpm, observedNativePnpm, observedReleaseNode] = await Promise.all([
+        execFileAsync(runtime.nodePath, ['--version'], { timeout: 5_000, maxBuffer: 1024, env, signal, killSignal: 'SIGKILL' }),
+        execFileAsync(runtime.nodePath, [runtime.pnpmPath, '--version'], { timeout: 5_000, maxBuffer: 1024, env, signal, killSignal: 'SIGKILL' }),
+        execFileAsync(runtime.nativePnpmPath, ['--version'], { timeout: 5_000, maxBuffer: 1024, env, signal, killSignal: 'SIGKILL' }),
+        execFileAsync(releaseNodePath, ['--version'], { timeout: 5_000, maxBuffer: 1024, env, signal, killSignal: 'SIGKILL' }),
+    ]);
+    if (observedNode.stdout.trim() !== runtime.versions.node
+        || observedPnpm.stdout.trim() !== runtime.versions.pnpm
+        || observedNativePnpm.stdout.trim() !== runtime.versions.pnpm
+        || observedReleaseNode.stdout.trim() !== runtime.versions.node) {
+        throw new Error('Linux runtime executable version differs');
+    }
+    signal?.throwIfAborted();
+    return runtime;
+}
+//# sourceMappingURL=linux-runtime.js.map

package/lib/linux-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-runtime.js","sourceRoot":"","sources":["../src/linux-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAsBrC,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,WAAW,GAAG,OAAO,CAAA;AAC3B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AACzC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;OAC3E,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;OACtE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACnD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AACpG,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAEnG,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACzG,MAAM,IAAI,GAAG,KAAqB,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,iKAAiK;WACpM,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc;WAC3D,IAAI,CAAC,QAAQ,KAAK,SAAS,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;WAC5E,IAAI,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;WACpC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;WACxD,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qBAAqB;WAC5E,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG;WACpD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;WACzD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;WACxF,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc;YACxE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;WAC1F,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;WACrD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;WACjE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;WAC3D,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC;WACzD,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;WACzD,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;WAChD,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;WAChD,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,gDAAgD;WAC/G,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;WACpE,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAyD,CAAC,CAAA;YACxF,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QAClF,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACzH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAoB;IAC3E,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACzG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IACjI,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;IACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,EAAE,KAAK,GAAG,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACjG,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACpE,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YAChF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAClI,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YACtG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YAC9E,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAA;gBACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBACtJ,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;gBACrC,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,cAAc,EAAE,CAAA;oBACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;oBAC3E,MAAM,EAAE,cAAc,EAAE,CAAA;oBACxB,IAAI,SAAS,KAAK,CAAC;wBAAE,MAAK;oBAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;gBAChD,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAA;gBACrC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBACjK,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrC,CAAC;oBAAS,CAAC;gBAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YACtH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QAC9F,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IAChE,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAmB,EAAE,MAAoB;IAChF,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjF,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACxG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;WAC9E,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG;WAC9D,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACjI,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;WAC/E,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ;WACrD,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/H,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QACxF,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAU,EAAE,CAAC;QACpG,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC3G,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAyB,CAAA;QACvG,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACtD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,UAAU,CAAC,KAAK,KAAK,CAAC;WAC5E,UAAU,CAAC,IAAI,GAAG,KAAK,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,CAAA;IAChD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC,KAAK,KAAK,CAAC;WAC/E,WAAW,CAAC,IAAI,GAAG,KAAK,IAAI,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,eAAe;WAC/E,MAAM,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACzF,CAAA;IACnC,IAAI,cAAc,CAAC,IAAI,KAAK,WAAW,IAAI,cAAc,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAClF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACtF,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnF,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9F,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACvH,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACzI,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC7H,aAAa,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;KACvH,CAAC,CAAA;IACF,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;WACnD,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;WACpD,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;WAC1D,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/linux-system-snapshot.d.ts

@@ -0,0 +1,47 @@
+import { type Stats } from 'node:fs';
+import { type LinuxRuntime } from './linux-runtime.js';
+export interface LinuxSystemSnapshot {
+    schemaVersion: 1;
+    root: {
+        path: string;
+        dev: number;
+        ino: number;
+        sha256: string;
+    };
+    manifestSha256: string;
+    bytes: number;
+    entries: number;
+}
+export declare const linuxSystemSnapshotLimits: Readonly<{
+    bytes: number;
+    entries: 32768;
+}>;
+interface SourceLink {
+    path: string;
+    target: string;
+    info: Stats;
+}
+interface Source {
+    path: string;
+    info: Stats;
+    links: SourceLink[];
+}
+/** Resolve every component without trusting a user-owned intermediate or a mutable symlink. */
+export declare function inspectTrustedLinuxSystemSource(path: string): Promise<Source>;
+interface Elf {
+    interpreter?: string;
+    needed: string[];
+    search: string[];
+    inherit: boolean;
+}
+/** Metadata reads are bounded independently of ELF size; no loader or inspection executable runs. */
+export declare function parseLinuxSystemElf(readAt: (offset: number, length: number) => Promise<Buffer>, size: number, path: string): Promise<Elf | undefined>;
+/** The destination must be fresh, below a canonical owner-private directory. */
+export declare function prepareLinuxSystemSnapshot(root: string, signal?: AbortSignal, runtime?: LinuxRuntime): Promise<LinuxSystemSnapshot>;
+/** Verify actual modes, complete inventory and bytes, independently of live host sources. */
+export declare function verifyLinuxSystemSnapshot(value: LinuxSystemSnapshot, signal?: AbortSignal): Promise<LinuxSystemSnapshot>;
+/** Check the ABI closure of only the frozen runtime's selected Node/pnpm
+ * binaries. Host programs are never selected by caller-supplied arbitrary paths. */
+export declare function verifyLinuxSystemSnapshotRuntimeDependencies(snapshot: LinuxSystemSnapshot, runtime: LinuxRuntime, signal?: AbortSignal): Promise<void>;
+export {};
+//# sourceMappingURL=linux-system-snapshot.d.ts.map

package/lib/linux-system-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-system-snapshot.d.ts","sourceRoot":"","sources":["../src/linux-system-snapshot.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA;AAI/C,OAAO,EAAkE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtH,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,yBAAyB;;;EAA8D,CAAA;AAWpG,UAAU,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE;AAClE,UAAU,MAAM;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE;AAInE,+FAA+F;AAC/F,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBnF;AAkCD,UAAU,GAAG;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAC5F,qGAAqG;AACrG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CA+E3J;AAsBD,gFAAgF;AAChF,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA2OzI;AAED,6FAA6F;AAC7F,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqD9H;AAaD;oFACoF;AACpF,wBAAsB,4CAA4C,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EACrH,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoErC"}