@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/linux-execution-contract.d.ts

@@ -0,0 +1,123 @@
+import type { LinuxCgroupDirectory, LinuxCgroupLimits, LinuxCgroupRoots, LinuxCgroupSnapshot } from './linux-cgroups.js';
+import type { IsolationLimits } from './types.js';
+import type { LinuxSystemSnapshot } from './linux-system-snapshot.js';
+import { type LinuxUserNamespaceMapping, type LinuxUserNamespaceWitness } from './linux-user-namespace.js';
+export interface LinuxExecutionContractV1 {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    runtimeDigest: string;
+    profile: 'ordinary' | 'repository';
+    limits: IsolationLimits;
+    keeperLimits: LinuxCgroupLimits;
+    cgroupRoots: LinuxCgroupRoots;
+}
+export interface LinuxExecutionIntentV1 {
+    schemaVersion: 1;
+    jobId: string;
+    requestDigest: string;
+    nativeResourceId: string;
+    nativeNonce: string;
+    contractDigest: string;
+    bootId: string;
+    uid: number;
+    deadline: number;
+    namespacePath: string;
+    workerNonce: string;
+    keeperNonce: string;
+    roots: Record<string, LinuxCgroupDirectory>;
+}
+/** Repository authority is explicit and cannot enter the ordinary text runner. */
+export interface LinuxRepositoryExecutionContractV2 extends Omit<LinuxExecutionContractV1, 'schemaVersion' | 'profile' | 'limits'> {
+    schemaVersion: 2;
+    profile: 'repository';
+    limits: IsolationLimits & {
+        tmpMiB: number;
+        tmpInodes: number;
+        inputMiB: 65;
+        inputInodes: 16;
+    };
+}
+export interface LinuxRepositoryExecutionContractV3 extends Omit<LinuxRepositoryExecutionContractV2, 'schemaVersion'> {
+    schemaVersion: 3;
+    implementationDigest: string;
+    userNamespace: LinuxUserNamespaceMapping;
+    systemSnapshot: LinuxSystemSnapshot;
+}
+export type LinuxRepositoryExecutionContract = LinuxRepositoryExecutionContractV2 | LinuxRepositoryExecutionContractV3;
+export type LinuxExecutionContract = LinuxExecutionContractV1 | LinuxRepositoryExecutionContract;
+export interface LinuxRepositoryExecutionIntent extends Omit<LinuxExecutionIntentV1, 'schemaVersion'> {
+    schemaVersion: 2 | 3;
+    repository: {
+        archive: {
+            bytes: number;
+            sha256: string;
+        };
+        artifacts: string[];
+        executionDigest: string;
+    };
+}
+export type LinuxExecutionIntent = LinuxExecutionIntentV1 | LinuxRepositoryExecutionIntent;
+/** Maximum local spool reservation: two 32 MiB artifact copies, three 14 MiB
+ * JSON records and 2 MiB metadata headroom. Archives use only memory/pipes here;
+ * a source-job ledger must add its own archive/pack staging budget before prepare. */
+export declare const LINUX_REPOSITORY_STORAGE_BYTES: number;
+export interface LinuxExecutionResourcesV1 {
+    schemaVersion: 1;
+    intentDigest: string;
+    worker: LinuxCgroupSnapshot;
+    keeper: LinuxCgroupSnapshot;
+}
+export interface LinuxExecutionResourcesV2 extends Omit<LinuxExecutionResourcesV1, 'schemaVersion'> {
+    schemaVersion: 2;
+    userNamespace: {
+        witness: LinuxUserNamespaceWitness;
+        keeperGate: {
+            pid: number;
+            startTicks: string;
+            bootId: string;
+            uid: number;
+        };
+    } | null;
+}
+export type LinuxExecutionResources = LinuxExecutionResourcesV1 | LinuxExecutionResourcesV2;
+/** Host validates the private receipt and kernel evidence before presenting this binding. */
+export interface LinuxReceiptBinding {
+    requestDigest: string;
+    nativeNonce: string;
+    nativeResourceId: string;
+    intentDigest: string;
+    resourcesDigest: string;
+    receiptDigest: string;
+}
+/** Host-owned evidence for a dispatched job that never reached start admission. */
+export interface LinuxExecutionPartialCleanupProof {
+    schemaVersion: 1;
+    jobId: string;
+    requestDigest: string;
+    nativeResourceId: string;
+    nativeNonce: string;
+    intentDigest: string;
+    observedAt: number;
+    workerAbsent: true;
+    keeperAbsent: true;
+    namespaceAbsent: true;
+    proofDigest: string;
+}
+export declare function linuxExecutionPartialCleanupProofDigest(value: Omit<LinuxExecutionPartialCleanupProof, 'proofDigest'>): string;
+export declare function validateLinuxExecutionPartialCleanupProof(value: unknown): LinuxExecutionPartialCleanupProof;
+/** Pure static validation; no filesystem, cgroup creation or authority is acquired. */
+export declare function validateLinuxCgroupRoots(value: unknown): LinuxCgroupRoots;
+export declare function validateLinuxExecutionContract(value: unknown): LinuxExecutionContract;
+export declare function linuxExecutionContractDigest(value: LinuxExecutionContract): string;
+export declare function validateLinuxExecutionIntent(value: unknown, contract: LinuxExecutionContract): LinuxExecutionIntent;
+export declare function linuxExecutionIntentDigest(value: LinuxExecutionIntent): string;
+export declare function validateLinuxExecutionResources(value: unknown, intent: LinuxExecutionIntent, contract: LinuxExecutionContract): LinuxExecutionResources;
+export declare function linuxExecutionResourcesDigest(value: LinuxExecutionResources): string;
+export declare function validateLinuxReceiptBinding(value: unknown): LinuxReceiptBinding;
+/** All tmpfs mounts, keeper capacity and durable staging are admitted together. */
+export declare function linuxJobResourceReservation(contract: LinuxExecutionContract): {
+    memoryMiB: number;
+    workspaceInodes: number;
+    storageBytes: number;
+};
+//# sourceMappingURL=linux-execution-contract.d.ts.map

package/lib/linux-execution-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-execution-contract.d.ts","sourceRoot":"","sources":["../src/linux-execution-contract.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAExH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EACL,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAEnG,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,UAAU,GAAG,YAAY,CAAA;IAClC,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,iBAAiB,CAAA;IAC/B,WAAW,EAAE,gBAAgB,CAAA;CAC9B;AACD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,CAAC,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;CAC5C;AACD,kFAAkF;AAClF,MAAM,WAAW,kCAAmC,SAAQ,IAAI,CAAC,wBAAwB,EAAE,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;IAChI,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,eAAe,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,EAAE,CAAC;QAAC,WAAW,EAAE,EAAE,CAAA;KAAE,CAAA;CAC/F;AACD,MAAM,WAAW,kCAAmC,SAAQ,IAAI,CAAC,kCAAkC,EAAE,eAAe,CAAC;IACnH,aAAa,EAAE,CAAC,CAAA;IAChB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,aAAa,EAAE,yBAAyB,CAAA;IACxC,cAAc,EAAE,mBAAmB,CAAA;CACpC;AACD,MAAM,MAAM,gCAAgC,GAAG,kCAAkC,GAAG,kCAAkC,CAAA;AACtH,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,GAAG,gCAAgC,CAAA;AAChG,MAAM,WAAW,8BAA+B,SAAQ,IAAI,CAAC,sBAAsB,EAAE,eAAe,CAAC;IACnG,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;IACpB,UAAU,EAAE;QAAE,OAAO,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAA;CACzG;AACD,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,8BAA8B,CAAA;AAC1F;;sFAEsF;AACtF,eAAO,MAAM,8BAA8B,QAAkB,CAAA;AAC7D,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AACD,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC;IACjG,aAAa,EAAE,CAAC,CAAA;IAChB,aAAa,EAAE;QACb,OAAO,EAAE,yBAAyB,CAAA;QAClC,UAAU,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAC7E,GAAG,IAAI,CAAA;CACT;AACD,MAAM,MAAM,uBAAuB,GAAG,yBAAyB,GAAG,yBAAyB,CAAA;AAC3F,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;CACtB;AACD,mFAAmF;AACnF,MAAM,WAAW,iCAAiC;IAChD,aAAa,EAAE,CAAC,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,IAAI,CAAA;IAClB,YAAY,EAAE,IAAI,CAAA;IAClB,eAAe,EAAE,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB;AA0BD,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,IAAI,CAAC,iCAAiC,EAAE,aAAa,CAAC,GAAG,MAAM,CAO7H;AACD,wBAAgB,yCAAyC,CAAC,KAAK,EAAE,OAAO,GAAG,iCAAiC,CAK3G;AAaD,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAUzE;AACD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CA2BrF;AACD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAyD;AAgC5I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,GAAG,oBAAoB,CAWnH;AACD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAsC;AAsCrH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,sBAAsB,GAAG,uBAAuB,CA6BvJ;AACD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAEpF;AACD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAM/E;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAWlJ"}

package/lib/linux-execution-contract.js

@@ -0,0 +1,279 @@
+import { createHash } from 'node:crypto';
+import { posix } from 'node:path';
+import { plannedStorageBytes } from './storage-policy.js';
+import { validateLinuxUserNamespaceMapping, validateLinuxUserNamespaceWitness } from './linux-user-namespace.js';
+/** Maximum local spool reservation: two 32 MiB artifact copies, three 14 MiB
+ * JSON records and 2 MiB metadata headroom. Archives use only memory/pipes here;
+ * a source-job ledger must add its own archive/pack staging budget before prepare. */
+export const LINUX_REPOSITORY_STORAGE_BYTES = 108 * 1024 ** 2;
+const HEX = /^[a-f0-9]{64}$/u;
+const NONCE = /^[a-f0-9]{32}$/u;
+const UUID = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u;
+const controllers = ['cpu', 'memory', 'pids', 'freezer'];
+function fail() { throw new Error('invalid Linux execution contract or binding'); }
+const positive = (value) => Number.isSafeInteger(value) && value > 0;
+const natural = (value) => Number.isSafeInteger(value) && value >= 0;
+const matches = (value, pattern) => typeof value === 'string' && pattern.test(value);
+const path = (value) => typeof value === 'string' && value.length <= 4096 && value !== '/' && posix.isAbsolute(value) && posix.normalize(value) === value && !/[\p{Cc}\\]/u.test(value);
+function object(value, keys) {
+    if (!value || typeof value !== 'object' || Object.getPrototypeOf(value) !== Object.prototype
+        || Object.keys(value).length !== keys.length || keys.some(key => !Object.hasOwn(value, key)))
+        fail();
+}
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        for (const entry of Object.values(value))
+            freeze(entry);
+        Object.freeze(value);
+    }
+    return value;
+}
+function clone(value) { return freeze(JSON.parse(JSON.stringify(value))); }
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object')
+        return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+const digest = (value) => createHash('sha256').update(canonical(value)).digest('hex');
+export function linuxExecutionPartialCleanupProofDigest(value) {
+    object(value, ['schemaVersion', 'jobId', 'requestDigest', 'nativeResourceId', 'nativeNonce', 'intentDigest', 'observedAt', 'workerAbsent', 'keeperAbsent', 'namespaceAbsent']);
+    if (value.schemaVersion !== 1 || !matches(value.jobId, UUID) || !matches(value.requestDigest, HEX)
+        || value.nativeResourceId !== `linux-${value.jobId}` || !matches(value.nativeNonce, NONCE)
+        || !matches(value.intentDigest, HEX) || !positive(value.observedAt)
+        || value.workerAbsent !== true || value.keeperAbsent !== true || value.namespaceAbsent !== true)
+        fail();
+    return digest(value);
+}
+export function validateLinuxExecutionPartialCleanupProof(value) {
+    object(value, ['schemaVersion', 'jobId', 'requestDigest', 'nativeResourceId', 'nativeNonce', 'intentDigest', 'observedAt', 'workerAbsent', 'keeperAbsent', 'namespaceAbsent', 'proofDigest']);
+    const { proofDigest, ...body } = value;
+    if (!matches(proofDigest, HEX) || proofDigest !== linuxExecutionPartialCleanupProofDigest(body))
+        fail();
+    return clone(value);
+}
+function limits(value) {
+    object(value, ['memoryMiB', 'pidsLimit', 'cpus']);
+    if (!positive(value.memoryMiB) || value.memoryMiB > 65_536 || !positive(value.pidsLimit) || value.pidsLimit > 4096
+        || typeof value.cpus !== 'number' || !Number.isFinite(value.cpus) || value.cpus < 0.1 || value.cpus > 64)
+        fail();
+}
+function rootEntries(value) {
+    return value.mode === 'v1' ? controllers.map(key => [key, value[key]]) : [['unified', value.unified]];
+}
+function directory(value, expected) {
+    object(value, ['path', 'dev', 'ino']);
+    if (value.path !== expected || !natural(value.dev) || !positive(value.ino))
+        fail();
+}
+/** Pure static validation; no filesystem, cgroup creation or authority is acquired. */
+export function validateLinuxCgroupRoots(value) {
+    const roots = value;
+    if (!roots || !['v1', 'v2'].includes(roots.mode))
+        fail();
+    object(roots, roots.mode === 'v1' ? ['mode', ...controllers] : ['mode', 'unified']);
+    const entries = rootEntries(roots);
+    if (new Set(entries.map(([, root]) => root)).size !== entries.length)
+        fail();
+    for (const [, root] of entries)
+        if (!path(root) || !(roots.mode === 'v1'
+            ? /^\/sys\/fs\/cgroup\/[A-Za-z0-9_,]+\/dsh-native\/uid-[1-9][0-9]*$/u
+            : /^\/sys\/fs\/cgroup\/dsh-native\/uid-[1-9][0-9]*$/u).test(root))
+            fail();
+    return clone(roots);
+}
+export function validateLinuxExecutionContract(value) {
+    object(value, ['schemaVersion', 'backend', 'runtimeDigest', 'profile', 'limits', 'keeperLimits', 'cgroupRoots', ...(value?.schemaVersion === 3 ? ['implementationDigest', 'userNamespace', 'systemSnapshot'] : [])]);
+    if (![1, 2, 3].includes(value.schemaVersion) || value.backend !== 'linux-native' || !matches(value.runtimeDigest, HEX) || !['ordinary', 'repository'].includes(value.profile))
+        fail();
+    object(value.limits, ['maxDurationMs', 'maxInputBytes', 'maxOutputBytes', 'maxArtifactBytes', 'maxFiles', 'memoryMiB', 'workspaceMiB', 'workspaceInodes', 'pidsLimit', 'cpus', ...(value.schemaVersion !== 1 ? ['tmpMiB', 'tmpInodes', 'inputMiB', 'inputInodes'] : [])]);
+    for (const [key, item] of Object.entries(value.limits))
+        if (key !== 'cpus' && !positive(item))
+            fail();
+    limits({ memoryMiB: value.limits.memoryMiB, pidsLimit: value.limits.pidsLimit, cpus: value.limits.cpus });
+    if (value.schemaVersion !== 1 && (value.profile !== 'repository' || value.limits.inputMiB !== 65 || value.limits.inputInodes !== 16
+        || value.limits.tmpMiB > 4096 || value.limits.tmpInodes > 1_000_000 || value.limits.tmpInodes < 16
+        || value.limits.workspaceMiB > 8192 || value.limits.maxDurationMs > 1_800_000))
+        fail();
+    if (value.limits.maxInputBytes > (value.schemaVersion !== 1 ? 64 * 1024 ** 2 : 1_048_576) || value.limits.maxOutputBytes > 1_048_576
+        || value.limits.maxArtifactBytes > (value.schemaVersion !== 1 ? 32 * 1024 ** 2 : 1_048_576) || value.limits.maxFiles > 128
+        || value.limits.workspaceInodes < 16 || value.limits.workspaceInodes > 1_000_000
+        || value.limits.workspaceMiB > 65_536)
+        fail();
+    limits(value.keeperLimits);
+    if (value.schemaVersion !== 1 && (value.keeperLimits.memoryMiB < 256 || value.keeperLimits.pidsLimit < 64 || value.keeperLimits.cpus < 0.5))
+        fail();
+    if (value.schemaVersion === 3) {
+        if (!matches(value.implementationDigest, HEX))
+            fail();
+        validateLinuxUserNamespaceMapping(value.userNamespace);
+        object(value.systemSnapshot, ['schemaVersion', 'root', 'manifestSha256', 'bytes', 'entries']);
+        const snapshot = value.systemSnapshot;
+        object(snapshot.root, ['path', 'dev', 'ino', 'sha256']);
+        if (snapshot.schemaVersion !== 1 || !path(snapshot.root.path) || !natural(snapshot.root.dev) || !positive(snapshot.root.ino)
+            || !matches(snapshot.root.sha256, HEX) || !matches(snapshot.manifestSha256, HEX)
+            || !positive(snapshot.bytes) || snapshot.bytes > 640 * 1024 ** 2 || !positive(snapshot.entries) || snapshot.entries > 32768)
+            fail();
+    }
+    validateLinuxCgroupRoots(value.cgroupRoots);
+    return clone(value);
+}
+export function linuxExecutionContractDigest(value) { return digest(validateLinuxExecutionContract(value)); }
+function intentValue(value) {
+    object(value, ['schemaVersion', 'jobId', 'requestDigest', 'nativeResourceId', 'nativeNonce', 'contractDigest', 'bootId', 'uid', 'deadline', 'namespacePath', 'workerNonce', 'keeperNonce', 'roots', ...([2, 3].includes(value?.schemaVersion) ? ['repository'] : [])]);
+    if (![1, 2, 3].includes(value.schemaVersion) || !matches(value.jobId, UUID) || !matches(value.requestDigest, HEX) || value.nativeResourceId !== `linux-${value.jobId}`
+        || !matches(value.nativeNonce, NONCE) || !matches(value.contractDigest, HEX) || !matches(value.bootId, UUID)
+        || !positive(value.uid) || value.uid > 0xffff_fffe || !positive(value.deadline) || !path(value.namespacePath)
+        || !matches(value.workerNonce, NONCE) || !matches(value.keeperNonce, NONCE) || value.workerNonce === value.keeperNonce)
+        fail();
+    if (value.schemaVersion !== 1) {
+        object(value.repository, ['archive', 'artifacts', 'executionDigest']);
+        object(value.repository.archive, ['bytes', 'sha256']);
+        if (!positive(value.repository.archive.bytes) || value.repository.archive.bytes > 64 * 1024 ** 2
+            || !matches(value.repository.archive.sha256, HEX) || !matches(value.repository.executionDigest, HEX)
+            || !Array.isArray(value.repository.artifacts) || value.repository.artifacts.length > 128
+            || value.repository.artifacts.some(item => typeof item !== 'string' || item.length < 1 || item.length > 4096
+                || posix.isAbsolute(item) || /[\p{Cc}\\]/u.test(item) || item.split('/').some(part => !part || part === '.' || part === '..'))
+            || new Set(value.repository.artifacts).size !== value.repository.artifacts.length)
+            fail();
+    }
+    const roots = value.roots;
+    const keys = roots && typeof roots === 'object' && Object.hasOwn(roots, 'unified') ? ['unified'] : controllers;
+    object(roots, keys);
+    for (const key of keys) {
+        const entry = roots[key];
+        if (!entry || typeof entry !== 'object')
+            fail();
+        const root = entry.path;
+        if (!path(root) || !(key === 'unified'
+            ? /^\/sys\/fs\/cgroup\/dsh-native\/uid-[1-9][0-9]*$/u
+            : /^\/sys\/fs\/cgroup\/[A-Za-z0-9_,]+\/dsh-native\/uid-[1-9][0-9]*$/u).test(root)
+            || !root.endsWith(`/uid-${value.uid}`))
+            fail();
+        directory(entry, root);
+    }
+    return value;
+}
+export function validateLinuxExecutionIntent(value, contract) {
+    const checked = validateLinuxExecutionContract(contract);
+    const intent = intentValue(value);
+    if (intent.contractDigest !== linuxExecutionContractDigest(checked) || intent.schemaVersion !== checked.schemaVersion
+        || intent.schemaVersion !== 1 && (intent.repository.archive.bytes > checked.limits.maxInputBytes
+            || intent.repository.artifacts.length > checked.limits.maxFiles))
+        fail();
+    if (checked.schemaVersion === 3 && checked.userNamespace.ownerUid !== intent.uid)
+        fail();
+    const entries = rootEntries(checked.cgroupRoots);
+    object(intent.roots, entries.map(([key]) => key));
+    for (const [key, root] of entries)
+        directory(intent.roots[key], root);
+    return clone(intent);
+}
+export function linuxExecutionIntentDigest(value) { return digest(intentValue(value)); }
+function snapshotValue(value) {
+    object(value, ['schemaVersion', 'mode', 'bootId', 'jobId', 'nonce', 'uid', 'deadline', 'limits', 'directories']);
+    if (value.schemaVersion !== 1 || value.mode !== 'v1' && value.mode !== 'v2' || !matches(value.bootId, UUID)
+        || !matches(value.jobId, UUID) || !matches(value.nonce, NONCE) || !positive(value.uid) || value.uid > 0xffff_fffe || !positive(value.deadline))
+        fail();
+    limits(value.limits);
+    const keys = value.mode === 'v1' ? controllers : ['unified'];
+    object(value.directories, keys);
+    for (const key of keys) {
+        const entry = value.directories[key];
+        if (!entry || typeof entry !== 'object')
+            fail();
+        const child = entry.path;
+        if (!path(child) || !child.endsWith(`/uid-${value.uid}/job-${value.jobId}-${value.nonce}`))
+            fail();
+        directory(entry, child);
+    }
+    return value;
+}
+function resourcesValue(value) {
+    object(value, ['schemaVersion', 'intentDigest', 'worker', 'keeper', ...(value?.schemaVersion === 2 ? ['userNamespace'] : [])]);
+    if (![1, 2].includes(value.schemaVersion) || !matches(value.intentDigest, HEX))
+        fail();
+    const worker = snapshotValue(value.worker), keeper = snapshotValue(value.keeper);
+    if (worker.mode !== keeper.mode || worker.bootId !== keeper.bootId || worker.jobId !== keeper.jobId || worker.uid !== keeper.uid
+        || worker.deadline !== keeper.deadline || worker.nonce === keeper.nonce)
+        fail();
+    for (const key of Object.keys(worker.directories)) {
+        const left = worker.directories[key], right = keeper.directories[key];
+        if (posix.dirname(left.path) !== posix.dirname(right.path) || left.dev !== right.dev || left.ino === right.ino)
+            fail();
+    }
+    if (value.schemaVersion === 2 && value.userNamespace !== null) {
+        object(value.userNamespace, ['witness', 'keeperGate']);
+        const witness = validateLinuxUserNamespaceWitness(value.userNamespace.witness);
+        const gate = value.userNamespace.keeperGate;
+        object(gate, ['pid', 'startTicks', 'bootId', 'uid']);
+        if (witness.bootId !== worker.bootId || witness.ownerUid !== worker.uid || !positive(gate.pid)
+            || typeof gate.startTicks !== 'string' || !/^[1-9][0-9]{0,63}$/u.test(gate.startTicks)
+            || gate.bootId !== worker.bootId || gate.uid !== worker.uid)
+            fail();
+    }
+    return value;
+}
+export function validateLinuxExecutionResources(value, intent, contract) {
+    const checked = validateLinuxExecutionIntent(intent, contract);
+    resourcesValue(value);
+    object(value, ['schemaVersion', 'intentDigest', 'worker', 'keeper', ...(contract.schemaVersion === 3 ? ['userNamespace'] : [])]);
+    if (value.schemaVersion !== (contract.schemaVersion === 3 ? 2 : 1) || value.intentDigest !== linuxExecutionIntentDigest(checked))
+        fail();
+    if (contract.schemaVersion === 3) {
+        const bound = value.userNamespace;
+        if (bound && canonical(bound.witness.mapping) !== canonical(contract.userNamespace))
+            fail();
+    }
+    const entries = rootEntries(contract.cgroupRoots);
+    for (const kind of ['worker', 'keeper']) {
+        const item = value[kind];
+        object(item, ['schemaVersion', 'mode', 'bootId', 'jobId', 'nonce', 'uid', 'deadline', 'limits', 'directories']);
+        const nonce = checked[kind === 'worker' ? 'workerNonce' : 'keeperNonce'];
+        const expectedLimits = kind === 'worker' ? { memoryMiB: contract.limits.memoryMiB, pidsLimit: contract.limits.pidsLimit, cpus: contract.limits.cpus } : contract.keeperLimits;
+        limits(item.limits);
+        if (item.schemaVersion !== 1 || item.mode !== contract.cgroupRoots.mode || item.bootId !== checked.bootId || item.jobId !== checked.jobId
+            || item.nonce !== nonce || item.uid !== checked.uid || item.deadline !== checked.deadline || canonical(item.limits) !== canonical(expectedLimits))
+            fail();
+        object(item.directories, entries.map(([key]) => key));
+        for (const [key, root] of entries) {
+            directory(item.directories[key], `${root}/job-${checked.jobId}-${nonce}`);
+            const rootIdentity = checked.roots[key];
+            const child = item.directories[key];
+            if (child.dev !== rootIdentity.dev || child.ino === rootIdentity.ino)
+                fail();
+        }
+    }
+    const worker = value.worker, keeper = value.keeper;
+    for (const [key] of entries)
+        if (worker.directories[key].dev === keeper.directories[key].dev && worker.directories[key].ino === keeper.directories[key].ino)
+            fail();
+    return clone(value);
+}
+export function linuxExecutionResourcesDigest(value) {
+    return digest(resourcesValue(value));
+}
+export function validateLinuxReceiptBinding(value) {
+    object(value, ['requestDigest', 'nativeNonce', 'nativeResourceId', 'intentDigest', 'resourcesDigest', 'receiptDigest']);
+    if (!matches(value.requestDigest, HEX) || !matches(value.nativeNonce, NONCE) || typeof value.nativeResourceId !== 'string'
+        || !/^linux-[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u.test(value.nativeResourceId)
+        || !matches(value.intentDigest, HEX) || !matches(value.resourcesDigest, HEX) || !matches(value.receiptDigest, HEX))
+        fail();
+    return clone(value);
+}
+/** All tmpfs mounts, keeper capacity and durable staging are admitted together. */
+export function linuxJobResourceReservation(contract) {
+    const checked = validateLinuxExecutionContract(contract);
+    const { limits, keeperLimits } = checked;
+    if (checked.schemaVersion !== 1)
+        return {
+            memoryMiB: limits.memoryMiB + limits.workspaceMiB + checked.limits.tmpMiB + checked.limits.inputMiB + 1 + keeperLimits.memoryMiB + (checked.schemaVersion === 3 ? 8 : 0),
+            workspaceInodes: limits.workspaceInodes + checked.limits.tmpInodes + checked.limits.inputInodes + 4096 + 32 + (checked.schemaVersion === 3 ? 16_384 : 0),
+            storageBytes: 2 * limits.maxArtifactBytes + 44 * 1024 ** 2,
+        };
+    return { memoryMiB: limits.memoryMiB + limits.workspaceMiB
+            + Math.ceil(Math.max(1, Math.min(64, limits.memoryMiB / 4))) + 1 + keeperLimits.memoryMiB,
+        workspaceInodes: 2 * limits.workspaceInodes + 4096 + 32, storageBytes: 3 * plannedStorageBytes(limits) };
+}
+//# sourceMappingURL=linux-execution-contract.js.map

package/lib/linux-execution-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-execution-contract.js","sourceRoot":"","sources":["../src/linux-execution-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,OAAO,EAAE,iCAAiC,EAAE,iCAAiC,EACX,MAAM,2BAA2B,CAAA;AA6CnG;;sFAEsF;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAA;AAuC7D,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAA;AAC/B,MAAM,IAAI,GAAG,gDAAgD,CAAA;AAC7D,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AACjE,SAAS,IAAI,KAAY,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA,CAAC,CAAC;AACzF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAA;AAC1G,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAA;AAC1G,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,OAAe,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACtH,MAAM,IAAI,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjN,SAAS,MAAM,CAAC,KAAc,EAAE,IAAuB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;WACvF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;AACxG,CAAC;AACD,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;IACzH,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,KAAK,CAAI,KAAQ,IAAO,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC,CAAA,CAAC,CAAC;AACxF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACtE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACpL,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtG,MAAM,UAAU,uCAAuC,CAAC,KAA6D;IACnH,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC9K,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;WAC7F,KAAK,CAAC,gBAAgB,KAAK,SAAS,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC;WACvF,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;WAChE,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;QAAE,IAAI,EAAE,CAAA;IACzG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AACD,MAAM,UAAU,yCAAyC,CAAC,KAAc;IACtE,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAA;IAC7L,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,WAAW,KAAK,uCAAuC,CAAC,IAA8D,CAAC;QAAE,IAAI,EAAE,CAAA;IACjK,OAAO,KAAK,CAAC,KAAqD,CAAC,CAAA;AACrE,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI;WAC7G,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;QAAE,IAAI,EAAE,CAAA;AACpH,CAAC;AACD,SAAS,WAAW,CAAC,KAAuB;IAC1C,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;AACvG,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,EAAE,QAAgB;IACjD,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,IAAI,EAAE,CAAA;AACpF,CAAC;AACD,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,KAAK,GAAG,KAAyB,CAAA;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;IACxD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;IACnF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,IAAI,EAAE,CAAA;IAC5E,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI;YACtE,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,mDAAmD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,EAAE,CAAA;IAC3E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;AACrB,CAAC;AACD,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,CAAE,KAAwC,EAAE,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAuB,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAiB,CAAC;QAAE,IAAI,EAAE,CAAA;IACzM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzQ,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,EAAE,CAAA;IACrG,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACzG,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,EAAE;WAC7H,KAAK,CAAC,MAAM,CAAC,MAAiB,GAAG,IAAI,IAAK,KAAK,CAAC,MAAM,CAAC,SAAoB,GAAG,SAAS,IAAK,KAAK,CAAC,MAAM,CAAC,SAAoB,GAAG,EAAE;WAClI,KAAK,CAAC,MAAM,CAAC,YAAuB,GAAG,IAAI,IAAK,KAAK,CAAC,MAAM,CAAC,aAAwB,GAAG,SAAS,CAAC;QAAE,IAAI,EAAE,CAAA;IAChH,IAAK,KAAK,CAAC,MAAM,CAAC,aAAwB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,MAAM,CAAC,cAAyB,GAAG,SAAS;WACtJ,KAAK,CAAC,MAAM,CAAC,gBAA2B,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,MAAM,CAAC,QAAmB,GAAG,GAAG;WAC9I,KAAK,CAAC,MAAM,CAAC,eAA0B,GAAG,EAAE,IAAK,KAAK,CAAC,MAAM,CAAC,eAA0B,GAAG,SAAS;WACpG,KAAK,CAAC,MAAM,CAAC,YAAuB,GAAG,MAAM;QAAE,IAAI,EAAE,CAAA;IAC3D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC1B,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,IAAI,EAAE,CAAA;IACnJ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC;YAAE,IAAI,EAAE,CAAA;QACrD,iCAAiC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QACtD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAA;QACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;QACvD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;eACvH,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC;eAC7E,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,GAAG,KAAK;YAAE,IAAI,EAAE,CAAA;IACvI,CAAC;IACD,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,KAAK,CAAC,KAA0C,CAAC,CAAA;AAC1D,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,KAA6B,IAAY,OAAO,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;AAC5I,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAE,KAAwC,EAAE,aAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,KAAK,CAAC,KAAK,EAAE;WAC3K,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;WACzG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;WAC1G,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAAE,IAAI,EAAE,CAAA;IAChI,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;eAC3F,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC;eACjG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;eACrF,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;mBACvG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;eAC7H,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM;YAAE,IAAI,EAAE,CAAA;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC9G,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,EAAE,CAAA;QAC/C,MAAM,IAAI,GAAI,KAAiC,CAAC,IAAI,CAAA;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;YACpC,CAAC,CAAC,mDAAmD;YACrD,CAAC,CAAC,mEAAmE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eAC9E,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,GAAG,EAAE,CAAC;YAAE,IAAI,EAAE,CAAA;QAChD,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,KAAwC,CAAA;AACjD,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,KAAc,EAAE,QAAgC;IAC3F,MAAM,OAAO,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,CAAC,cAAc,KAAK,4BAA4B,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;WAChH,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa;eAC3F,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IAC5E,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,CAAA;IACxF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAChD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO;QAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAA2B,IAAY,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC;AACrH,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;IAChH,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;WACtG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IACxJ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACpB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC5D,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,EAAE,CAAA;QAC/C,MAAM,KAAK,GAAI,KAAiC,CAAC,IAAI,CAAA;QACrD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAAE,IAAI,EAAE,CAAA;QAClG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,KAAuC,CAAA;AAChD,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAE,KAAwC,EAAE,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC;QAAE,IAAI,EAAE,CAAA;IAChG,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;WAC3H,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,IAAI,EAAE,CAAA;IACjF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,EAAE,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,CAAA;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YAAE,IAAI,EAAE,CAAA;IACxH,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAA;QACtD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAA;QAC3C,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;eACzF,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;eACnF,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,CAAA;IACvE,CAAC;IACD,OAAO,KAA2C,CAAA;AACpD,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,KAAc,EAAE,MAA4B,EAAE,QAAgC;IAC5H,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9D,cAAc,CAAC,KAAK,CAAC,CAAA;IACrB,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAChI,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,OAAO,CAAC;QAAE,IAAI,EAAE,CAAA;IACxI,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,aAA2D,CAAA;QAC/E,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,EAAE,CAAA;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;QAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAA;QAC7K,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;eACpI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,cAAc,CAAC;YAAE,IAAI,EAAE,CAAA;QAC3J,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;YACzE,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAE,CAAA;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAyB,CAAA;YAC3D,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG;gBAAE,IAAI,EAAE,CAAA;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAwC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAwC,CAAA;IACtH,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO;QAAE,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,CAAC,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,CAAC,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,CAAC,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAE,CAAC,GAAG;YAAE,IAAI,EAAE,CAAA;IACvK,OAAO,KAAK,CAAC,KAA2C,CAAC,CAAA;AAC3D,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,KAA8B;IAC1E,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;AACtC,CAAC;AACD,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAA;IACvH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;WACrH,CAAC,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;WACpF,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;QAAE,IAAI,EAAE,CAAA;IAC5H,OAAO,KAAK,CAAC,KAAuC,CAAC,CAAA;AACvD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,MAAM,OAAO,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAA;IACxD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;IACxC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxK,eAAe,EAAE,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxJ,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;SAC3D,CAAA;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,YAAY;cACtD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS;QAC3F,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAA;AAC1G,CAAC"}

package/lib/linux-execution.d.ts

@@ -0,0 +1,123 @@
+import { type LinuxExecutionContract, type LinuxExecutionIntent, type LinuxExecutionResources, type LinuxReceiptBinding, type LinuxExecutionPartialCleanupProof, type LinuxExecutionIntentV1, type LinuxRepositoryExecutionContract, type LinuxRepositoryExecutionIntent } from './linux-execution-contract.js';
+import type { IsolationFile, IsolationResult } from './types.js';
+export interface LinuxExecutionReceiptV1 {
+    schemaVersion: 1;
+    intent: LinuxExecutionIntentV1;
+    resources: LinuxExecutionResources;
+    result: IsolationResult;
+    completedAt: number;
+    receiptDigest: string;
+}
+export interface LinuxRepositoryArtifactSummary {
+    path: string;
+    bytes: number;
+    sha256: string;
+}
+export interface LinuxRepositoryArtifact {
+    path: string;
+    bytes: Buffer;
+    sha256: string;
+}
+export interface LinuxRepositoryExecutionReceipt extends Omit<LinuxExecutionReceiptV1, 'schemaVersion' | 'intent'> {
+    schemaVersion: 2 | 3;
+    intent: LinuxRepositoryExecutionIntent;
+    repositoryArtifacts: LinuxRepositoryArtifactSummary[];
+}
+export type LinuxExecutionReceipt = LinuxExecutionReceiptV1 | LinuxRepositoryExecutionReceipt;
+export interface LinuxRepositoryExecutionContext {
+    stateRoot: string;
+    contract: LinuxRepositoryExecutionContract;
+    intent: LinuxRepositoryExecutionIntent;
+}
+export interface LinuxRepositoryExecutionRequest {
+    argv: readonly string[];
+    archive: {
+        bytes: Uint8Array;
+        sha256: string;
+    };
+    artifacts: readonly string[];
+    readOnlyRoots?: readonly string[];
+}
+interface Context {
+    stateRoot: string;
+    contract: LinuxExecutionContract;
+    intent: LinuxExecutionIntent;
+}
+/** Persists intent without creating cgroups or admitting a process. The Host must
+ * persist this value in its ledger and mark dispatch before calling run(). */
+interface PrepareInput {
+    stateRoot: string;
+    contract: LinuxExecutionContract;
+    job: {
+        id: string;
+        requestDigest: string;
+        nativeResourceId: string;
+        nativeNonce: string;
+        deadline: number;
+    };
+}
+export declare function prepareLinuxExecutionIntent(input: PrepareInput): Promise<LinuxExecutionIntent>;
+export declare function linuxExecutionReceiptBinding(receipt: LinuxExecutionReceipt): LinuxReceiptBinding;
+/** A private receipt alone never proves cleanup: recheck roots, boot and actual absence. */
+export declare function readLinuxExecutionReceipt(input: Context): Promise<LinuxExecutionReceipt | undefined>;
+export declare function readLinuxExecutionPartialCleanupProof(input: Context): Promise<LinuxExecutionPartialCleanupProof | undefined>;
+/** Host-only result retention. The synchronous callback must persist the ledger
+ * marker before either private evidence copy is replaced. A mixed pair after a
+ * crash is independently verifiable against that marker and can be retried. */
+export declare function retainLinuxExecutionResult(input: Context & {
+    resources: LinuxExecutionResources;
+    result: IsolationResult;
+    fenced: () => boolean;
+    compact: () => IsolationResult | undefined;
+}): Promise<number>;
+type RunInput = Context & {
+    argv: readonly string[];
+    files: readonly IsolationFile[];
+    artifacts?: readonly string[];
+    readOnlyRoots?: readonly string[];
+    signal: AbortSignal;
+    recordResources: (value: LinuxExecutionResources) => Promise<void>;
+    authorizeStart: () => Promise<boolean> | boolean;
+};
+type RunOutcome = {
+    result: IsolationResult;
+    resources?: LinuxExecutionResources;
+    receipt?: LinuxExecutionReceipt;
+    partialProof?: LinuxExecutionPartialCleanupProof;
+};
+export declare function runLinuxExecution(input: RunInput): Promise<RunOutcome>;
+/** Recovery never dispatches. A still-live creator may resume a pending create,
+ * irrespective of controller lease expiry, so it cannot be reclaimed here. */
+export declare function reconcileLinuxExecution(input: Context): Promise<{
+    quiescent: boolean;
+    resources?: LinuxExecutionResources;
+    receipt?: LinuxExecutionReceipt;
+    partialProof?: LinuxExecutionPartialCleanupProof;
+}>;
+export declare function prepareLinuxRepositoryIntent(input: PrepareInput & LinuxRepositoryExecutionRequest & {
+    contract: LinuxRepositoryExecutionContract;
+}): Promise<LinuxRepositoryExecutionIntent>;
+/** Binary bytes are returned only after successful receipt validation and fresh
+ * kernel absence checks. Reopening a completed identity only reads its receipt. */
+export declare function readLinuxRepositoryReceipt(input: LinuxRepositoryExecutionContext): Promise<{
+    receipt: LinuxRepositoryExecutionReceipt;
+    artifacts: LinuxRepositoryArtifact[];
+} | undefined>;
+export type LinuxRepositoryExecutionOutcome = Omit<RunOutcome, 'receipt'> & {
+    receipt?: LinuxRepositoryExecutionReceipt;
+    artifacts: LinuxRepositoryArtifact[];
+};
+export declare function runLinuxRepositoryExecution(input: LinuxRepositoryExecutionContext & LinuxRepositoryExecutionRequest & {
+    signal: AbortSignal;
+    recordResources: (value: LinuxExecutionResources) => Promise<void>;
+    authorizeStart: () => Promise<boolean> | boolean;
+}): Promise<LinuxRepositoryExecutionOutcome>;
+export declare function reconcileLinuxRepositoryExecution(input: LinuxRepositoryExecutionContext): Promise<{
+    quiescent: boolean;
+    resources?: LinuxExecutionResources;
+    receipt?: LinuxRepositoryExecutionReceipt;
+    partialProof?: LinuxExecutionPartialCleanupProof;
+    artifacts: LinuxRepositoryArtifact[];
+}>;
+export {};
+//# sourceMappingURL=linux-execution.d.ts.map

package/lib/linux-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-execution.d.ts","sourceRoot":"","sources":["../src/linux-execution.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAC9G,KAAK,iCAAiC,EAAE,KAAK,sBAAsB,EAAE,KAAK,gCAAgC,EAAE,KAAK,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAExL,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAOhE,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,CAAC,CAAA;IAChB,MAAM,EAAE,sBAAsB,CAAA;IAC9B,SAAS,EAAE,uBAAuB,CAAA;IAClC,MAAM,EAAE,eAAe,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AACD,MAAM,WAAW,8BAA8B;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC/F,MAAM,WAAW,uBAAuB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxF,MAAM,WAAW,+BAAgC,SAAQ,IAAI,CAAC,uBAAuB,EAAE,eAAe,GAAG,QAAQ,CAAC;IAChH,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;IACpB,MAAM,EAAE,8BAA8B,CAAA;IACtC,mBAAmB,EAAE,8BAA8B,EAAE,CAAA;CACtD;AACD,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,+BAA+B,CAAA;AAC7F,MAAM,WAAW,+BAA+B;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,8BAA8B,CAAA;CAAE;AAC1J,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AACD,UAAU,OAAO;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE;AAwSvG;8EAC8E;AAC9E,UAAU,YAAY;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC3E,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AAC/G,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAGpG;AA6GD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qBAAqB,GAAG,mBAAmB,CAMhG;AACD,4FAA4F;AAC5F,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAO1G;AACD,wBAAsB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,iCAAiC,GAAG,SAAS,CAAC,CAUlI;AA6BD;;+EAE+E;AAC/E,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,SAAS,EAAE,uBAAuB,CAAC;IACrG,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,eAAe,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE/G;AAED,KAAK,QAAQ,GAAG,OAAO,GAAG;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACnF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IACtF,eAAe,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CAAE,CAAA;AACxH,KAAK,UAAU,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAAC,YAAY,CAAC,EAAE,iCAAiC,CAAA;CAAE,CAAA;AACrK,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAG5E;AAmND;8EAC8E;AAC9E,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC/H,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAAC,YAAY,CAAC,EAAE,iCAAiC,CAAA;CAAE,CAAC,CAyDrF;AAkHD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,YAAY,GAAG,+BAA+B,GAAG;IACzG,QAAQ,EAAE,gCAAgC,CAAA;CAC3C,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAK1C;AACD;mFACmF;AACnF,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC;IAChG,OAAO,EAAE,+BAA+B,CAAC;IAAC,SAAS,EAAE,uBAAuB,EAAE,CAAA;CAC/E,GAAG,SAAS,CAAC,CAUb;AACD,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,+BAA+B,CAAC;IAAC,SAAS,EAAE,uBAAuB,EAAE,CAAA;CAAE,CAAA;AAC/J,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,+BAA+B,GAAG,+BAA+B,GAAG;IAC3H,MAAM,EAAE,WAAW,CAAC;IAAC,eAAe,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CAC1I,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAa3C;AACD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC;IACvG,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;IACnG,YAAY,CAAC,EAAE,iCAAiC,CAAC;IAAC,SAAS,EAAE,uBAAuB,EAAE,CAAA;CACvF,CAAC,CAOD"}