@dsh-enhanced/lark-channel 0.1.48 → 0.1.53

package/lib/rsi-build.js

@@ -0,0 +1,478 @@
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { isDeepStrictEqual } from 'node:util';
+import { readRsiSourceWorkspace } from './rsi-source.js';
+const COMMIT = /^[a-f0-9]{40}$/u;
+const IMAGE = /^sha256:[a-f0-9]{64}$/u;
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const SECCOMP_SHA = 'b1e4b5b709578785bd2aff4a3a344301997571ad0e8ae5747aec176571ddc342';
+const LEGACY_BUILDER_SHA = '7b7eb0797e1ca543fb1ffa0463eb78b3ecad14f28fe4bfca25651640aac4669b';
+const LEGACY_DOCKERFILE_SHA = 'c936e136517c5bc85603e7187fe74691e32f954f57b5076946dc42fed33c65f5';
+const BUILDER_SHA = '0f17e5976f7c7e689ca1cd965d7b24a8e2032c216a12c321af90c172e0e8b51b';
+const DOCKERFILE_SHA = 'b3b7d88cf3cf648db2082c49189ec0480bf6969be911448293cf202216be6906';
+const BASE_IMAGE = 'node:22.23.2-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9';
+const PACKAGE_MANAGER = 'pnpm@11.7.0';
+const MAX_OUTPUT = 65_536;
+export class RsiBuildUnavailableError extends Error {
+    code = 'rsi-build-unavailable';
+    constructor(message) { super(`rsi build unavailable: ${message}`); }
+}
+function fail(message) { throw new Error(`rsi build: ${message}`); }
+function digest(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function exactPath(path) { return isAbsolute(path) && resolve(path) === path && !path.includes('\0'); }
+function diagnosticTail(value) {
+    const redacted = value.replace(/https?:\/\/[^\s/@]+:[^\s/@]+@/giu, 'https://[redacted]@')
+        .replace(/authorization\s*:\s*[^\s]+/giu, 'authorization: [redacted]');
+    return Array.from(redacted).map(char => {
+        const code = char.codePointAt(0);
+        return code < 32 || code === 127 ? ' ' : char;
+    }).join('').slice(-2_048).trim();
+}
+async function directory(path, privateMode = true) {
+    const item = await lstat(path);
+    if (!item.isDirectory() || item.isSymbolicLink() || item.mode & (privateMode ? 0o077 : 0o022)
+        || process.getuid && item.uid !== process.getuid() || await realpath(path) !== path)
+        fail(`unsafe directory: ${path}`);
+}
+async function readStable(path, maximum, privateMode = false, allowRoot = false) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await fd.stat();
+        if (!before.isFile() || before.size > maximum || privateMode && before.mode & 0o077
+            || process.getuid && before.uid !== process.getuid() && !(allowRoot && before.uid === 0))
+            fail(`unsafe file: ${path}`);
+        const bytes = await fd.readFile(), after = await fd.stat(), name = await lstat(path);
+        if (bytes.length !== before.size || before.dev !== after.dev || before.ino !== after.ino
+            || before.size !== after.size || before.mtimeMs !== after.mtimeMs
+            || name.dev !== before.dev || name.ino !== before.ino || name.isSymbolicLink())
+            fail(`file changed during read: ${path}`);
+        return bytes;
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function writeExclusive(path, bytes) {
+    const fd = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        await fd.writeFile(bytes);
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function syncDirectory(path) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Drain a cancelled builder, giving its own finally block time to remove its context. */
+async function command(executable, args, environment, signal, timeoutMs, outputLimit = MAX_OUTPUT) {
+    signal.throwIfAborted();
+    const deadline = AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]);
+    return new Promise((resolvePromise, reject) => {
+        let child;
+        try {
+            child = spawn(executable, [...args], { env: environment, stdio: ['ignore', 'pipe', 'pipe'],
+                detached: process.platform !== 'win32', windowsHide: true });
+        }
+        catch {
+            reject(new Error('rsi build: subprocess could not start'));
+            return;
+        }
+        let stdoutBytes = 0, overLimit = false, spawnError = false;
+        const stdout = [];
+        let stderrTail = '';
+        let killTimer;
+        const group = (signalName) => {
+            if (!child.pid)
+                return;
+            try {
+                if (process.platform === 'win32')
+                    child.kill(signalName);
+                else
+                    process.kill(-child.pid, signalName);
+            }
+            catch (error) {
+                if (error.code !== 'ESRCH')
+                    child.kill(signalName);
+            }
+        };
+        const abort = () => {
+            group('SIGTERM');
+            killTimer ??= setTimeout(() => group('SIGKILL'), 5_000);
+            killTimer.unref?.();
+        };
+        deadline.addEventListener('abort', abort, { once: true });
+        if (deadline.aborted)
+            abort();
+        const collect = (data, keep) => {
+            if (keep) {
+                stdoutBytes += data.length;
+                if (stdoutBytes > outputLimit) {
+                    overLimit = true;
+                    group('SIGKILL');
+                    return;
+                }
+                stdout.push(data);
+            }
+            else {
+                // Docker build progress can be large. Drain it without logging it or
+                // treating normal progress as a malformed JSON result.
+                stderrTail = (stderrTail + data.toString('utf8')).slice(-8_192);
+            }
+        };
+        child.stdout.on('data', data => collect(data, true));
+        child.stderr.on('data', data => collect(data, false));
+        child.once('error', () => { spawnError = true; group('SIGKILL'); });
+        child.once('close', (code, killed) => {
+            deadline.removeEventListener('abort', abort);
+            if (killTimer)
+                clearTimeout(killTimer);
+            if (spawnError || overLimit || deadline.aborted || code !== 0 || killed !== null) {
+                const stage = executable === process.execPath ? 'source-image-builder'
+                    : args[0] === 'image' ? 'image-inspect' : args[0] ?? 'command';
+                const tail = diagnosticTail(stderrTail);
+                reject(new Error(`rsi build: subprocess failed, was cancelled, or exceeded its bound (stage=${stage}, exit=${code ?? 'signal'}${tail ? `, stderr=${tail}` : ''})`));
+            }
+            else
+                resolvePromise(Buffer.concat(stdout).toString('utf8').trim());
+        });
+    });
+}
+function isolatedEnvironment(home) {
+    return { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, DOCKER_CONFIG: join(home, 'docker-config'),
+        DOCKER_BUILDKIT: '1' };
+}
+function hostPlatform() {
+    if (process.platform === 'linux' && process.arch === 'x64')
+        return 'linux/amd64';
+    if (process.platform === 'darwin' && process.arch === 'x64')
+        return 'darwin/amd64';
+    if (process.platform === 'darwin' && process.arch === 'arm64')
+        return 'darwin/arm64';
+    throw new RsiBuildUnavailableError('Linux x64 or native macOS x64/arm64 is required');
+}
+async function localSocket(path) {
+    const expected = join(homedir(), '.docker', 'run', 'docker.sock');
+    const socket = path ?? expected;
+    if (!exactPath(socket) || socket !== expected)
+        fail('Docker socket must be the owner local socket');
+    let canonical;
+    try {
+        canonical = await realpath(socket);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RsiBuildUnavailableError('local Docker socket is unavailable');
+        throw error;
+    }
+    if (canonical !== socket)
+        fail('Docker socket must be the owner local socket');
+    let info, parent;
+    try {
+        [info, parent] = await Promise.all([lstat(socket), lstat(dirname(socket))]);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RsiBuildUnavailableError('local Docker socket is unavailable');
+        throw error;
+    }
+    if (!info.isSocket() || info.uid !== process.getuid?.() || !parent.isDirectory()
+        || parent.uid !== process.getuid?.() || parent.mode & 0o022)
+        fail('Docker socket is not owner-safe');
+    return socket;
+}
+function dockerArgs(args, scratch, socket) {
+    return socket === undefined ? args : ['--config', join(scratch, 'docker-config'), '-H', `unix://${socket}`, ...args];
+}
+// Shared by the release-toolchain preparer; these helpers never change a profile.
+export const rsiBuildResources = { directory, readStable, writeExclusive, syncDirectory, command, isolatedEnvironment,
+    hostPlatform, localSocket, dockerArgs };
+async function dockerExecutable(requested) {
+    let path = requested;
+    if (path === undefined) {
+        for (const folder of (process.env.PATH ?? '').split(':')) {
+            if (!folder || !exactPath(folder))
+                continue;
+            const candidate = join(folder, 'docker');
+            try {
+                await lstat(candidate);
+                path = candidate;
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        path ??= '/usr/bin/docker';
+    }
+    if (!exactPath(path))
+        fail('Docker path must be absolute');
+    let canonical;
+    try {
+        canonical = await realpath(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RsiBuildUnavailableError('Docker executable was not found');
+        throw error;
+    }
+    const file = await lstat(canonical), parent = await lstat(dirname(canonical)), uid = process.getuid?.();
+    if (!file.isFile() || file.isSymbolicLink() || file.mode & 0o022 || !(file.mode & 0o111)
+        || !parent.isDirectory() || parent.isSymbolicLink() || parent.mode & 0o002
+        || uid !== undefined && file.uid !== uid && file.uid !== 0)
+        fail('Docker executable is not owner-safe');
+    return { path: canonical, sha256: digest(await readStable(canonical, 100_000_000, false, true)) };
+}
+async function runtime(dockerPath, scratch, signal, platform, socket) {
+    let output;
+    try {
+        output = await command(dockerPath, dockerArgs(['version', '--format', '{{.Server.Version}}/{{.Server.Os}}/{{.Server.Arch}}'], scratch, socket), isolatedEnvironment(scratch), signal, 10_000, 4096);
+    }
+    catch {
+        if (signal.aborted)
+            signal.throwIfAborted();
+        throw new RsiBuildUnavailableError('local Docker daemon is unavailable');
+    }
+    const arch = platform.endsWith('/arm64') ? 'arm64' : 'amd64';
+    if (output !== `29.4.1/linux/${arch}`)
+        throw new RsiBuildUnavailableError(`Docker Server 29.4.1/linux/${arch} is required`);
+    if (socket === undefined)
+        return undefined;
+    const daemonId = await command(dockerPath, dockerArgs(['info', '--format', '{{.ID}}'], scratch, socket), isolatedEnvironment(scratch), signal, 10_000, 4096);
+    if (!/^[A-Za-z0-9][A-Za-z0-9:._-]{7,127}$/u.test(daemonId))
+        fail('Docker daemon identity is invalid');
+    return daemonId;
+}
+async function sourceInputs(source, expectedRepository) {
+    if (source.schemaVersion !== 1 || !COMMIT.test(source.sourceCommit) || source.repository !== expectedRepository
+        || !COMMIT.test(source.baseline.initialCommit)
+        || source.baseline.ref !== 'refs/dsh-source/repairs' || source.baseline.targetBranch !== 'repairs'
+        || source.baseline.remote !== join(dirname(expectedRepository), 'release.git'))
+        fail('source workspace binding is invalid');
+    if (source.baseline.initialCommit !== source.sourceCommit) {
+        // A newer checkout must be derived from retained, Host-signed maintenance
+        // history. A caller-supplied commit alone cannot replace the original root.
+        const current = await readRsiSourceWorkspace({ dshHome: dirname(dirname(dirname(expectedRepository))),
+            profile: basename(dirname(expectedRepository)),
+            ...(source.origin.kind === 'local-head' ? { sourceRepository: source.origin.locator } : {}) });
+        if (!isDeepStrictEqual(current, source))
+            fail('source workspace differs from signed maintenance history');
+    }
+    await directory(source.repository);
+    const files = new Map();
+    const contextFiles = ['scripts/isolation/source-builder.Dockerfile', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'];
+    for (const folder of ['plugins', 'packages']) {
+        for (const entry of await readdir(join(source.repository, folder), { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const name = `${folder}/${entry.name}/package.json`;
+            try {
+                await lstat(join(source.repository, name));
+                contextFiles.push(name);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    contextFiles.sort();
+    if (contextFiles.length > 256)
+        fail('source context file count exceeds bound');
+    const inputs = [...contextFiles, 'scripts/isolation/build-source-image.mjs', 'scripts/isolation/source-builder-seccomp.json'];
+    for (const name of inputs)
+        files.set(name, await readStable(join(source.repository, name), 4_194_304));
+    const manifest = JSON.parse(files.get('package.json').toString('utf8'));
+    if (manifest.name !== 'dsh-enhanced' || manifest.version !== source.version || manifest.packageManager !== PACKAGE_MANAGER)
+        fail('source manifest differs from installed cohort');
+    const builderHash = digest(files.get('scripts/isolation/build-source-image.mjs'));
+    const dockerfileHash = digest(files.get('scripts/isolation/source-builder.Dockerfile'));
+    const current = builderHash === BUILDER_SHA && dockerfileHash === DOCKERFILE_SHA;
+    const legacy = builderHash === LEGACY_BUILDER_SHA && dockerfileHash === LEGACY_DOCKERFILE_SHA;
+    if (!current && !(hostPlatform() === 'linux/amd64' && legacy))
+        fail('source builder differs from installed trusted builder');
+    if (digest(files.get('scripts/isolation/source-builder-seccomp.json')) !== SECCOMP_SHA)
+        fail('repository seccomp differs from approved runtime profile');
+    const hashes = Object.fromEntries([...files].map(([name, bytes]) => [name, digest(bytes)]));
+    return { files, hashes, contextFiles, lockSha256: digest(files.get('pnpm-lock.yaml')) };
+}
+async function snapshot(root, files) {
+    for (const [name, bytes] of files) {
+        const path = join(root, name);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        await writeExclusive(path, bytes);
+    }
+}
+function parseBuildOutput(raw, expected) {
+    if (Buffer.byteLength(raw) > 16_384)
+        fail('builder output exceeds bound');
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || Object.keys(value).sort().join('\0') !== ['image', 'tag', 'baseImage', 'packageManager', 'lockSha256', 'contextFiles'].sort().join('\0')
+        || typeof value.image !== 'string' || !IMAGE.test(value.image)
+        || value.baseImage !== BASE_IMAGE || value.packageManager !== PACKAGE_MANAGER
+        || value.lockSha256 !== expected.lockSha256
+        || JSON.stringify(value.contextFiles) !== JSON.stringify(expected.contextFiles))
+        fail('builder output does not match frozen source inputs');
+    return value.image;
+}
+function buildConfig(dockerPath, image, seccompPath, socket, daemonId) {
+    if (socket !== undefined && daemonId === undefined)
+        fail('portable Docker daemon identity is absent');
+    const common = { dockerPath, image, timeoutMs: 1_800_000, memoryMiB: 16_384, cpus: 8, pidsLimit: 1_024,
+        workspaceMiB: 4_096, temporaryMiB: 2_048, outputBytes: 65_536,
+        versioning: 'patch' };
+    return socket === undefined
+        ? { ...common, profile: 'repository', repositorySandbox: { seccompPath } }
+        : { ...common, temporaryMiB: 4_096, profile: 'portable-repository', repositorySandbox: { seccompPath }, socketPath: socket, daemonId: daemonId };
+}
+async function imageExists(dockerPath, image, scratch, signal, platform, socket) {
+    const arch = platform.endsWith('/arm64') ? 'arm64' : 'amd64';
+    const actual = await command(dockerPath, dockerArgs(['image', 'inspect', '--format', '{{.Id}}/{{.Os}}/{{.Architecture}}', image], scratch, socket), isolatedEnvironment(scratch), signal, 30_000, 4096);
+    if (actual !== `${image}/linux/${arch}`)
+        fail('Docker image ID or platform differs from builder receipt');
+}
+async function replay(final, expected, scratch, signal) {
+    await directory(final);
+    if (JSON.stringify((await readdir(final)).sort()) !== JSON.stringify(['bootstrap.json', 'seccomp.json']))
+        fail('build workspace incomplete or unexpected');
+    const value = JSON.parse((await readStable(join(final, 'bootstrap.json'), 65_536, true)).toString('utf8'));
+    const { receiptDigest, ...content } = value;
+    if (value.schemaVersion !== 1 || digest(JSON.stringify(content)) !== receiptDigest
+        || value.dshHome !== expected.dshHome || value.profile !== expected.profile
+        || value.repository !== expected.repository || value.sourceCommit !== expected.sourceCommit
+        || value.dockerSha256 !== expected.dockerSha256 || value.sourceBuild?.dockerPath !== expected.dockerPath
+        || value.hostPlatform !== (expected.socket === undefined ? undefined : expected.hostPlatform)
+        || value.imagePlatform !== (expected.socket === undefined ? undefined : `linux/${expected.hostPlatform.endsWith('/arm64') ? 'arm64' : 'amd64'}`)
+        || value.daemonId !== expected.daemonId
+        || !IMAGE.test(value.sourceBuild?.image ?? '')
+        || JSON.stringify(value.inputHashes) !== JSON.stringify(expected.inputHashes)
+        || JSON.stringify(value.contextFiles) !== JSON.stringify(expected.contextFiles)
+        || value.lockSha256 !== expected.lockSha256
+        || JSON.stringify(value.sourceBuild) !== JSON.stringify(buildConfig(expected.dockerPath, value.sourceBuild.image, join(final, 'seccomp.json'), expected.socket, expected.daemonId)))
+        fail('build receipt differs from frozen source or Docker client');
+    if (digest(await readStable(join(final, 'seccomp.json'), 65_536, true)) !== SECCOMP_SHA)
+        fail('private repository seccomp changed');
+    if (scratch !== undefined)
+        await imageExists(expected.dockerPath, value.sourceBuild.image, scratch, signal, expected.hostPlatform, expected.socket);
+    signal.throwIfAborted();
+    return { schemaVersion: 1, sourceCommit: value.sourceCommit, sourceBuild: value.sourceBuild };
+}
+/** Read recorded build inputs without creating resources or running Docker.
+ * Image availability is checked separately by preparation/execution. */
+export async function readRsiBuildEnvironment(input) {
+    if (!exactPath(input.dshHome) || !PROFILE.test(input.profile))
+        fail('invalid DSH_HOME or profile');
+    await directory(input.dshHome, false);
+    const repository = join(input.dshHome, 'rsi-sources', input.profile, 'checkout');
+    const source = await sourceInputs(input.source, repository);
+    const parent = join(input.dshHome, 'rsi-builds'), final = join(parent, input.profile);
+    await directory(parent);
+    await directory(final);
+    const saved = JSON.parse((await readStable(join(final, 'bootstrap.json'), 65_536, true)).toString('utf8'));
+    if (typeof saved.sourceBuild?.dockerPath !== 'string')
+        fail('recorded Docker path is absent');
+    const docker = await dockerExecutable(saved.sourceBuild.dockerPath);
+    const platform = hostPlatform();
+    const socket = platform.startsWith('darwin/') ? await localSocket(saved.sourceBuild.socketPath) : undefined;
+    const signal = input.signal ?? new AbortController().signal;
+    return replay(final, { dshHome: input.dshHome, profile: input.profile, repository,
+        sourceCommit: input.source.sourceCommit, dockerPath: docker.path, dockerSha256: docker.sha256,
+        inputHashes: source.hashes, contextFiles: source.contextFiles, lockSha256: source.lockSha256,
+        hostPlatform: platform, socket, daemonId: saved.daemonId }, undefined, signal);
+}
+/** Caller holds the DSH_HOME lifecycle lock; no profile or service is changed here. */
+export async function prepareRsiBuildEnvironment(input) {
+    if (!exactPath(input.dshHome) || !PROFILE.test(input.profile))
+        fail('invalid DSH_HOME or profile');
+    const platform = hostPlatform();
+    if (platform === 'linux/amd64' && input.socketPath !== undefined)
+        fail('Linux source build does not accept a portable socket');
+    await directory(input.dshHome, false);
+    const repository = join(input.dshHome, 'rsi-sources', input.profile, 'checkout');
+    const source = await sourceInputs(input.source, repository);
+    const docker = await dockerExecutable(input.dockerPath);
+    const socket = platform.startsWith('darwin/') ? await localSocket(input.socketPath) : undefined;
+    const parent = join(input.dshHome, 'rsi-builds');
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await directory(parent);
+    const final = join(parent, input.profile), signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(1_860_000)]);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    await chmod(stage, 0o700);
+    let claimed;
+    try {
+        await mkdir(join(stage, 'docker-config'), { mode: 0o700 });
+        const daemonId = await runtime(docker.path, stage, signal, platform, socket);
+        const expected = { dshHome: input.dshHome, profile: input.profile, repository, sourceCommit: input.source.sourceCommit,
+            dockerPath: docker.path, dockerSha256: docker.sha256, inputHashes: source.hashes,
+            contextFiles: source.contextFiles, lockSha256: source.lockSha256, hostPlatform: platform, socket, daemonId };
+        const present = await lstat(final).then(() => true, error => {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        });
+        if (present)
+            return await replay(final, expected, stage, signal);
+        const sourceSnapshot = join(stage, 'source');
+        await mkdir(sourceSnapshot, { mode: 0o700 });
+        await snapshot(sourceSnapshot, source.files);
+        const builder = join(sourceSnapshot, 'scripts', 'isolation', 'build-source-image.mjs');
+        const raw = await command(process.execPath, [builder, '--docker-path', docker.path, '--timeout-ms', '1800000',
+            ...(socket === undefined ? [] : ['--socket-path', socket, '--platform', platform.slice('darwin/'.length)])], isolatedEnvironment(stage), signal, 1_810_000);
+        const image = parseBuildOutput(raw, source);
+        await imageExists(docker.path, image, stage, signal, platform, socket);
+        if (await runtime(docker.path, stage, signal, platform, socket) !== daemonId)
+            fail('Docker daemon changed during source image build');
+        const fresh = await sourceInputs(input.source, repository);
+        if (JSON.stringify(fresh.hashes) !== JSON.stringify(source.hashes))
+            fail('source inputs changed during Docker build');
+        await mkdir(final, { mode: 0o700 });
+        const identity = await stat(final);
+        claimed = { dev: identity.dev, ino: identity.ino };
+        await writeExclusive(join(stage, 'seccomp.json'), source.files.get('scripts/isolation/source-builder-seccomp.json'));
+        await rename(join(stage, 'seccomp.json'), join(final, 'seccomp.json'));
+        const result = { schemaVersion: 1, sourceCommit: input.source.sourceCommit,
+            sourceBuild: buildConfig(docker.path, image, join(final, 'seccomp.json'), socket, daemonId) };
+        const content = { ...result, dshHome: input.dshHome, profile: input.profile, repository,
+            dockerSha256: docker.sha256, inputHashes: source.hashes, contextFiles: source.contextFiles, lockSha256: source.lockSha256,
+            ...(socket === undefined ? {} : { hostPlatform: platform, imagePlatform: `linux/${platform.endsWith('/arm64') ? 'arm64' : 'amd64'}`, daemonId }) };
+        await writeExclusive(join(final, 'bootstrap.json'), JSON.stringify({ ...content, receiptDigest: digest(JSON.stringify(content)) }));
+        await syncDirectory(final);
+        await syncDirectory(parent);
+        return result;
+    }
+    catch (error) {
+        if (claimed) {
+            const current = await lstat(final).catch(() => undefined);
+            if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino) {
+                const names = await readdir(final).catch(() => []);
+                if (names.every(name => ['seccomp.json', 'bootstrap.json'].includes(name)))
+                    await rm(final, { recursive: true, force: true });
+            }
+        }
+        throw error;
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+        await syncDirectory(parent);
+    }
+}
+//# sourceMappingURL=rsi-build.js.map

package/lib/rsi-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-build.js","sourceRoot":"","sources":["../src/rsi-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC1G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,OAAO,EAAE,sBAAsB,EAA2B,MAAM,iBAAiB,CAAA;AAGjF,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,KAAK,GAAG,wBAAwB,CAAA;AACtC,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,WAAW,GAAG,kEAAkE,CAAA;AACtF,MAAM,kBAAkB,GAAG,kEAAkE,CAAA;AAC7F,MAAM,qBAAqB,GAAG,kEAAkE,CAAA;AAChG,MAAM,WAAW,GAAG,kEAAkE,CAAA;AACtF,MAAM,cAAc,GAAG,kEAAkE,CAAA;AACzF,MAAM,UAAU,GAAG,oGAAoG,CAAA;AACvH,MAAM,eAAe,GAAG,aAAa,CAAA;AACrC,MAAM,UAAU,GAAG,MAAM,CAAA;AAEzB,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,uBAAuB,CAAA;IACvC,YAAY,OAAe,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;CAC5E;AAsBD,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAClF,SAAS,MAAM,CAAC,KAAsB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAC3G,SAAS,SAAS,CAAC,IAAY,IAAa,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AACvH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,kCAAkC,EAAE,qBAAqB,CAAC;SACtF,OAAO,CAAC,+BAA+B,EAAE,2BAA2B,CAAC,CAAA;IACxE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAA;QACjC,OAAO,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAClC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,WAAW,GAAG,IAAI;IACvD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;WACxF,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;AAC1H,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK;IAC7F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,OAAO,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;eAC9E,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;QACxH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QACpF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;eACnF,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eAC9D,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QAC3H,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChC,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAsB;IAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACpH,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjF,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC9F,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,OAAO,CAAC,UAAkB,EAAE,IAAuB,EAAE,WAA8B,EAChG,MAAmB,EAAE,SAAiB,EAAE,WAAW,GAAG,UAAU;IAChE,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,KAA+B,CAAA;QACnC,IAAI,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC9F,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAChE,MAAM,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAC5E,IAAI,WAAW,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,EAAE,UAAU,GAAG,KAAK,CAAA;QAC1D,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,UAAU,GAAG,EAAE,CAAA;QACnB,IAAI,SAAoD,CAAA;QACxD,MAAM,KAAK,GAAG,CAAC,UAA0B,EAAE,EAAE;YAC3C,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,OAAM;YACtB,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;;oBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAAC,CAAC;QACnG,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,CAAC,SAAS,CAAC,CAAA;YAChB,SAAS,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;YACvD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAA;QACrB,CAAC,CAAA;QACD,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,QAAQ,CAAC,OAAO;YAAE,KAAK,EAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAa,EAAE,EAAE;YAC9C,IAAI,IAAI,EAAE,CAAC;gBACT,WAAW,IAAI,IAAI,CAAC,MAAM,CAAA;gBAC1B,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC;oBAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAC7E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,uDAAuD;gBACvD,UAAU,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,CAAA;QACD,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACrD,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAClE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC5C,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAA;YACtC,IAAI,UAAU,IAAI,SAAS,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACjF,MAAM,KAAK,GAAG,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB;oBACpE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;gBAChE,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;gBACvC,MAAM,CAAC,IAAI,KAAK,CAAC,6EAA6E,KAAK,UAAU,IAAI,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YACrK,CAAC;;gBACI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QAC5G,eAAe,EAAE,GAAG,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,aAAa,CAAA;IAChF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAClF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAA;IACpF,MAAM,IAAI,wBAAwB,CAAC,iDAAiD,CAAC,CAAA;AACvF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAa;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,IAAI,QAAQ,CAAA;IAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;IACnG,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,oCAAoC,CAAC,CAAA;QAChI,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,SAAS,KAAK,MAAM;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;IAC9E,IAAI,IAAuC,EAAE,MAAyC,CAAA;IACtF,IAAI,CAAC;QAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAAC,CAAC;IACnF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,oCAAoC,CAAC,CAAA;QAChI,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;WAC3E,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACtG,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,OAAe,EAAE,MAAe;IAClE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;AACtH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB;IACnH,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AAEzC,KAAK,UAAU,gBAAgB,CAAC,SAAkB;IAChD,IAAI,IAAI,GAAG,SAAS,CAAA;IACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YACxC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBAAC,IAAI,GAAG,SAAS,CAAC;gBAAC,MAAK;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;YAAC,CAAC;QAC/I,CAAC;QACD,IAAI,KAAK,iBAAiB,CAAA;IAC5B,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC1D,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IACxC,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,iCAAiC,CAAC,CAAA;QAC7H,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IACvG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;WACnF,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;WACvE,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACzG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAA;AACnG,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAmB,EAAE,QAAgB,EAAE,MAAe;IAChH,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qDAAqD,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAClJ,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IACvD,MAAM,CAAC;QACL,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,cAAc,EAAE,CAAA;QAC3C,MAAM,IAAI,wBAAwB,CAAC,oCAAoC,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAC5D,IAAI,MAAM,KAAK,gBAAgB,IAAI,EAAE;QAAE,MAAM,IAAI,wBAAwB,CAAC,8BAA8B,IAAI,cAAc,CAAC,CAAA;IAC3H,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EACrG,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACrD,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACrG,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAA0B,EAAE,kBAA0B;IAGhF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB;WAC1G,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC3C,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,yBAAyB,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;WAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;IAC7H,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1D,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnG,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAChG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,MAAM,YAAY,GAAG,CAAC,6CAA6C,EAAE,cAAc,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;IAC7H,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5F,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAQ;YAC5D,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,CAAA;YACnD,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAC3E,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;YAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,CAAA;IACnB,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,EAAE,0CAA0C,EAAE,+CAA+C,CAAC,CAAA;IAC7H,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;IACtG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACnG,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,cAAc,KAAK,eAAe;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;IACjL,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAE,CAAC,CAAA;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAE,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,WAAW,KAAK,WAAW,IAAI,cAAc,KAAK,cAAc,CAAA;IAChF,MAAM,MAAM,GAAG,WAAW,KAAK,kBAAkB,IAAI,cAAc,KAAK,qBAAqB,CAAA;IAC7F,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,aAAa,IAAI,MAAM,CAAC;QAAE,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC5H,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C,CAAE,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzJ,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC,EAAE,CAAA;AAC1F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAA0B;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC7B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,QAAwD;IAC7F,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;WACxI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;WAC3D,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,KAAK,CAAC,cAAc,KAAK,eAAe;WAC1E,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WACxC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC7I,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,KAAa,EAAE,WAAmB,EAAE,MAAe,EAAE,QAAiB;IAC7G,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;IACrG,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK;QACpG,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;QAC7D,UAAU,EAAE,OAAgB,EAAE,CAAA;IAChC,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE;QAC1E,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAA;AACrJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAmB,EAAE,QAAgB,EAAE,MAAe;IACnI,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAChJ,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACrD,IAAI,MAAM,KAAK,GAAG,KAAK,UAAU,IAAI,EAAE;QAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;AAC3G,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,QAEyF,EAAE,OAA2B,EAAE,MAAmB;IAC9K,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACtB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAAE,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAC1J,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IACrH,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAA;IAC3C,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa;WAC7E,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;WACxE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;WACxF,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,EAAE,UAAU,KAAK,QAAQ,CAAC,UAAU;WACrG,KAAK,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC1F,KAAK,CAAC,aAAa,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;WAC7I,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;WACpC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;WAC3C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;WAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC5E,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WACxC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;IACxP,IAAI,MAAM,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnI,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnJ,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAA;AAC/F,CAAC;AAED;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KACM;IAClD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAClG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACrF,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IACrH,IAAI,OAAO,KAAK,CAAC,WAAW,EAAE,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC7F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3G,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAA;IAC3D,OAAO,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU;QAC/E,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM;QAC7F,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC5F,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;AAClF,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KACyC;IACxF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;IAC/B,IAAI,QAAQ,KAAK,aAAa,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,sDAAsD,CAAC,CAAA;IAC9H,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IAClI,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACnJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,CAAA;IACrE,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,OAAiD,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC5E,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACpH,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM;YAChF,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QAC9G,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;YAC1D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YACpE,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,OAAO;YAAE,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5C,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;QACtF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS;YAC3G,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC3G,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC3C,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtE,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;QACrI,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;QACrH,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QACtF,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C,CAAE,CAAC,CAAA;QACrH,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAA;QACtE,MAAM,MAAM,GAAwB,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YAC7F,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAA;QAC/F,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU;YACrF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;YACzH,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACpJ,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACnI,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QACvD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBACzF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;gBAClD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/H,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;AAC9F,CAAC"}

package/lib/rsi-creation-build.d.ts

@@ -0,0 +1,48 @@
+import { type RsiBuildEnvironment } from './rsi-build.js';
+import type { RsiSourceWorkspace } from './rsi-source.js';
+export interface RsiCreationBuildEnvironment {
+    schemaVersion: 1;
+    sourceCommit: string;
+    sourceImage: string;
+    image: string;
+    dockerPath: string;
+    socketPath?: string;
+}
+interface Input {
+    dshHome: string;
+    profile: string;
+    source: RsiSourceWorkspace;
+    build: RsiBuildEnvironment;
+    signal?: AbortSignal;
+}
+/** Verify frozen local inputs only. This reader never invokes Docker. */
+export declare function readRsiCreationBuildEnvironment(input: Input): Promise<RsiCreationBuildEnvironment>;
+export declare function readRsiCreationBuildInStage(input: {
+    logicalHome: string;
+    stagePhysicalHome: string;
+    profile: string;
+    stagedSource: RsiSourceWorkspace;
+    stagedBuild: RsiBuildEnvironment;
+    signal?: AbortSignal;
+}): Promise<RsiCreationBuildEnvironment>;
+/** Bind a freshly built candidate image to a stopped, copied Home. The old
+ * logical Home and the candidate receipt are never written by this operation. */
+export declare function materializeRsiCreationBuildInStage(input: {
+    candidateHome: string;
+    stagePhysicalHome: string;
+    logicalHome: string;
+    profile: string;
+    candidateSource: RsiSourceWorkspace;
+    candidateBuild: RsiBuildEnvironment;
+    stagedSource: RsiSourceWorkspace;
+    stagedBuild: RsiBuildEnvironment;
+    signal?: AbortSignal;
+}): Promise<{
+    creationBuild: RsiCreationBuildEnvironment;
+    candidateReceiptSha256: string;
+    receiptSha256: string;
+}>;
+/** Caller holds the DSH_HOME lifecycle lock. Build or replay an immutable image. */
+export declare function prepareRsiCreationBuildEnvironment(input: Input): Promise<RsiCreationBuildEnvironment>;
+export {};
+//# sourceMappingURL=rsi-creation-build.d.ts.map

package/lib/rsi-creation-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-creation-build.d.ts","sourceRoot":"","sources":["../src/rsi-creation-build.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoD,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC3G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAsBzD,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,CAAC,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAgBD,UAAU,KAAK;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE;AA4IlI,yEAAyE;AACzE,wBAAsB,+BAA+B,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAOxG;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;IAC/D,YAAY,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACzF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAcvC;AAED;iFACiF;AACjF,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;IACtF,eAAe,EAAE,kBAAkB,CAAC;IAAC,cAAc,EAAE,mBAAmB,CAAA;IACxE,YAAY,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACzF,GAAG,OAAO,CAAC;IAAE,aAAa,EAAE,2BAA2B,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAgFjH;AAED,oFAAoF;AACpF,wBAAsB,kCAAkC,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAuE3G"}