@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/rsi-release-build.js

@@ -0,0 +1,223 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, copyFile, lstat, mkdir, mkdtemp, readdir, rename, rm } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io } from './rsi-build.js';
+export class RsiReleaseBuildUnavailableError extends Error {
+    constructor(message) { super(`rsi release build unavailable: ${message}`); }
+}
+function fail(message) { throw new Error(`rsi release build: ${message}`); }
+function digest(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+async function inspect(root) {
+    const require = createRequire(import.meta.url);
+    const packageRoot = dirname(require.resolve('@dsh-enhanced/plugin-control-plane/package.json'));
+    const adapter = await import(__rewriteRelativeImportExtension(pathToFileURL(join(packageRoot, 'bin', 'dsh-local-release-adapter.js')).href));
+    if (typeof adapter.inspectLocalReleaseBuildEnvironment !== 'function')
+        fail('installed Control Plane lacks release environment inspection');
+    return adapter.inspectLocalReleaseBuildEnvironment({ pnpmRoot: join(root, 'toolchain'),
+        storeRoot: join(root, 'store'), cacheRoot: join(root, 'cache') });
+}
+/** Verify existing exported inputs only; never creates a container or repairs a
+ * missing export. The caller separately verifies the source image evidence. */
+export async function readRsiReleaseBuildEnvironment(input) {
+    if (!isAbsolute(input.dshHome) || resolve(input.dshHome) !== input.dshHome
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(input.profile))
+        fail('invalid resource binding');
+    input.signal?.throwIfAborted();
+    await io.directory(input.dshHome, false);
+    const parent = join(input.dshHome, 'rsi-release-builds'), final = join(parent, input.profile);
+    await io.directory(parent);
+    await io.directory(final);
+    if (!isDeepStrictEqual((await readdir(final)).sort(), ['bootstrap.json', 'cache', 'store', 'toolchain']))
+        fail('existing release environment is incomplete');
+    const receipt = JSON.parse((await io.readStable(join(final, 'bootstrap.json'), 65_536, true)).toString('utf8'));
+    const { receiptDigest, ...content } = receipt;
+    if (receipt.schemaVersion !== 1 || receipt.dshHome !== input.dshHome || receipt.profile !== input.profile
+        || receipt.sourceCommit !== input.build.sourceCommit || receipt.image !== input.build.sourceBuild.image
+        || digest(JSON.stringify(content)) !== receiptDigest
+        || !isDeepStrictEqual(receipt.releaseBuild, await inspect(final)))
+        fail('release environment differs from its receipt');
+    input.signal?.throwIfAborted();
+    return { schemaVersion: 1, sourceCommit: receipt.sourceCommit, image: receipt.image, releaseBuild: receipt.releaseBuild };
+}
+// Docker cp preserves image mode bits. Make exported resources private, reject
+// links/devices, and separate any hard links before the adapter pins the trees.
+async function harden(root, signal) {
+    let entries = 0, bytes = 0;
+    const visit = async (path) => {
+        signal.throwIfAborted();
+        if (++entries > 100_000)
+            fail('export contains too many entries');
+        const item = await lstat(path);
+        if (item.isSymbolicLink() || process.getuid && item.uid !== process.getuid())
+            fail('export contains an unsafe entry');
+        if (item.isDirectory()) {
+            await chmod(path, 0o700);
+            for (const name of await readdir(path))
+                await visit(join(path, name));
+        }
+        else if (item.isFile()) {
+            bytes += item.size;
+            if (item.size > 268_435_456 || bytes > 2_147_483_648)
+                fail('export exceeds its size bound');
+            if (item.nlink !== 1) {
+                const temporary = `${path}.copy-${randomUUID()}`;
+                try {
+                    await copyFile(path, temporary);
+                    await rename(temporary, path);
+                }
+                finally {
+                    await rm(temporary, { force: true });
+                }
+            }
+            await chmod(path, item.mode & 0o111 ? 0o700 : 0o600);
+        }
+        else
+            fail('export contains a nonregular entry');
+    };
+    await visit(root);
+}
+/** Caller holds the home lifecycle lock. Exports only fixed assets from the
+ * already prepared immutable image; the container is never started. */
+export async function prepareRsiReleaseBuildEnvironment(input) {
+    if (!isAbsolute(input.dshHome) || resolve(input.dshHome) !== input.dshHome
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(input.profile)
+        || input.build.schemaVersion !== 1 || !/^[a-f0-9]{40}$/u.test(input.build.sourceCommit)
+        || !/^sha256:[a-f0-9]{64}$/u.test(input.build.sourceBuild.image))
+        fail('invalid resource binding');
+    if (process.platform !== 'linux' || process.arch !== 'x64')
+        throw new RsiReleaseBuildUnavailableError('Linux x64 is required');
+    await io.directory(input.dshHome, false);
+    for (const path of ['/usr/bin/bwrap', '/usr/bin/tar']) {
+        try {
+            await lstat(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                throw new RsiReleaseBuildUnavailableError(`${path} is required`);
+            throw error;
+        }
+    }
+    const parent = join(input.dshHome, 'rsi-release-builds');
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    const final = join(parent, input.profile), image = input.build.sourceBuild.image;
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(600_000)]);
+    try {
+        await lstat(final);
+        return await readRsiReleaseBuildEnvironment({ ...input, signal });
+    }
+    catch (error) {
+        // Only absence of the root permits creation. A missing child is drift.
+        if (error.code !== 'ENOENT')
+            throw error;
+        try {
+            await lstat(final);
+            fail('existing release environment is incomplete');
+        }
+        catch (missing) {
+            if (missing.code !== 'ENOENT')
+                throw missing;
+        }
+    }
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    await chmod(stage, 0o700);
+    const assets = join(stage, 'assets'), token = randomUUID(), container = `dsh-release-assets-${token}`;
+    const docker = input.build.sourceBuild.dockerPath;
+    let containerMayExist = false, claimed;
+    const run = (args, cleanup = false) => io.command(docker, args, io.isolatedEnvironment(stage), cleanup ? new AbortController().signal : signal, cleanup ? 30_000 : 180_000);
+    const cleanupContainer = async () => {
+        if (!containerMayExist)
+            return;
+        // Generated name and unguessable label bind cleanup even if create's reply
+        // was lost. Do not delete a replacement container with another label.
+        const ids = await run(['ps', '-a', '--filter', `name=^/${container}$`, '--format', '{{.ID}}'], true);
+        if (!ids) {
+            containerMayExist = false;
+            return;
+        }
+        const label = await run(['inspect', '--format', '{{index .Config.Labels "org.dsh.release-assets"}}', container], true);
+        if (label !== token)
+            fail('export container ownership changed');
+        await run(['rm', '-f', container], true);
+        containerMayExist = false;
+    };
+    try {
+        await mkdir(join(stage, 'docker-config'), { mode: 0o700 });
+        await mkdir(assets, { mode: 0o700 });
+        for (const name of ['toolchain', 'store', 'cache'])
+            await mkdir(join(assets, name), { mode: 0o700 });
+        await mkdir(join(assets, 'store', 'v11', 'files'), { recursive: true, mode: 0o700 });
+        containerMayExist = true;
+        await run(['create', '--name', container, '--label', `org.dsh.release-assets=${token}`,
+            '--network', 'none', '--read-only', '--entrypoint', '/bin/false', image]);
+        for (const [source, target] of [
+            ['/opt/pnpm-native/node_modules/@pnpm/exe/.', join(assets, 'toolchain')],
+            ['/usr/local/bin/node', join(assets, 'toolchain', 'node')],
+            // The image's projects registry points at its deleted /seed checkout.
+            // Each release uses a fresh writable registry, never those stale links.
+            ['/opt/pnpm-store/v11/files/.', join(assets, 'store', 'v11', 'files')],
+            ['/opt/pnpm-store/v11/index.db', join(assets, 'store', 'v11', 'index.db')],
+            ['/opt/pnpm-cache/.', join(assets, 'cache')],
+        ])
+            await run(['cp', `${container}:${source}`, target]);
+        await cleanupContainer();
+        await mkdir(join(assets, 'store', 'v11', 'projects'), { recursive: true, mode: 0o700 });
+        await harden(assets, signal);
+        const toolchain = join(assets, 'toolchain');
+        const environment = { PATH: `${toolchain}:/usr/bin:/bin`, HOME: stage, LANG: 'C', LC_ALL: 'C' };
+        const nodeVersion = await io.command(join(toolchain, 'node'), ['--version'], environment, signal, 10_000);
+        const pnpmVersion = await io.command(join(toolchain, 'pnpm'), ['--version'], environment, signal, 10_000);
+        if (nodeVersion !== 'v22.23.2' || pnpmVersion !== '11.7.0')
+            fail('image toolchain version differs from the approved runtime');
+        await inspect(assets);
+        signal.throwIfAborted();
+        await mkdir(final, { mode: 0o700 });
+        const identity = await lstat(final);
+        claimed = { dev: identity.dev, ino: identity.ino };
+        for (const name of ['toolchain', 'store', 'cache'])
+            await rename(join(assets, name), join(final, name));
+        const result = { schemaVersion: 1, sourceCommit: input.build.sourceCommit,
+            image, releaseBuild: await inspect(final) };
+        const content = { ...result, dshHome: input.dshHome, profile: input.profile };
+        await io.writeExclusive(join(final, 'bootstrap.json'), JSON.stringify({ ...content, receiptDigest: digest(JSON.stringify(content)) }));
+        await io.syncDirectory(final);
+        await io.syncDirectory(parent);
+        return result;
+    }
+    catch (error) {
+        if (claimed) {
+            const current = await lstat(final).catch(() => undefined);
+            if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino)
+                await rm(final, { recursive: true, force: true });
+        }
+        throw error;
+    }
+    finally {
+        // A cleanup failure is surfaced and leaves the labelled container visible.
+        try {
+            await cleanupContainer();
+        }
+        finally {
+            await rm(stage, { recursive: true, force: true });
+            await io.syncDirectory(parent);
+        }
+    }
+}
+//# sourceMappingURL=rsi-release-build.js.map

package/lib/rsi-release-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-release-build.js","sourceRoot":"","sources":["../src/rsi-release-build.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAA4B,MAAM,gBAAgB,CAAA;AAYlF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,OAAe,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;CACpF;AACD,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC1F,SAAS,MAAM,CAAC,KAAsB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAE3G,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,MAAM,MAAM,kCAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC,IAAI,EAExG,CAAA;IACD,IAAI,OAAO,OAAO,CAAC,mCAAmC,KAAK,UAAU;QAAE,IAAI,CAAC,8DAA8D,CAAC,CAAA;IAC3I,OAAO,OAAO,CAAC,mCAAmC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QACpF,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;AACrE,CAAC;AAED;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAEpD;IACC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;WACrE,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAChG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrD,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC5J,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IAC1H,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WACpG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK;WACpG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa;WACjD,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;IACzH,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAA;AAC3H,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAmB;IACrD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,EAAE,OAAO,GAAG,OAAO;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACrH,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACvE,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,KAAK,IAAI,IAAI,CAAC,IAAI,CAAA;YAClB,IAAI,IAAI,CAAC,IAAI,GAAG,WAAW,IAAI,KAAK,GAAG,aAAa;gBAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;YAC3F,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,GAAG,IAAI,SAAS,UAAU,EAAE,EAAE,CAAA;gBAChD,IAAI,CAAC;oBAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBAAC,CAAC;wBAC9D,CAAC;oBAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACtD,CAAC;;YAAM,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnD,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;AACnB,CAAC;AAED;uEACuE;AACvE,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAEvD;IACC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;WACrE,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WACzD,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;WACpF,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IACpG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,IAAI,+BAA+B,CAAC,uBAAuB,CAAC,CAAA;IAC9H,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACvC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,+BAA+B,CAAC,GAAG,IAAI,cAAc,CAAC,CAAA;YACxH,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IACxD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IAClI,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAA;IAChF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;QAClB,OAAO,MAAM,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;QACnE,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;QAAC,CAAC;QAC9E,OAAO,OAAO,EAAE,CAAC;YAAC,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAA;QAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,CAAA;IACrE,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,EAAE,SAAS,GAAG,sBAAsB,KAAK,EAAE,CAAA;IACrG,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAA;IACjD,IAAI,iBAAiB,GAAG,KAAK,EAAE,OAAiD,CAAA;IAChF,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACrG,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAC9E,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;QACjD,IAAI,CAAC,iBAAiB;YAAE,OAAM;QAC9B,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,SAAS,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,iBAAiB,GAAG,KAAK,CAAC;YAAC,OAAM;QAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,mDAAmD,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACtH,IAAI,KAAK,KAAK,KAAK;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAC/D,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACxC,iBAAiB,GAAG,KAAK,CAAA;IAC3B,CAAC,CAAA;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpC,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,iBAAiB,GAAG,IAAI,CAAA;QACxB,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,KAAK,EAAE;YACpF,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;QAC3E,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI;YAC7B,CAAC,2CAA2C,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACxE,CAAC,qBAAqB,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1D,sEAAsE;YACtE,wEAAwE;YACxE,CAAC,6BAA6B,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC,8BAA8B,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACpC;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/D,MAAM,gBAAgB,EAAE,CAAA;QACxB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACvF,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC3C,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC/F,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACzG,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACzG,IAAI,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,QAAQ;YAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;QAC7H,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QACrB,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QACvF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QACvG,MAAM,MAAM,GAA+B,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACnG,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;QAC7C,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QAC7E,MAAM,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACtI,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;gBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7I,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,IAAI,CAAC;YAAC,MAAM,gBAAgB,EAAE,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;IAChI,CAAC;AACH,CAAC"}

package/lib/rsi-service-environment.d.ts

@@ -0,0 +1,6 @@
+export type RsiServiceEnvironment = Readonly<Record<string, string>>;
+export declare function isRsiServiceEnvironmentName(name: string): boolean;
+export declare function rsiServiceEnvironmentPath(home: string, profile: string): string;
+export declare function validateRsiServiceEnvironment(value: unknown, home: string, profile: string): Promise<RsiServiceEnvironment>;
+export declare function readRsiServiceEnvironment(home: string, profile: string): Promise<RsiServiceEnvironment | undefined>;
+//# sourceMappingURL=rsi-service-environment.d.ts.map

package/lib/rsi-service-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-service-environment.d.ts","sourceRoot":"","sources":["../src/rsi-service-environment.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAuBpE,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAkC;AAEpG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG/E;AAuBD,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAC5C,OAAO,CAAC,qBAAqB,CAAC,CAoBhC;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAmBzH"}

package/lib/rsi-service-environment.js

@@ -0,0 +1,113 @@
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+const profilePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const releaseStages = ['PR', 'REVIEW', 'MERGE', 'BUILD', 'SIGN', 'PUBLISH', 'REGISTRY_VERIFY', 'CATALOG_ADMISSION'];
+const allowedNames = new Set([
+    'DSH_SYSTEMD_HOST_ATTESTOR_CONFIG',
+    ...releaseStages.map(stage => `DSH_RELEASE_${stage}_CONFIG`),
+]);
+const maximumBindingBytes = 65_536;
+const maximumConfigBytes = 2_097_152;
+function fail(message) { throw new Error(`rsi service environment: ${message}`); }
+function canonicalPath(value, label) {
+    if (typeof value !== 'string' || !isAbsolute(value) || resolve(value) !== value || value.includes('\0')
+        || /[\r\n]/u.test(value))
+        fail(`${label} must be canonical absolute`);
+}
+function scope(home, profile) {
+    canonicalPath(home, 'DSH_HOME');
+    if (!profilePattern.test(profile))
+        fail('invalid profile');
+}
+export function isRsiServiceEnvironmentName(name) { return allowedNames.has(name); }
+export function rsiServiceEnvironmentPath(home, profile) {
+    scope(home, profile);
+    return join(home, 'rsi-service-environments', `${profile}.json`);
+}
+async function ownedDirectory(path, privateDirectory) {
+    const entry = await lstat(path);
+    if (!entry.isDirectory() || entry.uid !== process.getuid?.() || (entry.mode & (privateDirectory ? 0o077 : 0o022)) !== 0
+        || await realpath(path) !== path)
+        fail(`unsafe directory: ${path}`);
+}
+async function ownedFile(path, maximum) {
+    let descriptor;
+    try {
+        descriptor = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    try {
+        const entry = await descriptor.stat(), linked = await lstat(path);
+        if (!entry.isFile() || entry.nlink !== 1 || entry.uid !== process.getuid?.() || (entry.mode & 0o077) !== 0
+            || entry.size < 1 || entry.size > maximum || linked.dev !== entry.dev || linked.ino !== entry.ino
+            || await realpath(path) !== path)
+            fail(`unsafe file: ${path}`);
+        return await descriptor.readFile('utf8');
+    }
+    finally {
+        await descriptor.close();
+    }
+}
+export async function validateRsiServiceEnvironment(value, home, profile) {
+    scope(home, profile);
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail('environment must be an object');
+    const environment = value;
+    const result = {};
+    for (const name of Object.keys(environment).sort()) {
+        if (!isRsiServiceEnvironmentName(name))
+            fail(`unsupported environment name: ${name}`);
+        const path = environment[name];
+        canonicalPath(path, name);
+        const configPath = path;
+        const withinProfiles = relative(join(home, 'profiles'), configPath);
+        if (withinProfiles === '' || withinProfiles !== '..' && !withinProfiles.startsWith(`..${sep}`) && !isAbsolute(withinProfiles)) {
+            // The profile tree is candidate writable and cannot hold authority configuration.
+            fail(`configuration is inside profiles: ${name}`);
+        }
+        const content = await ownedFile(configPath, maximumConfigBytes);
+        if (content === undefined)
+            fail(`configuration is missing: ${name}`);
+        result[name] = configPath;
+    }
+    return result;
+}
+export async function readRsiServiceEnvironment(home, profile) {
+    const path = rsiServiceEnvironmentPath(home, profile);
+    let parent;
+    try {
+        parent = await lstat(dirname(path));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    if (!parent.isDirectory())
+        fail('unsafe environment directory');
+    await ownedDirectory(home, false);
+    await ownedDirectory(dirname(path), true);
+    const content = await ownedFile(path, maximumBindingBytes);
+    if (content === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        fail('invalid environment JSON');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        fail('invalid environment binding');
+    const binding = parsed;
+    if (Object.keys(binding).sort().join(',') !== 'dshHome,environment,profile,schemaVersion'
+        || binding.schemaVersion !== 1 || binding.dshHome !== home || binding.profile !== profile)
+        fail('environment binding does not match profile');
+    return validateRsiServiceEnvironment(binding.environment, home, profile);
+}
+//# sourceMappingURL=rsi-service-environment.js.map

package/lib/rsi-service-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-service-environment.js","sourceRoot":"","sources":["../src/rsi-service-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAI7E,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAC3D,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAU,CAAA;AAC5H,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS;IACnC,kCAAkC;IAClC,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,KAAK,SAAS,CAAC;CAC7D,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,kBAAkB,GAAG,SAAS,CAAA;AAEpC,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAEhG,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WAClG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe;IAC1C,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAY,IAAa,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AAEpG,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAe;IACrE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpB,OAAO,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;AAClE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,gBAAyB;IACnE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;WAClH,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,UAAU,CAAA;IACd,IAAI,CAAC;QAAC,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC9F,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eACrG,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;eAC9F,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;QAChE,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;YAAS,CAAC;QAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAc,EAAE,IAAY,EAAE,OAAe;IAE7C,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACtG,MAAM,WAAW,GAAG,KAAgC,CAAA;IACpD,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAA;QACrF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9B,aAAa,CAAC,IAAc,EAAE,IAAI,CAAC,CAAA;QACnC,MAAM,UAAU,GAAG,IAAc,CAAA;QACjC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;QACnE,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9H,kFAAkF;YAClF,IAAI,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAA;QACnD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAe;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACzD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC/D,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACjC,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IACvG,MAAM,OAAO,GAAG,MAAiC,CAAA;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,2CAA2C;WACpF,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC/I,OAAO,6BAA6B,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AAC1E,CAAC"}

package/lib/rsi-service-setup.d.ts

@@ -0,0 +1,10 @@
+import type { RsiSetupManifest } from './rsi-profile.js';
+import { type RsiServiceEnvironment } from './rsi-service-environment.js';
+export interface RsiServiceEnvironments {
+    target: RsiServiceEnvironment;
+    coordinator: RsiServiceEnvironment;
+}
+/** Capture selected config paths once; a later shell cannot silently change a
+ * registered service. Explicit manifest values can replace a prior binding. */
+export declare function resolveRsiServiceEnvironments(manifest: RsiSetupManifest, home: string, ambient?: NodeJS.ProcessEnv): Promise<RsiServiceEnvironments | undefined>;
+//# sourceMappingURL=rsi-service-setup.d.ts.map

package/lib/rsi-service-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-service-setup.d.ts","sourceRoot":"","sources":["../src/rsi-service-setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAA4D,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEnI,MAAM,WAAW,sBAAsB;IAAG,MAAM,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,qBAAqB,CAAA;CAAE;AAI7G;+EAC+E;AAC/E,wBAAsB,6BAA6B,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAC1F,OAAO,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAuBvF"}

package/lib/rsi-service-setup.js

@@ -0,0 +1,34 @@
+import { readRsiServiceEnvironment, validateRsiServiceEnvironment } from './rsi-service-environment.js';
+const hostVariable = 'DSH_SYSTEMD_HOST_ATTESTOR_CONFIG';
+const phases = ['pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+/** Capture selected config paths once; a later shell cannot silently change a
+ * registered service. Explicit manifest values can replace a prior binding. */
+export async function resolveRsiServiceEnvironments(manifest, home, ambient = process.env) {
+    const { loadTrustConfig } = await import('@dsh-enhanced/plugin-control-plane');
+    const trust = await loadTrustConfig(manifest.controlPlane.trustPath);
+    const targetNames = phases.flatMap(phase => {
+        const name = `DSH_RELEASE_${phase.toUpperCase().replaceAll('-', '_')}_CONFIG`;
+        return trust.releaseAdapters?.[phase]?.environmentAllowlist.includes(name) ? [name] : [];
+    });
+    const coordinatorNames = trust.hostAttestor?.environmentAllowlist.includes(hostVariable) ? [hostVariable] : [];
+    targetNames.push(...coordinatorNames);
+    const existing = await Promise.all([manifest.targetProfile, manifest.coordinatorProfile].map(profile => readRsiServiceEnvironment(home, profile)));
+    const explicit = manifest.serviceEnvironment;
+    if (explicit !== undefined && (!explicit || typeof explicit !== 'object' || Array.isArray(explicit)
+        || Object.keys(explicit).sort().join(',') !== 'coordinator,target'))
+        throw new Error('rsi setup: serviceEnvironment must contain target and coordinator');
+    if (!explicit && !existing.some(value => value !== undefined) && targetNames.length === 0)
+        return undefined;
+    const select = async (names, saved, declared, profile) => {
+        const selected = declared === undefined ? Object.fromEntries(names.map(name => [name, saved?.[name] ?? ambient[name]])) : declared;
+        if (Object.keys(selected).sort().join('\0') !== [...names].sort().join('\0'))
+            throw new Error('rsi setup: service environment differs from selected trust adapters');
+        return validateRsiServiceEnvironment(selected, home, profile);
+    };
+    const target = await select(targetNames, existing[0], explicit?.target, manifest.targetProfile);
+    const coordinator = await select(coordinatorNames, existing[1], explicit?.coordinator, manifest.coordinatorProfile);
+    if (target[hostVariable] !== coordinator[hostVariable])
+        throw new Error('rsi setup: both Hosts must use the same selected Host authority config');
+    return { target, coordinator };
+}
+//# sourceMappingURL=rsi-service-setup.js.map

package/lib/rsi-service-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-service-setup.js","sourceRoot":"","sources":["../src/rsi-service-setup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAA8B,MAAM,8BAA8B,CAAA;AAGnI,MAAM,YAAY,GAAG,kCAAkC,CAAA;AACvD,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAU,CAAA;AAErH;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,QAA0B,EAAE,IAAY,EAC1F,UAA6B,OAAO,CAAC,GAAG;IACxC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;IAC9E,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM,IAAI,GAAG,eAAe,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAA;QAC7E,OAAO,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1F,CAAC,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAG,KAAK,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9G,WAAW,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAClJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAA;IAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;WAC9F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oBAAoB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IAC3J,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3G,MAAM,MAAM,GAAG,KAAK,EAAE,KAAe,EAAE,KAAwC,EAAE,QAA2C,EAAE,OAAe,EAAE,EAAE;QAC/I,MAAM,QAAQ,GAA2B,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAA2B,CAAC,CAAC,CAAC,QAAQ,CAAA;QACpL,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QACpK,OAAO,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAC/F,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACnH,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IACjJ,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC"}

package/lib/rsi-setup.d.ts

@@ -1,5 +1,8 @@
 import type { ActiveLarkOwnerBindingsSnapshot } from '@dsh-enhanced/assistant-delivery';
 import { compileRsiProfiles, type RsiSetupManifest } from './rsi-profile.js';
+import { type RsiAutomationInventories, type RsiAutomationInventory } from './rsi-owner-profile.js';
+import { type RsiServiceEnvironment } from './rsi-service-environment.js';
+import { resolveRsiServiceEnvironments } from './rsi-service-setup.js';
 export declare function assertRsiEffectivePatch(patch: string, effective: string): void;
 export interface RsiSetupArgs {
     manifestPath: string;
@@ -9,22 +12,52 @@ export interface RsiSetupArgs {
     start: boolean;
     confirmStopped: boolean;
     help: boolean;
+    prepareSource?: boolean;
+    profile?: string;
+    sourceRepository?: string;
+    prepareBuild?: boolean;
+    optionalBuild?: boolean;
+    dockerPath?: string;
+    prepareAuthorities?: boolean;
+    installOwner?: boolean;
+    ackExistingAutomations?: boolean;
+    /** Installer's pre-stop source and destination inventories; never parsed from CLI. */
+    expectedAutomationInventories?: RsiAutomationInventories;
+    installLocalCohort?: boolean;
+    bundles?: string[];
+    prepareLocalUpdate?: boolean;
+    addMemoryLearning?: boolean;
 }
 export declare function parseRsiSetupArgs(argv: readonly string[]): RsiSetupArgs;
 export interface RsiSetupPorts {
     dump(profile: string, home: string): string;
     base(profile: string, home: string): Promise<string>;
     snapshot(effective: string, home: string): Promise<ActiveLarkOwnerBindingsSnapshot>;
+    automationInventory(effective: string, home: string): Promise<RsiAutomationInventory>;
     compile: typeof compileRsiProfiles;
-    validateAuthorities(manifest: RsiSetupManifest, owner: ActiveLarkOwnerBindingsSnapshot['bindings'][number]): Promise<void>;
+    validateAuthorities(manifest: RsiSetupManifest, owner: ActiveLarkOwnerBindingsSnapshot['bindings'][number], environment?: RsiServiceEnvironment): Promise<void>;
+    resolveEnvironments: typeof resolveRsiServiceEnvironments;
+    serviceUnitPath(profile: string, home: string): string;
+    renderServiceUnit(profile: string, home: string, environment: RsiServiceEnvironment): Promise<string>;
+    reloadServices(): void;
+    validateServiceUnits(manifest: RsiSetupManifest, environment: RsiServiceEnvironment): Promise<void>;
     assertStopped(profile: string): void;
     start(profile: string, home: string): Promise<void>;
 }
+export declare function readRsiInstalledBase(profile: string, home: string, environment?: NodeJS.ProcessEnv): Promise<string>;
+export declare const rsiSetupPorts: RsiSetupPorts;
+/** Read back the loaded unit after daemon-reload, before starting either Host. */
+export declare function validateRsiServiceUnitEnvironment(manifest: Pick<RsiSetupManifest, 'targetProfile'>, environment: RsiServiceEnvironment): Promise<void>;
 /** Validate imported finite grants, without calling any signing/authorization method. */
-export declare function validateRsiAuthorities(manifest: RsiSetupManifest, binding: ActiveLarkOwnerBindingsSnapshot['bindings'][number]): Promise<void>;
+export declare function validateRsiAuthorities(manifest: RsiSetupManifest, binding: ActiveLarkOwnerBindingsSnapshot['bindings'][number], environment?: RsiServiceEnvironment): Promise<void>;
 export declare function configureRsiSetup(args: RsiSetupArgs, ports?: RsiSetupPorts): Promise<{
     mode: string;
     profiles: readonly string[];
 }>;
+/** Internal installer entry: caller already owns the DSH_HOME lifecycle lock. */
+export declare function configureRsiSetupLocked(args: RsiSetupArgs, ports?: RsiSetupPorts): Promise<{
+    mode: string;
+    profiles: readonly string[];
+}>;
 export declare function runRsiSetup(argv?: readonly string[]): Promise<void>;
 //# sourceMappingURL=rsi-setup.d.ts.map

package/lib/rsi-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsi-setup.d.ts","sourceRoot":"","sources":["../src/rsi-setup.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAmB5E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU9E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CACjI;AACD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAyBvE;AAwDD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACnF,OAAO,EAAE,OAAO,kBAAkB,CAAA;IAClC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1H,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AA6BD,yFAAyF;AACzF,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDpJ;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA4B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAkEvJ;AAED,wBAAsB,WAAW,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhG"}
+{"version":3,"file":"rsi-setup.d.ts","sourceRoot":"","sources":["../src/rsi-setup.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACa,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAS9G,OAAO,EAA6B,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAA;AA6BtE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU9E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;IAChI,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACpE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACpE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,sFAAsF;IACtF,6BAA6B,CAAC,EAAE,wBAAwB,CAAA;IACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AACD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAiFvE;AA4FD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACnF,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACrF,OAAO,EAAE,OAAO,kBAAkB,CAAA;IAClC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/J,mBAAmB,EAAE,OAAO,6BAA6B,CAAA;IACzD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IACtD,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrG,cAAc,IAAI,IAAI,CAAA;IACtB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvI;AAED,eAAO,MAAM,aAAa,EAAE,aAgC3B,CAAA;AAED,kFAAkF;AAClF,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5J;AAED,yFAAyF;AACzF,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EzL;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAExJ;AAED,iFAAiF;AACjF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAiG9J;AAED,wBAAsB,WAAW,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqGhG"}