@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/linux-verifier-runner.js

@@ -0,0 +1,346 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmodSync, lstatSync, mkdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, resolve, sep } from 'node:path';
+import { setTimeout as pause } from 'node:timers/promises';
+import { defaultLimits } from './config.js';
+import { IsolationLedger, IsolationLedgerError } from './ledger.js';
+import { linuxExecutionContractDigest, validateLinuxExecutionContract } from './linux-execution-contract.js';
+import { linuxExecutionReceiptBinding, prepareLinuxExecutionIntent, readLinuxExecutionReceipt, readLinuxExecutionPartialCleanupProof, reconcileLinuxExecution, runLinuxExecution } from './linux-execution.js';
+import { linuxRuntimeDigest, validateLinuxRuntime, verifyLinuxRuntime } from './linux-runtime.js';
+import { defaultStoragePolicy, plannedStorageBytes } from './storage-policy.js';
+import { observeStorage } from './storage.js';
+import { normalizeRequest } from './workspace.js';
+import { inspectLinuxRunnerState, validateLinuxRunnerStateSeal } from './linux-runner-state.js';
+const TTL = 30_000;
+const STARTUP_TIMEOUT = 31_000;
+const MAX_MEMORY = 2048;
+const MAX_INODES = 32_768;
+const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const unknown = (job, quiescent = false, reason = 'verification-in-progress-no-replay') => job.result ?? { jobId: job.id, status: 'unknown', quiescent, stdout: '', stderr: '', artifacts: [], reason };
+/** Private operator API. Uses the same ledger, grants and history as the Docker verifier. */
+export class LinuxVerifierRunner {
+    #input;
+    #contract;
+    #identity;
+    #ledger;
+    #abort = new AbortController();
+    #pending = new Map();
+    #calls = new Set();
+    #ready;
+    #executionRoot;
+    #controller;
+    #timer;
+    #sweep;
+    #recoveryCursor = '';
+    #active = true;
+    #closePromise;
+    constructor(input) {
+        if (process.platform !== 'linux' || !process.getuid?.() || input.backend !== 'linux-native'
+            || !/^[0-9a-f]{64}$/u.test(input.authorityDigest) || typeof input.command !== 'string'
+            || input.command.length < 1 || input.command.length > 16_384 || input.command.includes('\0')
+            || !Number.isSafeInteger(input.maxRuns) || input.maxRuns < 1 || input.maxRuns > 10_000
+            || !Number.isSafeInteger(input.maxTotalDurationMs) || input.maxTotalDurationMs < 1 || input.maxTotalDurationMs > 86_400_000
+            || !Number.isSafeInteger(input.maxDurationMs) || input.maxDurationMs < 1 || input.maxDurationMs > 300_000
+            || input.maxDurationMs > input.maxTotalDurationMs
+            || !Number.isSafeInteger(input.maxOutputBytes) || input.maxOutputBytes < 1 || input.maxOutputBytes > 262_144
+            || !Number.isSafeInteger(input.expiresAt) || input.expiresAt < 1
+            || !isAbsolute(input.stateRoot) || resolve(input.stateRoot) !== input.stateRoot || input.stateRoot === '/'
+            || /[\p{Cc}\\]/u.test(input.stateRoot))
+            throw new Error('invalid Linux verifier authority');
+        const stateSeal = input.stateSeal === undefined ? undefined : Object.freeze(validateLinuxRunnerStateSeal(input.stateSeal));
+        if (stateSeal)
+            inspectLinuxRunnerState({ stateRoot: input.stateRoot, stateSeal, kind: 'verification' });
+        const runtime = validateLinuxRuntime(input.runtime);
+        if (runtime.root.path === input.stateRoot || runtime.root.path.startsWith(input.stateRoot + sep)
+            || input.stateRoot.startsWith(runtime.root.path + sep))
+            throw new Error('Linux verifier state overlaps runtime');
+        this.#contract = validateLinuxExecutionContract({ schemaVersion: 1, backend: 'linux-native',
+            runtimeDigest: linuxRuntimeDigest(runtime), profile: 'ordinary',
+            limits: { ...defaultLimits, ...input.limits, maxDurationMs: input.maxDurationMs, maxOutputBytes: input.maxOutputBytes },
+            keeperLimits: { memoryMiB: 128, pidsLimit: 64, cpus: 0.5 }, cgroupRoots: input.cgroupRoots });
+        const limits = this.#contract.limits;
+        if (limits.workspaceMiB > 4096 || this.#reservedMemory() > MAX_MEMORY || this.#reservedInodes() > MAX_INODES) {
+            throw new Error('Linux verifier limits exceed resource pool');
+        }
+        this.#input = Object.freeze({ ...input, runtime, limits: this.#contract.limits, cgroupRoots: this.#contract.cgroupRoots,
+            ...(stateSeal ? { stateSeal } : {}) });
+        const root = input.stateRoot;
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        const info = lstatSync(root);
+        if (realpathSync(root) !== root || !info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()) {
+            throw new Error('Linux verifier requires a private owned state root');
+        }
+        chmodSync(root, 0o700);
+        this.#executionRoot = join(root, 'linux-executions');
+        mkdirSync(this.#executionRoot, { mode: 0o700, recursive: true });
+        const native = lstatSync(this.#executionRoot);
+        if (realpathSync(this.#executionRoot) !== this.#executionRoot || !native.isDirectory() || native.isSymbolicLink()
+            || native.uid !== process.getuid?.() || native.mode & 0o077)
+            throw new Error('Linux verifier execution state is not private');
+        // Do not bind, replace or even contact a historical Docker socket marker.
+        this.#ledger = new IsolationLedger(join(root, 'ledger.sqlite'));
+        this.#identity = Object.freeze({ principalDigest: input.authorityDigest,
+            principalRecordId: `verification:${input.authorityDigest}`, principalVersion: 1,
+            workspace: root, agentPreset: 'verification' });
+        this.#ready = this.#start();
+        void this.#ready.catch(() => { this.#active = false; this.#abort.abort(); });
+    }
+    #reservedMemory() {
+        const limits = this.#contract.limits;
+        return limits.memoryMiB + limits.workspaceMiB + Math.ceil(Math.max(1, Math.min(64, limits.memoryMiB / 4)))
+            + 1 + this.#contract.keeperLimits.memoryMiB;
+    }
+    #reservedInodes() { return 2 * this.#contract.limits.workspaceInodes + 4096 + 32; }
+    #authority() {
+        if (this.#input.stateSeal)
+            inspectLinuxRunnerState({ stateRoot: this.#input.stateRoot,
+                stateSeal: this.#input.stateSeal, kind: 'verification' });
+        if (!this.#controller || !this.#ledger.hasController(this.#controller))
+            throw new Error('Linux verifier controller unavailable');
+        return this.#controller;
+    }
+    #available(signal) {
+        if (!this.#active || signal.aborted)
+            throw new Error('Linux verifier unavailable');
+        this.#authority();
+    }
+    async #start() {
+        const ownerId = randomUUID(), deadline = Date.now() + STARTUP_TIMEOUT;
+        for (;;) {
+            this.#abort.signal.throwIfAborted();
+            if (this.#input.stateSeal)
+                inspectLinuxRunnerState({ stateRoot: this.#input.stateRoot,
+                    stateSeal: this.#input.stateSeal, kind: 'verification' });
+            try {
+                this.#controller = this.#ledger.claimController(ownerId, TTL);
+                break;
+            }
+            catch (error) {
+                if (!(error instanceof IsolationLedgerError) || error.code !== 'unauthorized' || Date.now() >= deadline)
+                    throw error;
+                await pause(Math.min(250, deadline - Date.now()), undefined, { signal: this.#abort.signal });
+            }
+        }
+        this.#abort.signal.throwIfAborted();
+        this.#ledger.syncGrants([{ ...this.#identity, id: 'verification', revision: 1, expiresAt: this.#input.expiresAt,
+                maxRuns: this.#input.maxRuns, maxTotalDurationMs: this.#input.maxTotalDurationMs }], this.#controller);
+        this.#timer = setInterval(() => {
+            try {
+                if (this.#input.stateSeal)
+                    inspectLinuxRunnerState({ stateRoot: this.#input.stateRoot,
+                        stateSeal: this.#input.stateSeal, kind: 'verification' });
+                if (this.#controller && this.#ledger.renewController(this.#controller, TTL)) {
+                    this.#scheduleRecovery();
+                    return;
+                }
+            }
+            catch { /* Fence loss revokes work. */ }
+            this.#active = false;
+            this.#abort.abort();
+        }, 5_000);
+        this.#timer.unref();
+        await this.#recover();
+    }
+    #scheduleRecovery() {
+        if (!this.#active || this.#sweep)
+            return;
+        const sweep = this.#ready.then(() => this.#recover());
+        this.#sweep = sweep;
+        void sweep.catch(() => { }).finally(() => {
+            if (this.#sweep === sweep)
+                this.#sweep = undefined;
+        });
+    }
+    async #recover() {
+        // Each sweep visits at most one small batch. Retained unknown rows rotate
+        // through the cursor instead of blocking later jobs or an awaited close.
+        let visited = 0;
+        while (visited < 16) {
+            if (!this.#active)
+                return;
+            this.#authority();
+            const jobs = this.#ledger.recoverable(this.#recoveryCursor).slice(0, 16 - visited);
+            if (jobs.length === 0) {
+                this.#recoveryCursor = '';
+                return;
+            }
+            for (let job of jobs) {
+                if (!this.#active)
+                    return;
+                visited++;
+                this.#recoveryCursor = job.id;
+                if (this.#pending.has(job.id))
+                    continue;
+                const authority = this.#authority();
+                if (job.backend !== 'linux-native' || !job.dispatchAttempted || !job.linuxIntent || !job.linuxContract) {
+                    if (job.status === 'prepared' || job.status === 'running') {
+                        this.#ledger.settle(job.id, job.version, { ...unknown(job), status: 'unknown',
+                            quiescent: job.backend === 'linux-native' && !job.dispatchAttempted,
+                            reason: 'verification-recovery-no-replay' }, authority);
+                    }
+                    continue;
+                }
+                try {
+                    const ctx = { stateRoot: this.#executionRoot, contract: job.linuxContract, intent: job.linuxIntent };
+                    const receipt = await readLinuxExecutionReceipt(ctx);
+                    const recovered = receipt ? { receipt, resources: receipt.resources } : await reconcileLinuxExecution(ctx);
+                    if (!this.#active)
+                        return;
+                    if (!job.linuxResources && recovered.resources && job.status === 'prepared') {
+                        job = this.#ledger.recordLinuxResources(job.id, job.version, recovered.resources, this.#authority());
+                    }
+                    else if (!job.linuxResources && recovered.resources && job.status === 'unknown') {
+                        job = this.#ledger.recordLinuxRecoveredResources(job.id, job.version, recovered.resources, this.#authority());
+                    }
+                    if ('partialProof' in recovered && recovered.partialProof && !job.linuxResources) {
+                        this.#ledger.settleLinuxPrestartCleanup(job.id, job.version, recovered.partialProof, this.#authority());
+                        continue;
+                    }
+                    if (recovered.receipt && job.linuxResources) {
+                        const binding = linuxExecutionReceiptBinding(recovered.receipt);
+                        if (job.status === 'unknown')
+                            this.#ledger.settleLinuxReconciledUnknown(job.id, job.version, binding, this.#authority());
+                        else
+                            this.#ledger.settleLinuxReceipt(job.id, job.version, binding, recovered.receipt.result, this.#authority());
+                        continue;
+                    }
+                }
+                catch { /* Retain uncertainty when private evidence or kernel proof is unavailable. */ }
+                if (job.status === 'prepared' || job.status === 'running') {
+                    this.#ledger.settle(job.id, job.version, { ...unknown(job), status: 'unknown', quiescent: false,
+                        reason: 'verification-recovery-no-replay' }, this.#authority());
+                }
+            }
+        }
+    }
+    run = (key, artifact, stdin, signal) => {
+        const call = this.#run(key, artifact, stdin, signal);
+        this.#calls.add(call);
+        void call.then(() => this.#calls.delete(call), () => this.#calls.delete(call));
+        return call;
+    };
+    async #run(key, artifact, stdin, signal) {
+        await this.#ready;
+        this.#available(signal);
+        const request = normalizeRequest({ grantId: 'verification', idempotencyKey: key, command: this.#input.command,
+            files: [{ path: 'artifact', content: artifact }, { path: 'input', content: stdin }], artifacts: [],
+            timeoutMs: this.#input.maxDurationMs }, this.#contract.limits);
+        const requestDigest = hash({ request, authority: this.#input.authorityDigest, contract: linuxExecutionContractDigest(this.#contract) });
+        const existing = this.#ledger.findJobByKey(this.#identity, `authority:${this.#input.authorityDigest}`, 'verification', key);
+        if (existing)
+            return await this.#existing(existing, request, requestDigest);
+        // Full tree and executable verification is repeated for each newly admitted request.
+        await verifyLinuxRuntime(this.#input.runtime, AbortSignal.any([signal, this.#abort.signal]));
+        this.#available(signal);
+        const observation = await observeStorage(this.#input.stateRoot);
+        this.#available(signal);
+        const { job, created } = this.#ledger.prepare({ identity: this.#identity, sessionId: `authority:${this.#input.authorityDigest}`,
+            grantId: 'verification', idempotencyKey: key, requestDigest, durationMs: this.#input.maxDurationMs,
+            maxActiveJobs: 2, authority: this.#authority(), backend: 'linux-native', linuxContract: this.#contract,
+            resourceReservation: { memoryMiB: this.#reservedMemory(), workspaceInodes: this.#reservedInodes(),
+                maxMemoryMiB: MAX_MEMORY, maxWorkspaceInodes: MAX_INODES },
+            storageBudget: { maxStateBytes: defaultStoragePolicy.maxStateBytes, maxJobRecords: defaultStoragePolicy.maxJobRecords,
+                reservedBytes: 3 * plannedStorageBytes(this.#contract.limits),
+                ...(observation ? { observation } : {}) } });
+        if (!created)
+            return await this.#existing(job, request, requestDigest);
+        const pending = this.#execute(job, request, AbortSignal.any([signal, this.#abort.signal]));
+        this.#pending.set(job.id, pending);
+        try {
+            return await pending;
+        }
+        finally {
+            this.#pending.delete(job.id);
+        }
+    }
+    async #existing(job, request, digest) {
+        const expected = job.backend === 'docker' ? hash({ request, authority: this.#input.authorityDigest }) : digest;
+        if (job.requestDigest !== expected || job.backend === 'linux-native'
+            && (!job.linuxContract || linuxExecutionContractDigest(job.linuxContract) !== linuxExecutionContractDigest(this.#contract))) {
+            throw new Error('verification idempotency key has a different request or contract');
+        }
+        return await this.#pending.get(job.id) ?? unknown(job);
+    }
+    async #execute(initial, request, signal) {
+        let job = initial;
+        let result = { jobId: job.id, status: 'failed', quiescent: true,
+            stdout: '', stderr: '', artifacts: [], reason: 'verification-preparation-failed' };
+        const abort = new AbortController();
+        const current = () => this.#active && !signal.aborted && this.#ledger.hasController(this.#authority()) && this.#ledger.usable(job.id);
+        const timer = setInterval(() => { try {
+            if (current())
+                return;
+        }
+        catch { /* Lost authority cancels. */ } ; abort.abort(); }, 250);
+        timer.unref();
+        try {
+            if (!current())
+                throw new Error('verification authorization changed');
+            const intent = await prepareLinuxExecutionIntent({ stateRoot: this.#executionRoot, contract: this.#contract,
+                job: { id: job.id, requestDigest: job.requestDigest, nativeResourceId: job.nativeResourceId, nativeNonce: job.nativeNonce, deadline: job.deadline } });
+            if (!current())
+                throw new Error('verification authorization changed');
+            job = this.#ledger.markLinuxCreateIntent(job.id, job.version, intent, this.#authority());
+            job = this.#ledger.markDispatched(job.id, job.version, this.#authority());
+            await runLinuxExecution({ stateRoot: this.#executionRoot, contract: this.#contract, intent,
+                argv: ['/bin/sh', '-c', 'PATH=/runtime/0/bin:/runtime/0/pnpm-native:/usr/bin:/bin; export PATH; exec /bin/sh -c "$1"',
+                    'dsh-linux-verifier', request.command], files: request.files ?? [], artifacts: [],
+                readOnlyRoots: [this.#input.runtime.root.path], signal: AbortSignal.any([signal, abort.signal]),
+                recordResources: async (resources) => {
+                    if (!current())
+                        throw new Error('verification authorization changed');
+                    job = this.#ledger.recordLinuxResources(job.id, job.version, resources, this.#authority());
+                }, authorizeStart: () => {
+                    if (!current())
+                        return false;
+                    job = this.#ledger.start(job.id, job.version, this.#authority());
+                    return true;
+                } });
+            // Re-read the private receipt and actual resource absence; a returned tool
+            // result or ordinary ledger settle is never sufficient for native success.
+            const receipt = await readLinuxExecutionReceipt({ stateRoot: this.#executionRoot, contract: this.#contract, intent });
+            if (!receipt) {
+                const proof = await readLinuxExecutionPartialCleanupProof({ stateRoot: this.#executionRoot, contract: this.#contract, intent });
+                if (proof)
+                    return this.#ledger.settleLinuxPrestartCleanup(job.id, job.version, proof, this.#authority()).result;
+                throw new Error('verification receipt unavailable');
+            }
+            if (!job.linuxResources)
+                job = this.#ledger.recordLinuxResources(job.id, job.version, receipt.resources, this.#authority());
+            const settled = this.#ledger.settleLinuxReceipt(job.id, job.version, linuxExecutionReceiptBinding(receipt), receipt.result, this.#authority());
+            return settled.result;
+        }
+        catch {
+            if (job.dispatchAttempted)
+                result = { ...result, status: 'unknown', quiescent: false, reason: 'verification-dispatch-unconfirmed' };
+            try {
+                return this.#ledger.settle(job.id, job.version, result, this.#authority()).result;
+            }
+            catch {
+                return { ...result, status: 'unknown', quiescent: false, reason: 'verification-settlement-unconfirmed' };
+            }
+        }
+        finally {
+            clearInterval(timer);
+        }
+    }
+    close = async () => {
+        if (this.#closePromise)
+            return await this.#closePromise;
+        this.#active = false;
+        this.#abort.abort();
+        clearInterval(this.#timer);
+        this.#closePromise = (async () => {
+            await Promise.allSettled([this.#ready, this.#sweep, ...this.#calls]);
+            try {
+                if (this.#controller)
+                    this.#ledger.releaseController(this.#controller);
+            }
+            finally {
+                this.#ledger.close();
+            }
+        })();
+        return await this.#closePromise;
+    };
+}
+//# sourceMappingURL=linux-verifier-runner.js.map

package/lib/linux-verifier-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-verifier-runner.js","sourceRoot":"","sources":["../src/linux-verifier-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAqC,MAAM,aAAa,CAAA;AAEtG,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAA+B,MAAM,+BAA+B,CAAA;AACzI,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,qCAAqC,EAClI,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AACpH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAA6B,MAAM,yBAAyB,CAAA;AAkB1H,MAAM,GAAG,GAAG,MAAM,CAAA;AAClB,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,MAAM,UAAU,GAAG,IAAI,CAAA;AACvB,MAAM,UAAU,GAAG,MAAM,CAAA;AACzB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzG,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,SAAS,GAAG,KAAK,EAAE,MAAM,GAAG,oCAAoC,EAAmB,EAAE,CACvH,GAAG,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;AAE9G,6FAA6F;AAC7F,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAqC;IAC3C,SAAS,CAAwB;IACjC,SAAS,CAAmB;IAC5B,OAAO,CAAiB;IACxB,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAA;IACtD,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC5C,MAAM,CAAe;IACrB,cAAc,CAAQ;IAC/B,WAAW,CAA0C;IACrD,MAAM,CAA4C;IAClD,MAAM,CAA2B;IACjC,eAAe,GAAG,EAAE,CAAA;IACpB,OAAO,GAAG,IAAI,CAAA;IACd,aAAa,CAA2B;IAExC,YAAY,KAAgC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc;eACtF,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;eACnF,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;eACzF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,MAAM;eACnF,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,UAAU;eACxH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,OAAO;eACtG,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,kBAAkB;eAC9C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,OAAO;eACzG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC;eAC7D,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG;eACvG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAC7F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QAC1H,IAAI,SAAS;YAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QACvG,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;eAC3F,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAClH,IAAI,CAAC,SAAS,GAAG,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc;YACzF,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU;YAC/D,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YACvH,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAA;QACpC,IAAI,MAAM,CAAC,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,UAAU,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,UAAU,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW;YACrH,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAA;QAC5B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACnH,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;QACpD,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;eAC5G,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC/H,0EAA0E;QAC1E,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;YACrE,iBAAiB,EAAE,gBAAgB,KAAK,CAAC,eAAe,EAAE,EAAE,gBAAgB,EAAE,CAAC;YAC/E,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;QAC3B,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,eAAe;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAA;QACpC,OAAO,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;cACtG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAA;IAC/C,CAAC;IACD,eAAe,KAAa,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,GAAG,IAAI,GAAG,EAAE,CAAA,CAAC,CAAC;IAC1F,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBACnF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAChI,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IACD,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAClF,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IACD,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,GAAG,UAAU,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAA;QACrE,SAAS,CAAC;YACR,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBACnF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;YAC3D,IAAI,CAAC;gBAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAK;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAC1F,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAAE,MAAM,KAAK,CAAA;gBACpH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QACnC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAC7G,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QACxG,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;oBAAE,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;wBACnF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;gBAC3D,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC5E,IAAI,CAAC,iBAAiB,EAAE,CAAA;oBACxB,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC3C,CAAC,EAAE,KAAK,CAAC,CAAA;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAsE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,OAAO,OAAO,GAAG,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAM;YACzB,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,CAAA;YAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAC5D,KAAK,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAM;gBACzB,OAAO,EAAE,CAAA;gBACT,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAA;gBAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAQ;gBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;gBACnC,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS;4BAC3E,SAAS,EAAE,GAAG,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,iBAAiB;4BACnE,MAAM,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAAA;oBAC3D,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,CAAA;oBACpG,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;oBACpD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAA;oBAC1G,IAAI,CAAC,IAAI,CAAC,OAAO;wBAAE,OAAM;oBACzB,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;wBAC5E,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;oBACtG,CAAC;yBAAM,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAClF,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;oBAC/G,CAAC;oBACD,IAAI,cAAc,IAAI,SAAS,IAAI,SAAS,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;wBACjF,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;wBACvG,SAAQ;oBACV,CAAC;oBACD,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;wBAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;wBAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;4BAAE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;;4BACnH,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;wBAC/G,SAAQ;oBACV,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,8EAA8E,CAAC,CAAC;gBAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK;wBAC7F,MAAM,EAAE,iCAAiC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,GAAG,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAmB,EAA4B,EAAE;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAmB;QAC1E,MAAM,IAAI,CAAC,MAAM,CAAA;QACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC3G,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE;YAClG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAChE,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACvI,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAC3H,IAAI,QAAQ;YAAE,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QAC3E,qFAAqF;QACrF,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC5F,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;YAC7H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YAClG,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS;YACtG,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC/F,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE;YAC5D,aAAa,EAAE,EAAE,aAAa,EAAE,oBAAoB,CAAC,aAAa,EAAE,aAAa,EAAE,oBAAoB,CAAC,aAAa;gBACnH,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IACvE,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,GAAiB,EAAE,OAAyB,EAAE,MAAc;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9G,IAAI,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;eAC/D,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,4BAA4B,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9H,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,OAAyB,EAAE,MAAmB;QAClF,IAAI,GAAG,GAAG,OAAO,CAAA;QACjB,IAAI,MAAM,GAAoB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI;YAC9E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;QACpF,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,MAAM,OAAO,GAAG,GAAY,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9I,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,OAAO,EAAE;gBAAE,OAAM;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAA,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC9H,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACrE,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACzG,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAiB,EAAE,WAAW,EAAE,GAAG,CAAC,WAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC1J,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACrE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YACxF,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YACzE,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM;gBACxF,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,6FAA6F;oBACnH,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE;gBACnF,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/F,eAAe,EAAE,KAAK,EAAC,SAAS,EAAC,EAAE;oBACjC,IAAI,CAAC,OAAO,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;oBACrE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC5F,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO,KAAK,CAAA;oBAC5B,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;oBAChE,OAAO,IAAI,CAAA;gBACb,CAAC,EAAE,CAAC,CAAA;YACN,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;YACrH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,qCAAqC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC/H,IAAI,KAAK;oBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,MAAO,CAAA;gBAChH,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,cAAc;gBAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3H,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EACjE,4BAA4B,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3E,OAAO,OAAO,CAAC,MAAO,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,CAAC,iBAAiB;gBAAE,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;YACnI,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,MAAO,CAAA;YAAC,CAAC;YAC1F,MAAM,CAAC;gBAAC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAA;YAAC,CAAC;QACpH,CAAC;gBAAS,CAAC;YAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;IACpC,CAAC;IAED,KAAK,GAAG,KAAK,IAAmB,EAAE;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;QACvD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;YACpE,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,WAAW;oBAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QACjH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;IACjC,CAAC,CAAA;CACF"}

package/lib/native-cgroup-roots.d.ts

@@ -0,0 +1,20 @@
+import type { LinuxCgroupRoots } from './linux-cgroups.js';
+declare const CONTROLLERS: readonly ["cpu", "memory", "pids", "freezer"];
+type Controller = typeof CONTROLLERS[number];
+export declare class RsiLinuxCgroupUnavailableError extends Error {
+    readonly code = "rsi-linux-cgroup-unavailable";
+    constructor(message: string);
+}
+export type LinuxV1CgroupRoots = Extract<LinuxCgroupRoots, {
+    mode: 'v1';
+}>;
+/** Parse cgroup v1 controller mounts from /proc/self/mountinfo using the same
+ * split/field rules as the delegation command. Each required controller must
+ * have exactly one mount; cgroup2, other hierarchies and non-/sys/fs/cgroup
+ * mountpoints are ignored. */
+export declare function parseLinuxV1ControllerMounts(lines: readonly string[]): Record<Controller, string>;
+export declare function discoverLinuxCgroupRoots(input?: {
+    signal?: AbortSignal;
+}): Promise<LinuxV1CgroupRoots>;
+export {};
+//# sourceMappingURL=native-cgroup-roots.d.ts.map

package/lib/native-cgroup-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-cgroup-roots.d.ts","sourceRoot":"","sources":["../src/native-cgroup-roots.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAS1D,QAAA,MAAM,WAAW,+CAAgD,CAAA;AACjE,KAAK,UAAU,GAAG,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;AAI5C,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,kCAAiC;gBAClC,OAAO,EAAE,MAAM;CAC5B;AAKD,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAA;AAE1E;;;8BAG8B;AAC9B,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAkBjG;AAqCD,wBAAsB,wBAAwB,CAAC,KAAK,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BhH"}

package/lib/native-cgroup-roots.js

@@ -0,0 +1,121 @@
+import { lstat, readFile, realpath, statfs } from 'node:fs/promises';
+import { resolve } from 'node:path';
+/** Read-only discovery of the four cgroup v1 delegation roots created by the
+ * root-run scripts/isolation/prepare-linux-cgroups.mjs delegation command.
+ * Discovery never creates, remounts, synthesizes v2 roots or falls back to
+ * rlimit/host-PID containment: a missing or ambiguous delegation is an
+ * environment gap reported as not-ready so installation stops before granting
+ * any finite behavior authority. */
+const V1_MAGIC = 0x27e0eb;
+const CONTROLLERS = ['cpu', 'memory', 'pids', 'freezer'];
+const MOUNT_PATTERN = /^\/sys\/fs\/cgroup\/[A-Za-z0-9_,]+$/u;
+const DELEGATION_HINT = 'rerun scripts/isolation/prepare-linux-cgroups.mjs --uid <owner uid> --v1 as root';
+export class RsiLinuxCgroupUnavailableError extends Error {
+    code = 'rsi-linux-cgroup-unavailable';
+    constructor(message) { super(`rsi linux cgroup unavailable: ${message}`); }
+}
+function fail(message) { throw new Error(`rsi linux cgroup roots: ${message}`); }
+function unavailable(message) { throw new RsiLinuxCgroupUnavailableError(`${message}; ${DELEGATION_HINT}`); }
+/** Parse cgroup v1 controller mounts from /proc/self/mountinfo using the same
+ * split/field rules as the delegation command. Each required controller must
+ * have exactly one mount; cgroup2, other hierarchies and non-/sys/fs/cgroup
+ * mountpoints are ignored. */
+export function parseLinuxV1ControllerMounts(lines) {
+    const mounts = new Map();
+    for (const line of lines) {
+        const [before, after] = line.split(' - ');
+        const fields = before?.split(' '), filesystem = after?.split(' ');
+        if (filesystem?.[0] !== 'cgroup' || !fields?.[4]?.startsWith('/sys/fs/cgroup/'))
+            continue;
+        const options = filesystem[2]?.split(',') ?? [];
+        for (const controller of CONTROLLERS) {
+            if (!options.includes(controller))
+                continue;
+            if (mounts.has(controller))
+                unavailable(`multiple ${controller} cgroup mounts are ambiguous`);
+            mounts.set(controller, fields[4]);
+        }
+    }
+    if (mounts.size !== CONTROLLERS.length) {
+        const missing = CONTROLLERS.filter(controller => !mounts.has(controller)).join(', ');
+        unavailable(`cgroup v1 controllers are not all mounted (missing ${missing})`);
+    }
+    return Object.fromEntries(CONTROLLERS.map(controller => [controller, mounts.get(controller)]));
+}
+/** The delegated leaf mirrors the delegation command's strict leaf contract:
+ * canonical real path, no symlink, owned by the invoking non-root user, exactly
+ * mode 0700 and a cgroup v1 filesystem reached through exactly one mountinfo
+ * entry for this controller. */
+async function checkedLeaf(input) {
+    const { controller, mount, lines } = input;
+    input.signal?.throwIfAborted();
+    if (typeof process.getuid !== 'function')
+        fail('process identity is unavailable');
+    const owner = process.getuid();
+    const path = `${mount}/dsh-native/uid-${owner}`;
+    const matching = lines.filter(line => {
+        const [before, after] = line.split(' - ');
+        const fields = before?.split(' '), filesystem = after?.split(' ');
+        return fields?.[4] === mount && filesystem?.[0] === 'cgroup'
+            && (filesystem[2]?.split(',') ?? []).includes(controller);
+    });
+    if (matching.length !== 1)
+        unavailable(`the ${controller} controller mount identity is not unique`);
+    try {
+        if (resolve(path) !== path || await realpath(path) !== path)
+            unavailable(`the delegated ${controller} root is not canonical`);
+        const info = await lstat(path);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            unavailable(`the delegated ${controller} root is not a private directory`);
+        if (info.uid !== owner)
+            unavailable(`the delegated ${controller} root is not owned by uid ${owner}`);
+        if ((info.mode & 0o077) !== 0 || (info.mode & 0o700) !== 0o700)
+            unavailable(`the delegated ${controller} root is not mode 0700`);
+        if ((await statfs(path)).type !== V1_MAGIC)
+            unavailable(`the delegated ${controller} root is not a cgroup v1 filesystem`);
+    }
+    catch (error) {
+        const code = error.code;
+        if (error instanceof RsiLinuxCgroupUnavailableError)
+            throw error;
+        if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'EPERM') {
+            unavailable(`the delegated ${controller} root at ${path} is unavailable (${code})`);
+        }
+        throw error;
+    }
+    return path;
+}
+export async function discoverLinuxCgroupRoots(input = {}) {
+    input.signal?.throwIfAborted();
+    if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) {
+        fail('cgroup v1 delegation discovery requires Linux x64/arm64');
+    }
+    if (typeof process.getuid !== 'function' || process.getuid() === 0) {
+        fail('cgroup delegation must be discovered as the non-root owner, never root');
+    }
+    const lines = (await readFile('/proc/self/mountinfo', { encoding: 'utf8', signal: input.signal })).split('\n');
+    const mounts = parseLinuxV1ControllerMounts(lines);
+    const roots = {};
+    for (const controller of CONTROLLERS) {
+        const mount = mounts[controller];
+        if (!MOUNT_PATTERN.test(mount))
+            unavailable(`unexpected ${controller} controller mount ${mount}`);
+        try {
+            if ((await statfs(mount)).type !== V1_MAGIC)
+                unavailable(`${mount} is not a cgroup v1 filesystem`);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'EPERM') {
+                unavailable(`the ${controller} controller mount ${mount} is unavailable (${code})`);
+            }
+            throw error;
+        }
+        roots[controller] = await checkedLeaf({ controller, mount, lines, ...(input.signal ? { signal: input.signal } : {}) });
+    }
+    if (new Set(CONTROLLERS.map(controller => roots[controller])).size !== CONTROLLERS.length) {
+        unavailable('delegated controller roots are not distinct hierarchies');
+    }
+    return { mode: 'v1', cpu: roots.cpu, memory: roots.memory, pids: roots.pids, freezer: roots.freezer };
+}
+//# sourceMappingURL=native-cgroup-roots.js.map

package/lib/native-cgroup-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-cgroup-roots.js","sourceRoot":"","sources":["../src/native-cgroup-roots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC;;;;;oCAKoC;AACpC,MAAM,QAAQ,GAAG,QAAQ,CAAA;AACzB,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AAEjE,MAAM,aAAa,GAAG,sCAAsC,CAAA;AAC5D,MAAM,eAAe,GAAG,kFAAkF,CAAA;AAE1G,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAC9C,IAAI,GAAG,8BAA8B,CAAA;IAC9C,YAAY,OAAe,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;CACnF;AAED,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC/F,SAAS,WAAW,CAAC,OAAe,IAAW,MAAM,IAAI,8BAA8B,CAAC,GAAG,OAAO,KAAK,eAAe,EAAE,CAAC,CAAA,CAAC,CAAC;AAI3H;;;8BAG8B;AAC9B,MAAM,UAAU,4BAA4B,CAAC,KAAwB;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACjE,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC;YAAE,SAAQ;QACzF,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAQ;YAC3C,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,WAAW,CAAC,YAAY,UAAU,8BAA8B,CAAC,CAAA;YAC7F,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpF,WAAW,CAAC,sDAAsD,OAAO,GAAG,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,CAAC,CAA+B,CAAA;AAC/H,CAAC;AAED;;;gCAGgC;AAChC,KAAK,UAAU,WAAW,CAAC,KAAgG;IACzH,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC1C,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAG,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAA;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACnC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACjE,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ;eACvD,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,WAAW,CAAC,OAAO,UAAU,0CAA0C,CAAC,CAAA;IACnG,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,WAAW,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAA;QAC7H,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,WAAW,CAAC,iBAAiB,UAAU,kCAAkC,CAAC,CAAA;QAC5H,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK;YAAE,WAAW,CAAC,iBAAiB,UAAU,6BAA6B,KAAK,EAAE,CAAC,CAAA;QACpG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;YAAE,WAAW,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAA;QAChI,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,iBAAiB,UAAU,qCAAqC,CAAC,CAAA;IAC3H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAA;QAChE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrF,WAAW,CAAC,iBAAiB,UAAU,YAAY,IAAI,oBAAoB,IAAI,GAAG,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAkC,EAAE;IACjF,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,yDAAyD,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,wEAAwE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9G,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,EAAgC,CAAA;IAC9C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAE,CAAA;QACjC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,WAAW,CAAC,cAAc,UAAU,qBAAqB,KAAK,EAAE,CAAC,CAAA;QACjG,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,WAAW,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAA;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrF,WAAW,CAAC,OAAO,UAAU,qBAAqB,KAAK,oBAAoB,IAAI,GAAG,CAAC,CAAA;YACrF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACxH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1F,WAAW,CAAC,yDAAyD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAa,EAAE,GAAG,EAAE,KAAK,CAAC,GAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAQ,EAAE,CAAA;AACpH,CAAC"}

package/lib/native-resources.d.ts

@@ -0,0 +1,44 @@
+import { type LinuxRuntime } from './linux-runtime.js';
+import { type FrozenLinuxRuntimeSource } from './linux-runtime-source.js';
+export { freezeLinuxRuntimeSource, type FrozenLinuxRuntimeSource, type LinuxRuntimeSourceInput } from './linux-runtime-source.js';
+export { probeLinuxIsolationRuntime, type LinuxIsolationProbeConfig } from './probe.js';
+export { validateLinuxRuntime, type LinuxRuntime } from './linux-runtime.js';
+export { validateLinuxCgroupRoots } from './linux-execution-contract.js';
+export type { LinuxCgroupRoots } from './linux-cgroups.js';
+export { discoverLinuxCgroupRoots, parseLinuxV1ControllerMounts, RsiLinuxCgroupUnavailableError, type LinuxV1CgroupRoots } from './native-cgroup-roots.js';
+export declare const NODE_VERSION = "v22.23.2";
+export declare const NODE_ARCHIVES: {
+    readonly x64: "b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a";
+    readonly arm64: "013b59cfd2819703a6f4a14ab891fc46fc2a4e3f5bcd92de3fb4929b43e35b30";
+};
+/** Environmental prerequisites are missing (platform, binaries, namespace or
+ * tmpfs support). Integrity/identity failures stay hard errors via fail(). */
+export declare class LinuxRsiRuntimeUnavailableError extends Error {
+    constructor(message: string);
+}
+export interface PreparedLinuxRuntime {
+    schemaVersion: 3;
+    backend: 'linux-native';
+    sourceCommit: string;
+    lockSha256: string;
+    runtime: LinuxRuntime;
+}
+export interface LinuxRuntimeInput {
+    dshHome: string;
+    profile: string;
+    source: FrozenLinuxRuntimeSource;
+    signal?: AbortSignal;
+    /** Trusted caller-specific provenance fence, rechecked before/after preparation. */
+    revalidateSource?: () => Promise<void>;
+    /** Exact cached official archives, still checked against fixed digest. */
+    nodeArchivePath?: string;
+    pnpmArchivePath?: string;
+    pnpmExeArchivePath?: string;
+    pnpmNativeArchivePath?: string;
+}
+export declare function officialArchive(path: string | undefined, url: string, expected: string, maximum: number, stage: string, signal: AbortSignal): Promise<string>;
+export declare function extractExact(archive: string, member: string, cwd: string, signal: AbortSignal, maximum: number): Promise<Buffer>;
+/** Build only the approved manifest and lock dependency closure; candidate code is never present. */
+export declare function prepareLinuxRuntime(input: LinuxRuntimeInput): Promise<PreparedLinuxRuntime>;
+export declare function readLinuxRuntime(input: LinuxRuntimeInput): Promise<PreparedLinuxRuntime>;
+//# sourceMappingURL=native-resources.d.ts.map

package/lib/native-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-resources.d.ts","sourceRoot":"","sources":["../src/native-resources.ts"],"names":[],"mappings":"AAOA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAChG,OAAO,EAA6B,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AACpG,OAAO,EAAE,wBAAwB,EAAE,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACjI,OAAO,EAAE,0BAA0B,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAA;AACvF,OAAO,EAAE,oBAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE1J,eAAO,MAAM,YAAY,aAAa,CAAA;AAGtC,eAAO,MAAM,aAAa;;;CAGhB,CAAA;AAcV;8EAC8E;AAC9E,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,OAAO,EAAE,MAAM;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,YAAY,CAAA;CACtB;AACD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,wBAAwB,CAAA;IAChC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC/B;AA8CD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAC5G,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBrD;AACD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAClG,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlC;AAmED,qGAAqG;AACrG,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6HjG;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAW9F"}