@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/rsi-local-resources.js

@@ -0,0 +1,184 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, cp, lstat, mkdir, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io } from './rsi-build.js';
+import { readRsiLocalUpdateLocked } from './rsi-local-update.js';
+const kinds = ['rsi-local-cohorts', 'rsi-builds', 'rsi-release-builds'];
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+function fail(message) { throw new Error(`rsi local resources: ${message}`); }
+const inside = (root, path) => path === root || path.startsWith(root + sep);
+const exact = (path) => isAbsolute(path) && resolve(path) === path && !path.includes('\0');
+/** Include modes and directories: matching file bytes alone cannot prove a
+ * copied toolchain has retained its executable and private-directory contract. */
+async function inventory(root, signal) {
+    let size = 0;
+    const entries = [];
+    const visit = async (path) => {
+        signal.throwIfAborted();
+        const item = await lstat(path);
+        if (entries.length >= 150_000 || item.isSymbolicLink() || (item.mode & 0o077) !== 0
+            || process.getuid && item.uid !== process.getuid())
+            fail(`unsafe resource entry: ${path}`);
+        if (item.isDirectory()) {
+            await io.directory(path);
+            entries.push({ path: relative(root, path), mode: item.mode & 0o777, sha256: null });
+            for (const name of (await readdir(path)).sort())
+                await visit(join(path, name));
+        }
+        else if (item.isFile() && item.nlink === 1) {
+            size += item.size;
+            if (item.size > 268_435_456 || size > 4_294_967_296)
+                fail('resource tree exceeds size bound');
+            entries.push({ path: relative(root, path), mode: item.mode & 0o777,
+                sha256: hash(await io.readStable(path, 268_435_456, true)) });
+        }
+        else
+            fail(`resource is not a private regular file or directory: ${path}`);
+    };
+    await visit(root);
+    return entries;
+}
+function receipt(bytes) {
+    const value = JSON.parse(bytes.toString('utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('invalid resource receipt');
+    const { receiptDigest, ...body } = value;
+    if (receiptDigest !== hash(JSON.stringify(body)))
+        fail('resource receipt digest differs');
+    return body;
+}
+function encode(body) { return JSON.stringify({ ...body, receiptDigest: hash(JSON.stringify(body)) }); }
+/** Caller owns the Home lifecycle lock and has stopped all Home writers. Only
+ * these three trees in the disposable stage are changed; source, profiles,
+ * owner authority and ledger still require the enclosing activation transaction.
+ * A crash requires discarding/recovering that stage, never reusing it as live. */
+export async function stageRsiLocalUpdateResources(input) {
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(600_000)]);
+    const { logicalHome, stagePhysicalHome, profile } = input;
+    if (!exact(logicalHome) || !exact(stagePhysicalHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(profile)
+        || await realpath(logicalHome) !== logicalHome || await realpath(stagePhysicalHome) !== stagePhysicalHome
+        || inside(logicalHome, stagePhysicalHome) || inside(stagePhysicalHome, logicalHome))
+        fail('stage must be a distinct canonical stopped Home');
+    await io.directory(stagePhysicalHome);
+    const prepared = await readRsiLocalUpdateLocked({ dshHome: logicalHome, profile, root: input.preparationRoot, signal });
+    if (!prepared.build || inside(stagePhysicalHome, prepared.root) || inside(prepared.root, stagePhysicalHome))
+        fail('stage overlaps preparation');
+    const original = {}, candidate = {};
+    for (const kind of kinds) {
+        await io.directory(join(logicalHome, kind));
+        await io.directory(join(stagePhysicalHome, kind));
+        await io.directory(join(prepared.candidateHome, kind));
+        original[kind] = await inventory(join(logicalHome, kind, profile), signal);
+        if (!isDeepStrictEqual(original[kind], await inventory(join(stagePhysicalHome, kind, profile), signal)))
+            fail(`copied original differs: ${kind}`);
+        candidate[kind] = await inventory(join(prepared.candidateHome, kind, profile), signal);
+    }
+    const cohortRoot = join(logicalHome, kinds[0], profile);
+    const originalCohort = receipt(await io.readStable(join(cohortRoot, 'receipt.json'), 20_971_520, true));
+    if (hash(JSON.stringify(originalCohort)) !== prepared.originalCohortDigest
+        || typeof originalCohort.sourceRepository !== 'string' || !exact(originalCohort.sourceRepository))
+        fail('original cohort source differs');
+    if (inside(originalCohort.sourceRepository, stagePhysicalHome)
+        || inside(stagePhysicalHome, originalCohort.sourceRepository))
+        fail('stage overlaps upstream source repository');
+    const { receiptDigest: _oldDigest, ...cohortBody } = prepared.cohort;
+    const cohort = JSON.parse(encode({ ...cohortBody, root: cohortRoot,
+        sourceRepository: originalCohort.sourceRepository,
+        packages: prepared.cohort.packages.map(item => ({ ...item, tarball: join(cohortRoot, 'artifacts', `${item.name.split('/')[1]}.tgz`) })) }));
+    const buildBody = receipt(await io.readStable(join(prepared.candidateHome, kinds[1], profile, 'bootstrap.json'), 65_536, true));
+    const sourceBuild = { ...prepared.build.sourceBuild, sourceBuild: {
+            ...prepared.build.sourceBuild.sourceBuild,
+            repositorySandbox: { ...prepared.build.sourceBuild.sourceBuild.repositorySandbox,
+                seccompPath: join(logicalHome, kinds[1], profile, 'seccomp.json') },
+        } };
+    const releaseRoot = join(logicalHome, kinds[2], profile);
+    const oldReleaseRoot = join(prepared.candidateHome, kinds[2], profile);
+    const releaseBuild = { ...prepared.build.releaseBuild,
+        releaseBuild: Object.fromEntries(Object.entries(prepared.build.releaseBuild.releaseBuild).map(([key, pin]) => [key,
+            inside(oldReleaseRoot, pin.path) ? { ...pin, path: join(releaseRoot, relative(oldReleaseRoot, pin.path)) } : pin,
+        ])) };
+    const releaseBody = receipt(await io.readStable(join(prepared.candidateHome, kinds[2], profile, 'bootstrap.json'), 65_536, true));
+    const receipts = {
+        'rsi-local-cohorts': { name: 'receipt.json', source: JSON.stringify(cohort) },
+        'rsi-builds': { name: 'bootstrap.json', source: encode({ ...buildBody, dshHome: logicalHome,
+                repository: join(logicalHome, 'rsi-sources', profile, 'checkout'), sourceBuild: sourceBuild.sourceBuild }) },
+        'rsi-release-builds': { name: 'bootstrap.json', source: encode({ ...releaseBody, dshHome: logicalHome,
+                releaseBuild: releaseBuild.releaseBuild }) },
+    };
+    const scratch = join(stagePhysicalHome, `.rsi-local-resources-${randomUUID()}`);
+    await mkdir(scratch, { mode: 0o700 });
+    const moved = [], installed = [];
+    let verified = false;
+    try {
+        // Build all replacement trees and verify them before replacing any stage resource.
+        for (const kind of kinds) {
+            const next = join(scratch, kind), source = join(prepared.candidateHome, kind, profile);
+            await cp(source, next, { recursive: true, dereference: false, verbatimSymlinks: true, errorOnExist: true, force: false });
+            if (!isDeepStrictEqual(await inventory(next, signal), candidate[kind]))
+                fail(`resource changed during copy: ${kind}`);
+            const update = receipts[kind], entry = candidate[kind].find(item => item.path === update.name);
+            if (!entry || entry.sha256 === null)
+                fail('resource receipt is missing from inventory');
+            await writeFile(join(next, update.name), update.source, { mode: entry.mode });
+            await chmod(join(next, update.name), entry.mode);
+            candidate[kind] = candidate[kind].map(item => item.path === update.name ? { ...item, sha256: hash(update.source) } : item);
+            if (!isDeepStrictEqual(await inventory(next, signal), candidate[kind]))
+                fail(`rebased resource differs: ${kind}`);
+        }
+        // Revalidate the preparation and originals after copying, before stage mutation.
+        if (!isDeepStrictEqual(await readRsiLocalUpdateLocked({ dshHome: logicalHome, profile, root: input.preparationRoot, signal }), prepared))
+            fail('preparation changed during copy');
+        for (const kind of kinds) {
+            if (!isDeepStrictEqual(await inventory(join(logicalHome, kind, profile), signal), original[kind])
+                || !isDeepStrictEqual(await inventory(join(stagePhysicalHome, kind, profile), signal), original[kind]))
+                fail(`original resource changed: ${kind}`);
+        }
+        for (const kind of kinds) {
+            signal.throwIfAborted();
+            await rename(join(stagePhysicalHome, kind, profile), join(scratch, `old-${kind}`));
+            moved.push(kind);
+            await rename(join(scratch, kind), join(stagePhysicalHome, kind, profile));
+            installed.push(kind);
+            await io.syncDirectory(join(stagePhysicalHome, kind));
+        }
+        const proof = { schemaVersion: 1, dshHome: logicalHome, profile,
+            preparationDigest: prepared.receiptDigest,
+            original: Object.fromEntries(kinds.map(kind => [kind, hash(JSON.stringify(original[kind]))])),
+            candidate: Object.fromEntries(kinds.map(kind => [kind, hash(JSON.stringify(candidate[kind]))])) };
+        await verifyRsiLocalUpdateResources({ physicalHome: stagePhysicalHome, proof, signal });
+        verified = true;
+        await rm(scratch, { recursive: true });
+        return { cohort, sourceBuild, releaseBuild, proof };
+    }
+    catch (error) {
+        // Once backup cleanup begins, an incomplete cleanup is not permission to
+        // restore from backups that may already have been removed.
+        if (verified)
+            throw error;
+        // A failed restore deliberately keeps the scratch tree and surfaces the error.
+        for (const kind of moved.reverse()) {
+            if (installed.includes(kind))
+                await rm(join(stagePhysicalHome, kind, profile), { recursive: true });
+            await rename(join(scratch, `old-${kind}`), join(stagePhysicalHome, kind, profile));
+            await io.syncDirectory(join(stagePhysicalHome, kind));
+        }
+        await rm(scratch, { recursive: true });
+        throw error;
+    }
+}
+export async function verifyRsiLocalUpdateResources(input) {
+    const { proof, physicalHome } = input;
+    if (proof.schemaVersion !== 1 || !exact(physicalHome) || await realpath(physicalHome) !== physicalHome
+        || !exact(proof.dshHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(proof.profile)
+        || !/^[a-f0-9]{64}$/u.test(proof.preparationDigest))
+        fail('invalid resource proof binding');
+    const signal = input.signal ?? new AbortController().signal;
+    for (const kind of kinds) {
+        await io.directory(join(physicalHome, kind));
+        if (hash(JSON.stringify(await inventory(join(physicalHome, kind, proof.profile), signal)))
+            !== (input.original ? proof.original : proof.candidate)[kind])
+            fail(`resource proof differs: ${kind}`);
+    }
+}
+//# sourceMappingURL=rsi-local-resources.js.map

package/lib/rsi-local-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-resources.js","sourceRoot":"","sources":["../src/rsi-local-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAA4B,MAAM,gBAAgB,CAAA;AAGlF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,MAAM,KAAK,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,CAAU,CAAA;AAEhF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC5F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AACpG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAW3G;kFACkF;AAClF,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,MAAmB;IACxD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAC9E,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAA;YACjB,IAAI,IAAI,CAAC,IAAI,GAAG,WAAW,IAAI,IAAI,GAAG,aAAa;gBAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;YAC7F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK;gBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;;YAAM,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IAC3E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IACjG,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,IAAI,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACzF,OAAO,IAAI,CAAA;AACb,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC;AAEvH;;;kFAGkF;AAClF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAElD;IAEC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;WACtG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,iBAAiB;WACtG,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAC9I,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAA;IACvH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAC/I,MAAM,QAAQ,GAAG,EAA2B,EAAE,SAAS,GAAG,EAA2B,CAAA;IACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9F,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;QAC1E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;QACjJ,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAA;IACvG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,KAAK,QAAQ,CAAC,oBAAoB;WACrE,OAAO,cAAc,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC3I,IAAI,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;WACzD,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAClH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,UAAU;QAChE,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmB,CAAA;IAC/J,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/H,MAAM,WAAW,GAAwB,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE;YACrF,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW;YACzC,iBAAiB,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,iBAAiB;gBAC9E,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE;SACtE,EAAE,CAAA;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,YAAY,GAA+B,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY;QAC/E,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG;YAChH,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;SACjH,CAAC,CAA0D,EAAE,CAAA;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IACjI,MAAM,QAAQ,GAAmD;QAC/D,mBAAmB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAC7E,YAAY,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW;gBACzF,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE;QAC9G,oBAAoB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,WAAW;gBACnG,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,EAAE;KAC/C,CAAA;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,UAAU,EAAE,EAAE,CAAC,CAAA;IAC/E,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrC,MAAM,KAAK,GAAW,EAAE,EAAE,SAAS,GAAW,EAAE,CAAA;IAChD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,mFAAmF;QACnF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YACtF,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YACzH,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAA;YACrH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAA;YAC9F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;gBAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;YACvF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAChD,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC1H,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACnH,CAAC;QACD,iFAAiF;QACjF,IAAI,CAAC,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACjL,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;mBAC5F,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QACtJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/F,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,KAAK,GAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO;YACpF,iBAAiB,EAAE,QAAQ,CAAC,aAAa;YACzC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAyB;YACrH,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAyB,EAAE,CAAA;QAC3H,MAAM,6BAA6B,CAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,QAAQ,GAAG,IAAI,CAAA;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2DAA2D;QAC3D,IAAI,QAAQ;YAAE,MAAM,KAAK,CAAA;QACzB,+EAA+E;QAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACnG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAClF,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAEnD;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IACrC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,YAAY;WACjG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAClF,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAA;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACpF,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;IAC1G,CAAC;AACH,CAAC"}

package/lib/rsi-local-roots-extension.d.ts

@@ -0,0 +1,11 @@
+export type RsiLocalRootExtension = 'memory-learning';
+/** The only supported change to a pre-owner frozen profile's selected roots. */
+export declare function rsiLocalUpdateBundles(original: readonly string[], extension?: RsiLocalRootExtension): string[];
+/** Matches the learner bundle's published cordis.patch.yml initial row. */
+export declare const rsiMemoryLearningInitialRow: Readonly<{
+    id: "dsh-enhanced-assistant-memory-learning";
+    name: "@dsh-enhanced/assistant-memory-learning";
+    disabled: true;
+    inject: readonly string[];
+}>;
+//# sourceMappingURL=rsi-local-roots-extension.d.ts.map

package/lib/rsi-local-roots-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-roots-extension.d.ts","sourceRoot":"","sources":["../src/rsi-local-roots-extension.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAA;AAMrD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAU9G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;EAQtC,CAAA"}

package/lib/rsi-local-roots-extension.js

@@ -0,0 +1,31 @@
+const learner = 'assistant-memory-learning';
+const required = ['personal-assistant', 'assistant-delivery', 'assistant-evaluation', 'assistant-verifier'];
+const slug = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+/** The only supported change to a pre-owner frozen profile's selected roots. */
+export function rsiLocalUpdateBundles(original, extension) {
+    if (!Array.isArray(original) || !original.length || original.some(value => typeof value !== 'string' || !slug.test(value))
+        || new Set(original).size !== original.length)
+        throw new Error('rsi local roots extension: invalid original roots');
+    if (extension === undefined)
+        return [...original].sort();
+    if (extension !== 'memory-learning')
+        throw new Error('rsi local roots extension: unsupported extension');
+    if (original.includes(learner))
+        throw new Error('rsi local roots extension: learner root already installed');
+    for (const value of required)
+        if (!original.includes(value)) {
+            throw new Error(`rsi local roots extension: required provider root is missing: ${value}`);
+        }
+    return [...original, learner].sort();
+}
+/** Matches the learner bundle's published cordis.patch.yml initial row. */
+export const rsiMemoryLearningInitialRow = Object.freeze({
+    id: 'dsh-enhanced-assistant-memory-learning',
+    name: '@dsh-enhanced/assistant-memory-learning',
+    disabled: true,
+    inject: Object.freeze([
+        'assistantDelivery', 'assistantEvaluation', 'assistantAutomations', 'personalMemory', 'assistantVerifier',
+        'assistantPolicy', 'agents', 'sessions', 'tools', 'llm', 'systemPrompt',
+    ]),
+});
+//# sourceMappingURL=rsi-local-roots-extension.js.map

package/lib/rsi-local-roots-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-roots-extension.js","sourceRoot":"","sources":["../src/rsi-local-roots-extension.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAC3C,MAAM,QAAQ,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,CAAA;AAC3G,MAAM,IAAI,GAAG,6BAA6B,CAAA;AAE1C,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,SAAiC;IAClG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACrH,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrH,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;IACxD,IAAI,SAAS,KAAK,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACxG,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC5G,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,iEAAiE,KAAK,EAAE,CAAC,CAAA;QAC3F,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,wCAAwC;IAC5C,IAAI,EAAE,yCAAyC;IAC/C,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,mBAAmB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,mBAAmB;QACzG,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc;KACxE,CAAC;CACH,CAAC,CAAA"}

package/lib/rsi-local-update-build.d.ts

@@ -0,0 +1,18 @@
+import type { RsiSourceWorkspace } from './rsi-source.js';
+import type { RsiLocalCohortPorts } from './rsi-local-cohort.js';
+/** Only the digest-pinned manifest/image preparation runs on the host. Updated
+ * repository build/pack scripts run with the release adapter's existing offline
+ * bwrap mounts, without the live Home, source Git directories or credentials. */
+export declare function prepareRsiLocalUpdateBuild(input: {
+    dshHome: string;
+    profile: string;
+    source: RsiSourceWorkspace;
+    signal: AbortSignal;
+}): Promise<{
+    ports: RsiLocalCohortPorts;
+    evidence: {
+        sourceBuild: import("./rsi-build.js").RsiBuildEnvironment;
+        releaseBuild: import("./rsi-release-build.js").RsiReleaseBuildEnvironment;
+    };
+}>;
+//# sourceMappingURL=rsi-local-update-build.d.ts.map

package/lib/rsi-local-update-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-update-build.d.ts","sourceRoot":"","sources":["../src/rsi-local-update-build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;iFAEiF;AACjF,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAClF;;;;;;GAmBA"}

package/lib/rsi-local-update-build.js

@@ -0,0 +1,37 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { prepareRsiBuildEnvironment, rsiBuildResources as io } from './rsi-build.js';
+import { prepareRsiReleaseBuildEnvironment } from './rsi-release-build.js';
+/** Only the digest-pinned manifest/image preparation runs on the host. Updated
+ * repository build/pack scripts run with the release adapter's existing offline
+ * bwrap mounts, without the live Home, source Git directories or credentials. */
+export async function prepareRsiLocalUpdateBuild(input) {
+    const require = createRequire(import.meta.url);
+    const packageRoot = dirname(require.resolve('@dsh-enhanced/plugin-control-plane/package.json'));
+    const adapterPath = join(packageRoot, 'bin', 'dsh-local-release-adapter.js');
+    const adapter = await import(__rewriteRelativeImportExtension(pathToFileURL(adapterPath).href));
+    if (typeof adapter.buildLocalUpdateCohort !== 'function')
+        throw new Error('rsi local update: Control Plane lacks isolated cohort preparation');
+    const build = await prepareRsiBuildEnvironment(input);
+    const release = await prepareRsiReleaseBuildEnvironment({ ...input, build });
+    const ports = { build: async (workspace, output, packagePaths, signal) => {
+            // Keep the synchronous adapter in a separate, bounded process so cancel and
+            // timeout can drain its bwrap child through --die-with-parent.
+            // The adapter also has a CLI entry guard. Clear this eval process's argv
+            // after capturing the data so importing it cannot be mistaken for its CLI.
+            const program = "const [url,source]=process.argv.slice(1);process.argv.length=1;const m=await import(url);m.buildLocalUpdateCohort(JSON.parse(source));";
+            await io.command(process.execPath, ['--input-type=module', '--eval', program,
+                pathToFileURL(adapterPath).href, JSON.stringify({ build: release.releaseBuild, workspace, output, packagePaths })], { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C', TZ: 'UTC' }, signal, 1_800_000, 2_097_152);
+        } };
+    return { ports, evidence: { sourceBuild: build, releaseBuild: release } };
+}
+//# sourceMappingURL=rsi-local-update-build.js.map

package/lib/rsi-local-update-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-update-build.js","sourceRoot":"","sources":["../src/rsi-local-update-build.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACpF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAA;AAI1E;;iFAEiF;AACjF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAEhD;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,CAAA;IAC/F,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,8BAA8B,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,MAAM,MAAM,kCAAC,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,EAAyC,CAAA;IACrG,IAAI,OAAO,OAAO,CAAC,sBAAsB,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IAC9I,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5E,MAAM,KAAK,GAAwB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE;YAC5F,4EAA4E;YAC5E,+DAA+D;YAC/D,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,OAAO,GAAG,wIAAwI,CAAA;YACxJ,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,QAAQ,EAAE,OAAO;gBAC1E,aAAa,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,EACpH,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;QACnH,CAAC,EAAE,CAAA;IACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAA;AAC3E,CAAC"}

package/lib/rsi-local-update.d.ts

@@ -0,0 +1,39 @@
+import { type RsiLocalCohort, type RsiLocalCohortPorts } from './rsi-local-cohort.js';
+import { type RsiSourceUpdateCandidate } from './rsi-source-update.js';
+import { prepareRsiLocalUpdateBuild } from './rsi-local-update-build.js';
+export interface RsiLocalUpdateInput {
+    dshHome: string;
+    profile: string;
+    sourceRepository: string;
+    rootExtension?: 'memory-learning';
+    signal?: AbortSignal;
+}
+export interface RsiLocalUpdatePreparation {
+    schemaVersion: 1 | 2;
+    mode: 'prepared';
+    /** Schema 2 explicitly binds the only supported pre-owner root addition. */
+    extension?: 'memory-learning';
+    dshHome: string;
+    profile: string;
+    root: string;
+    candidateHome: string;
+    originalCohortDigest: string;
+    source: RsiSourceUpdateCandidate;
+    cohort: RsiLocalCohort;
+    build: Awaited<ReturnType<typeof prepareRsiLocalUpdateBuild>>['evidence'] | null;
+    receiptDigest: string;
+}
+/** Caller owns the original Home lifecycle lock. Reading a completed candidate
+ * never creates missing resources and does not run candidate build scripts. */
+export declare function readRsiLocalUpdateLocked(input: {
+    dshHome: string;
+    profile: string;
+    root: string;
+    signal?: AbortSignal;
+}): Promise<RsiLocalUpdatePreparation>;
+export declare function readRsiLocalUpdate(input: Parameters<typeof readRsiLocalUpdateLocked>[0]): Promise<RsiLocalUpdatePreparation>;
+/** Build a reusable update candidate without stopping or changing the installed
+ * Agent. Activation must separately reconcile signed history and migrate the
+ * candidate into a stopped Home transaction; this receipt does not authorize it. */
+export declare function prepareRsiLocalUpdate(input: RsiLocalUpdateInput, ports?: RsiLocalCohortPorts): Promise<RsiLocalUpdatePreparation>;
+//# sourceMappingURL=rsi-local-update.d.ts.map

package/lib/rsi-local-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-update.d.ts","sourceRoot":"","sources":["../src/rsi-local-update.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE9E,OAAO,EAA+C,KAAK,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEnH,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAMxE,MAAM,WAAW,mBAAmB;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAChG,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE;AAC3D,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,MAAM,EAAE,wBAAwB,CAAA;IAChC,MAAM,EAAE,cAAc,CAAA;IACtB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAA;IAChF,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;+EAC+E;AAC/E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IACrG,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiD5D;AAgBD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAElI;AAqBD;;oFAEoF;AACpF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,EACpE,KAAK,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA+DjE"}

package/lib/rsi-local-update.js

@@ -0,0 +1,205 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readdir, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io, readRsiBuildEnvironment } from './rsi-build.js';
+import { readRsiReleaseBuildEnvironment } from './rsi-release-build.js';
+import { prepareRsiLocalCohort, readRsiLocalCohort, verifyRsiLocalInstalledPackages } from './rsi-local-cohort.js';
+import { prepareRsiSourceWorkspace, readRsiSourceWorkspace } from './rsi-source.js';
+import { prepareRsiSourceUpdate, readRsiSourceUpdate } from './rsi-source-update.js';
+import { withDshHomeLifecycleLock } from './setup.js';
+import { prepareRsiLocalUpdateBuild } from './rsi-local-update-build.js';
+import { rsiLocalUpdateBundles } from './rsi-local-roots-extension.js';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const fail = (message) => { throw new Error(`rsi local update: ${message}`); };
+const profileName = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+/** Caller owns the original Home lifecycle lock. Reading a completed candidate
+ * never creates missing resources and does not run candidate build scripts. */
+export async function readRsiLocalUpdateLocked(input) {
+    if (process.platform !== 'linux' || !profileName.test(input.profile)
+        || !isAbsolute(input.dshHome) || resolve(input.dshHome) !== input.dshHome
+        || !isAbsolute(input.root) || resolve(input.root) !== input.root
+        || await realpath(input.dshHome) !== input.dshHome || await realpath(input.root) !== input.root)
+        fail('invalid preparation identity');
+    await io.directory(input.dshHome, false);
+    const parent = join(dirname(input.dshHome), `.dsh-rsi-local-updates-${hash(input.dshHome).slice(0, 16)}`);
+    if (dirname(input.root) !== parent)
+        fail('preparation is outside its bound parent');
+    await io.directory(parent);
+    await io.directory(input.root);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(180_000)]);
+    signal.throwIfAborted();
+    const raw = await io.readStable(join(input.root, 'receipt.json'), 20_971_520, true);
+    const saved = JSON.parse(raw.toString('utf8'));
+    const extended = saved?.schemaVersion === 2;
+    if (!saved || typeof saved !== 'object' || Array.isArray(saved)
+        || !isDeepStrictEqual(Object.keys(saved).sort(), ['schemaVersion', 'mode', 'dshHome', 'profile', 'root',
+            'candidateHome', 'originalCohortDigest', 'source', 'cohort', 'build', 'receiptDigest',
+            ...(extended ? ['extension'] : [])].sort()))
+        fail('prepared update receipt is invalid');
+    const { receiptDigest, ...body } = saved;
+    if (receiptDigest !== hash(JSON.stringify(body)) || ![1, 2].includes(saved.schemaVersion)
+        || extended && saved.extension !== 'memory-learning' || saved.mode !== 'prepared'
+        || saved.dshHome !== input.dshHome || saved.profile !== input.profile || saved.root !== input.root
+        || saved.candidateHome !== join(input.root, 'home') || !saved.build)
+        fail('prepared update receipt binding differs');
+    if (!isDeepStrictEqual((await readdir(input.root)).sort(), ['home', 'receipt.json', 'source']))
+        fail('unexpected preparation contents');
+    const original = await readRsiLocalCohort(input);
+    if (saved.originalCohortDigest !== original.receiptDigest)
+        fail('prepared update no longer matches installed cohort');
+    const expectedBundles = rsiLocalUpdateBundles(original.bundles, saved.extension);
+    if (!isDeepStrictEqual(saved.cohort.bundles, expectedBundles))
+        fail('prepared bundle selection differs');
+    if (extended)
+        await assertPreOwner(input, signal);
+    const sourceInput = { dshHome: input.dshHome, profile: input.profile, sourceRepository: original.sourceRepository,
+        candidateRoot: join(input.root, 'source'), signal };
+    const source = await readRsiSourceUpdate(sourceInput);
+    const identity = preparationIdentity({ ...input, original, upstreamCommit: source.upstreamCommit,
+        repairCommit: source.repairCommit, ...(saved.extension ? { rootExtension: saved.extension } : {}) });
+    if (join(parent, identity) !== input.root || !isDeepStrictEqual(saved.source, source))
+        fail('prepared source differs');
+    const workspace = await readRsiSourceWorkspace({ dshHome: saved.candidateHome, profile: input.profile,
+        sourceRepository: source.repository, signal });
+    if (workspace.sourceCommit !== source.sourceCommit || workspace.version !== source.version)
+        fail('candidate workspace differs from prepared source');
+    const cohort = await readRsiLocalCohort({ dshHome: saved.candidateHome, profile: input.profile, source: workspace });
+    const sourceBuild = await readRsiBuildEnvironment({ dshHome: saved.candidateHome, profile: input.profile, source: workspace, signal });
+    const releaseBuild = await readRsiReleaseBuildEnvironment({ dshHome: saved.candidateHome, profile: input.profile, build: sourceBuild, signal });
+    if (!isDeepStrictEqual(saved.cohort, cohort) || !isDeepStrictEqual(saved.build, { sourceBuild, releaseBuild }))
+        fail('prepared build or cohort differs');
+    await verifyRsiLocalInstalledPackages({ cohort: original, profilePath: join(input.dshHome, 'profiles', input.profile) });
+    if (!isDeepStrictEqual(await readRsiSourceUpdate(sourceInput), source)
+        || !isDeepStrictEqual(await readRsiLocalCohort(input), original)
+        || !(await io.readStable(join(input.root, 'receipt.json'), 20_971_520, true)).equals(raw))
+        fail('preparation or original changed during verification');
+    signal.throwIfAborted();
+    if (extended)
+        await assertPreOwner(input, signal);
+    return saved;
+}
+function preparationIdentity(input) {
+    return hash(JSON.stringify({ preparation: input.rootExtension ? 'isolated-build-v2' : 'isolated-build-v1',
+        home: input.dshHome, profile: input.profile, original: input.original.receiptDigest,
+        upstreamCommit: input.upstreamCommit, repairCommit: input.repairCommit,
+        ...(input.rootExtension ? { extension: input.rootExtension } : {}) }));
+}
+async function assertPreOwner(input, signal) {
+    const { assertRsiPreOwnerInstallation } = await import('./rsi-local-activation.js');
+    await assertRsiPreOwnerInstallation({ logicalHome: input.dshHome, physicalHome: input.dshHome,
+        profile: input.profile, signal });
+}
+export async function readRsiLocalUpdate(input) {
+    return withDshHomeLifecycleLock(input.dshHome, () => readRsiLocalUpdateLocked(input));
+}
+async function privateDirectory(path) {
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(path);
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function commit(repository, ref, signal) {
+    const value = await io.command('/usr/bin/git', ['-c', 'core.hooksPath=/dev/null', '-c', 'protocol.allow=never',
+        '-C', repository, 'rev-parse', '--verify', `${ref}^{commit}`], { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null', GIT_CONFIG_COUNT: '0', GIT_NO_REPLACE_OBJECTS: '1',
+        GIT_NO_LAZY_FETCH: '1', GIT_TERMINAL_PROMPT: '0' }, signal, 15_000, 1024);
+    if (!/^[a-f0-9]{40}$/u.test(value))
+        fail('source ref is not an exact commit');
+    return value;
+}
+/** Build a reusable update candidate without stopping or changing the installed
+ * Agent. Activation must separately reconcile signed history and migrate the
+ * candidate into a stopped Home transaction; this receipt does not authorize it. */
+export async function prepareRsiLocalUpdate(input, ports) {
+    if (process.platform !== 'linux' || !profileName.test(input.profile)
+        || !isAbsolute(input.dshHome) || resolve(input.dshHome) !== input.dshHome
+        || !isAbsolute(input.sourceRepository) || resolve(input.sourceRepository) !== input.sourceRepository
+        || await realpath(input.dshHome) !== input.dshHome
+        || await realpath(input.sourceRepository) !== input.sourceRepository)
+        fail('invalid local update identity');
+    await io.directory(input.dshHome, false);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(2_400_000)]);
+    return withDshHomeLifecycleLock(input.dshHome, async () => {
+        const original = await readRsiLocalCohort(input);
+        if (original.sourceRepository !== input.sourceRepository)
+            fail('update source differs from installed cohort');
+        const bundles = rsiLocalUpdateBundles(original.bundles, input.rootExtension);
+        if (input.rootExtension)
+            await assertPreOwner(input, signal);
+        const profilePath = join(input.dshHome, 'profiles', input.profile);
+        await verifyRsiLocalInstalledPackages({ cohort: original, profilePath });
+        const upstreamCommit = await commit(input.sourceRepository, 'HEAD', signal);
+        const repository = join(input.dshHome, 'rsi-sources', input.profile, 'checkout');
+        const repairCommit = await commit(repository, 'refs/dsh-source/repairs', signal);
+        const identity = preparationIdentity({ ...input, original, upstreamCommit, repairCommit });
+        // Outside Home so preparing/building never changes an active Agent's input
+        // tree. Each exact upstream/repair pair has a distinct immutable directory.
+        const parent = join(dirname(input.dshHome), `.dsh-rsi-local-updates-${hash(input.dshHome).slice(0, 16)}`);
+        if (parent === input.sourceRepository || parent.startsWith(input.sourceRepository + '/'))
+            fail('preparation directory would modify the source repository');
+        await privateDirectory(parent);
+        const root = join(parent, identity);
+        await privateDirectory(root);
+        const candidateHome = join(root, 'home'), receiptPath = join(root, 'receipt.json');
+        const sourceInput = { ...input, candidateRoot: join(root, 'source'), signal };
+        const source = await prepareRsiSourceUpdate(sourceInput);
+        if (source.upstreamCommit !== upstreamCommit || source.repairCommit !== repairCommit)
+            fail('source changed during preparation');
+        await privateDirectory(candidateHome);
+        const workspace = await prepareRsiSourceWorkspace({ dshHome: candidateHome, profile: input.profile,
+            version: source.version, sourceRepository: source.repository, signal });
+        if (workspace.sourceCommit !== source.sourceCommit)
+            fail('candidate checkout differs from merged source');
+        const builder = ports ? undefined : await prepareRsiLocalUpdateBuild({ dshHome: candidateHome,
+            profile: input.profile, source: workspace, signal });
+        const cohort = await prepareRsiLocalCohort({ dshHome: candidateHome, profile: input.profile,
+            source: workspace, bundles, signal }, ports ?? builder.ports);
+        const verifyOriginal = async () => {
+            if (!isDeepStrictEqual(await readRsiSourceUpdate(sourceInput), source)
+                || !isDeepStrictEqual(await readRsiLocalCohort(input), original))
+                fail('installed source or cohort changed during build');
+            await verifyRsiLocalInstalledPackages({ cohort: original, profilePath });
+            if (input.rootExtension)
+                await assertPreOwner(input, signal);
+            signal.throwIfAborted();
+        };
+        await verifyOriginal();
+        const content = { schemaVersion: input.rootExtension ? 2 : 1,
+            ...(input.rootExtension ? { extension: input.rootExtension } : {}), mode: 'prepared', dshHome: input.dshHome,
+            profile: input.profile, root, candidateHome, originalCohortDigest: original.receiptDigest, source, cohort,
+            build: builder?.evidence ?? null };
+        const result = { ...content, receiptDigest: hash(JSON.stringify(content)) };
+        if (await exists(receiptPath)) {
+            const existing = JSON.parse((await io.readStable(receiptPath, 20_971_520, true)).toString('utf8'));
+            if (!isDeepStrictEqual(existing, result))
+                fail('prepared update receipt differs');
+        }
+        else {
+            await io.writeExclusive(receiptPath, JSON.stringify(result));
+            await io.syncDirectory(root);
+        }
+        if (!isDeepStrictEqual((await readdir(root)).sort(), ['home', 'receipt.json', 'source']))
+            fail('unexpected preparation contents');
+        // The caller may inspect a completed receipt, but a stale candidate can
+        // never be treated as permission to overwrite newer source or task state.
+        await verifyOriginal();
+        return result;
+    });
+}
+//# sourceMappingURL=rsi-local-update.js.map

package/lib/rsi-local-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-update.js","sourceRoot":"","sources":["../src/rsi-local-update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,+BAA+B,EAClC,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAiC,MAAM,wBAAwB,CAAA;AACnH,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;AAC5F,MAAM,WAAW,GAAG,oCAAoC,CAAA;AAmBxD;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KACvB;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAC/D,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;WACtE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI;WAC7D,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACvI,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,0BAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACzG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACnF,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8B,CAAA;IAC3E,MAAM,QAAQ,GAAG,KAAK,EAAE,aAAa,KAAK,CAAC,CAAA;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM;YACrG,eAAe,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe;YACrF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAC3F,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,IAAI,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;WACpF,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;WAC9E,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WAC/F,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACtH,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACvI,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAChD,IAAI,KAAK,CAAC,oBAAoB,KAAK,QAAQ,CAAC,aAAa;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACrH,MAAM,eAAe,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IAChF,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACxG,IAAI,QAAQ;QAAE,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC/G,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;QAC9F,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACtG,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACtH,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;QACnG,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAChD,IAAI,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAAE,IAAI,CAAC,kDAAkD,CAAC,CAAA;IACpJ,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;IACpH,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtI,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/I,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACxJ,MAAM,+BAA+B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACxH,IAAI,CAAC,iBAAiB,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;WACjE,CAAC,iBAAiB,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;WAC7D,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACxJ,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,QAAQ;QAAE,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACjD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KACsD;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB;QACvG,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;QACnF,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACtE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAA2C,EAAE,MAAmB;IAC5F,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;IACnF,MAAM,6BAA6B,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAqD;IAC5F,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACrF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACtC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;AACrG,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,UAAkB,EAAE,GAAW,EAAE,MAAmB;IACxE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB;QAC5G,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,EAC/D,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG;QAC7F,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG;QAClH,iBAAiB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;oFAEoF;AACpF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA0B,EACpE,KAA2B;IAC3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAC/D,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;WACtE,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,KAAK,CAAC,gBAAgB;WACjG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;WAC/C,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,KAAK,CAAC,gBAAgB;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC7G,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9G,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;YAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;QAC7G,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;QAC5E,IAAI,KAAK,CAAC,aAAa;YAAE,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAClE,MAAM,+BAA+B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QACxE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAChF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAC1F,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,0BAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACzG,IAAI,MAAM,KAAK,KAAK,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC;YAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;QAC1J,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;QAClF,MAAM,WAAW,GAAG,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;QAC7E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAA;QACxD,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY;YAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;QAC/H,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAA;QACrC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YAChG,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QACzE,IAAI,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;QACzG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,0BAA0B,CAAC,EAAE,OAAO,EAAE,aAAa;YAC3F,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YACzF,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,OAAQ,CAAC,KAAK,CAAC,CAAA;QAChE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;YAChC,IAAI,CAAC,iBAAiB,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;mBACjE,CAAC,iBAAiB,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;gBAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;YAC3H,MAAM,+BAA+B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,CAAC,aAAa;gBAAE,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC5D,MAAM,CAAC,cAAc,EAAE,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,cAAc,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAU,CAAC,CAAC,CAAC,CAAU;YAC5E,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YACrH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,oBAAoB,EAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM;YACzG,KAAK,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;QAC3E,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;YAC7G,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACjI,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,cAAc,EAAE,CAAA;QACtB,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}