@dsh-enhanced/lark-channel 0.1.48 → 0.1.53

package/lib/rsi-owner-profile.js

@@ -0,0 +1,178 @@
+import { createHash } from 'node:crypto';
+import { lstatSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { externalPrincipalId, ownerRouteAuthorityHash } from '@dsh-enhanced/assistant-delivery';
+import { listAutomationsLocally } from '@dsh-enhanced/assistant-automations';
+import { isMap, isSeq, parseDocument, stringify } from 'yaml';
+function fail(message) { throw new Error(`rsi owner profile: ${message}`); }
+function text(value, label) {
+    if (typeof value !== 'string' || !value || value.trim() !== value)
+        fail(`invalid ${label}`);
+    return value;
+}
+function path(value, home, label) {
+    const raw = text(value, label), expression = /^dshHomePath\((['"])([^'"\\]+)\1\)$/u.exec(raw);
+    const resolved = expression ? join(home, expression[2]) : raw;
+    if (expression && expression[2].split('/').some(part => !part || part === '.' || part === '..')
+        || !isAbsolute(resolved) || resolve(resolved) !== resolved)
+        fail(`${label} must be a canonical path or bounded dshHomePath expression`);
+    return resolved;
+}
+function rows(effective) {
+    const document = parseDocument(effective, { uniqueKeys: true });
+    if (document.errors.length || !isSeq(document.contents))
+        fail('invalid effective YAML');
+    const result = new Map();
+    for (const item of document.contents.items) {
+        if (!isMap(item))
+            fail('invalid effective row');
+        const id = item.get('id');
+        if (typeof id !== 'string' || result.has(id))
+            fail('invalid or duplicate effective row');
+        result.set(id, item);
+    }
+    return result;
+}
+function config(entries, id) {
+    const entry = entries.get(id);
+    const value = entry?.get('config', true);
+    if (!entry || entry.get('disabled') === true || !isMap(value))
+        fail(`enabled ${id} config is required`);
+    return value;
+}
+/** Pure authority resolution. The caller adds a missing route only within its journaled compiler output. */
+export function resolveRsiOwnerRoute(delivery, owner, home, expectedId) {
+    if (owner.status !== 'active' || owner.owner?.status !== 'active' || owner.owner.role !== 'owner'
+        || !owner.owner.id || !isDeepStrictEqual(owner.owner.principal, owner.principal)
+        || owner.conversation.channel !== 'lark' || owner.conversation.kind !== 'dm' || owner.principal.channel !== 'lark'
+        || ![owner.version, owner.generation, owner.owner.version].every(value => Number.isSafeInteger(value) && value >= 1))
+        fail('active owner receipt is invalid');
+    const workspace = path(delivery.defaultWorkspace, home, 'Delivery workspace');
+    const preset = text(delivery.defaultAgentPreset, 'Delivery preset');
+    if (workspace !== owner.workspace || preset !== owner.agentPreset || delivery.policyRef !== undefined && delivery.policyRef !== owner.policyRef)
+        fail('owner binding differs from effective delivery scope');
+    const routes = delivery.ownerRoutes;
+    if (!Array.isArray(routes))
+        fail('Delivery owner routes are missing');
+    const ids = new Set();
+    for (const route of routes) {
+        if (!route || typeof route !== 'object' || Array.isArray(route))
+            fail('invalid owner route');
+        const id = text(route.id, 'owner route id');
+        if (ids.has(id))
+            fail('owner route id is duplicated');
+        ids.add(id);
+    }
+    const matching = routes.filter(route => isDeepStrictEqual(route.conversation, owner.conversation));
+    if (matching.length > 1)
+        fail('no unique effective route matches active owner');
+    let authority = matching[0];
+    if (authority) {
+        for (const key of ['principal', 'workspace', 'agentPreset', 'policyRef']) {
+            if (!isDeepStrictEqual(authority[key], owner[key]))
+                fail(`owner route ${key} conflicts with active owner`);
+        }
+        if (!Number.isSafeInteger(authority.minimumGeneration) || authority.minimumGeneration < 1
+            || authority.minimumGeneration > owner.generation)
+            fail('owner route minimumGeneration conflicts with active owner');
+    }
+    else {
+        const lineage = { owner: owner.owner.id, conversation: owner.conversation, principal: owner.principal,
+            workspace, agentPreset: preset, policyRef: owner.policyRef };
+        const id = `rsi-owner-${createHash('sha256').update(JSON.stringify(lineage)).digest('hex').slice(0, 32)}`;
+        if (ids.has(id))
+            fail('stable owner route id conflicts with an existing route');
+        authority = { id, conversation: owner.conversation, principal: owner.principal, workspace,
+            agentPreset: preset, policyRef: owner.policyRef, minimumGeneration: owner.generation };
+    }
+    if (expectedId !== undefined && authority.id !== expectedId)
+        fail('owner route id differs from frozen manifest');
+    return { workspace, preset, principal: externalPrincipalId(owner.principal), authority,
+        created: matching.length === 0,
+        route: { id: authority.id, authorityHash: ownerRouteAuthorityHash(authority) } };
+}
+/** Resolve owner lookup independently of Recovery/Health/Heartbeat deployment. */
+export function rsiOwnerBindingQuery(effective, home) {
+    const entries = rows(effective), delivery = config(entries, 'dsh-enhanced-assistant-delivery'), lark = config(entries, 'dsh-enhanced-lark-channel');
+    return { account: text(lark.get('account'), 'Lark account'), tenant: text(lark.get('tenant'), 'Lark tenant'),
+        workspace: path(delivery.get('defaultWorkspace'), home, 'Delivery workspace'),
+        agentPreset: text(delivery.get('defaultAgentPreset'), 'Delivery preset') };
+}
+function automations(effective) {
+    const entries = rows(effective);
+    const standalone = entries.get('dsh-enhanced-assistant-automations'), personal = entries.get('dsh-enhanced-personal-assistant');
+    if (standalone && standalone.get('disabled') !== true) {
+        if (personal && personal.get('disabled') !== true)
+            fail('ambiguous standalone and embedded Automations providers');
+        return config(entries, 'dsh-enhanced-assistant-automations');
+    }
+    const value = config(entries, 'dsh-enhanced-personal-assistant').get('assistantAutomations', true);
+    if (!isMap(value))
+        fail('assistantAutomations config is required');
+    return value;
+}
+export function rsiDatabasePaths(effective, home) {
+    return { deliveryDatabasePath: path(config(rows(effective), 'dsh-enhanced-assistant-delivery').get('databasePath'), home, 'Delivery database'),
+        automationsDatabasePath: path(automations(effective).get('databasePath'), home, 'Automations database') };
+}
+function missingPrivateDatabase(databasePath) {
+    try {
+        lstatSync(databasePath);
+        return false;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    // A fresh coordinator has no database directory yet. Prove absence under a
+    // private physical ancestor without creating directories or masking symlinks.
+    let parent = dirname(databasePath);
+    for (;;) {
+        try {
+            const metadata = lstatSync(parent);
+            if (!metadata.isDirectory() || metadata.isSymbolicLink() || realpathSync(parent) !== parent
+                || metadata.uid !== process.getuid?.() || (metadata.mode & 0o077) !== 0)
+                fail('missing Automations database has an unsafe parent');
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const next = dirname(parent);
+            if (next === parent)
+                fail('missing Automations database has no private parent');
+            parent = next;
+        }
+    }
+}
+export function rsiAutomationInventory(effective, home) {
+    const value = automations(effective), databasePath = path(value.get('databasePath'), home, 'Automations database');
+    const enabled = value.get('schedulerEnabled');
+    if (enabled !== undefined && typeof enabled !== 'boolean')
+        fail('invalid schedulerEnabled');
+    return { databasePath, schedulerEnabled: enabled === true,
+        records: missingPrivateDatabase(databasePath) ? [] : listAutomationsLocally(databasePath).filter(record => record.status !== 'deleted') };
+}
+export function rsiCoordinatorAutomationDatabasePath(home, profile) {
+    return join(home, 'rsi-coordinators', profile, 'automations.sqlite');
+}
+/** Capture both source ledgers and both destination ledgers. A coordinator switches to a private database. */
+export async function captureRsiAutomationInventories(inspect, target, coordinator, home, profile) {
+    const current = await Promise.all([inspect(target, home), inspect(coordinator, home)]);
+    const planned = current.map((value, index) => stringify([{ id: 'dsh-enhanced-assistant-automations', config: {
+                databasePath: index === 0 ? value.databasePath : rsiCoordinatorAutomationDatabasePath(home, profile), schedulerEnabled: true,
+            } }]));
+    const next = await Promise.all(planned.map(value => inspect(value, home)));
+    return structuredClone([...current, ...next]);
+}
+export function assertRsiSchedulerActivation(inventories, acknowledged) {
+    for (let index = 0; index < 2; index++) {
+        const before = inventories[index], after = inventories[index + 2];
+        if (after.schedulerEnabled && (!before.schedulerEnabled || before.databasePath !== after.databasePath)
+            && (before.records.length > 0 || after.records.length > 0) && !acknowledged) {
+            fail('existing active or paused Automations require --ack-existing-automations before scheduler activation');
+        }
+    }
+}
+//# sourceMappingURL=rsi-owner-profile.js.map

package/lib/rsi-owner-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-owner-profile.js","sourceRoot":"","sources":["../src/rsi-owner-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAA+B,MAAM,kCAAkC,CAAA;AAC5H,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAgB,MAAM,MAAM,CAAA;AAE3E,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC1F,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QAAE,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,IAAY,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7F,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9D,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;WAC3F,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAA;IACzI,OAAO,QAAQ,CAAA;AACjB,CAAC;AACD,SAAS,IAAI,CAAC,SAAiB;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC/C,MAAM,EAAE,GAAY,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACxF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,SAAS,MAAM,CAAC,OAA6B,EAAE,EAAU;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAY,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAA;IACvG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,oBAAoB,CAAC,QAA6B,EAAE,KAA6B,EAAE,IAAY,EAAE,UAAmB;IAClI,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;WAC5F,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;WAC7E,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM;WAC/G,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC/J,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAA;IACnE,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,IAAI,CAAC,qDAAqD,CAAC,CAAA;IAC5M,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAA;QAC3C,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACrD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;IAClG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC/E,IAAI,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAoC,CAAA;IAC9D,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAU,EAAE,CAAC;YAClF,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAE,IAAI,CAAC,eAAe,GAAG,8BAA8B,CAAC,CAAA;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,iBAAiB,GAAG,CAAC;eACpF,SAAS,CAAC,iBAAiB,GAAG,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;IACxH,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YACnG,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;QAC9D,MAAM,EAAE,GAAG,aAAa,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,EAAE,CAAA;QACxG,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,wDAAwD,CAAC,CAAA;QAC/E,SAAS,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS;YACvF,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;IAC1F,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IAChH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS;QACpF,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAY,EAAE,aAAa,EAAE,uBAAuB,CAAC,SAA0D,CAAC,EAAE,EAAE,CAAA;AAC/I,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAY;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,iCAAiC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;IACnJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAC1G,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC;QAC7E,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAA;AAC9E,CAAC;AACD,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;IAC/H,IAAI,UAAU,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,yDAAyD,CAAC,CAAA;QAClH,OAAO,MAAM,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAA;IAClG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAY;IAC9D,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,iCAAiC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC;QAC5I,uBAAuB,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,sBAAsB,CAAC,EAAE,CAAA;AAC7G,CAAC;AAMD,SAAS,sBAAsB,CAAC,YAAoB;IAClD,IAAI,CAAC;QAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACrF,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAClC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM;mBACtF,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;YACpI,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5B,IAAI,IAAI,KAAK,MAAM;gBAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;YAC/E,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;IACH,CAAC;AACH,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;IAClH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,OAAO,KAAK,IAAI;QACvD,OAAO,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAA;AAC7I,CAAC;AACD,MAAM,UAAU,oCAAoC,CAAC,IAAY,EAAE,OAAe;IAChF,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAA;AACtE,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAA6E,EACjI,MAAc,EAAE,WAAmB,EAAE,IAAY,EAAE,OAAe;IAClE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,oCAAoC,EAAE,MAAM,EAAE;gBAC3G,YAAY,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,oCAAoC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI;aAC7H,EAAE,CAAC,CAAC,CAAC,CAAA;IACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,CAA6B,CAAA;AAC3E,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,WAAqC,EAAE,YAAqB;IACvG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAE,EAAE,KAAK,GAAG,WAAW,CAAC,KAAK,GAAG,CAAC,CAAE,CAAA;QACnE,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;eACjG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,IAAI,CAAC,sGAAsG,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/rsi-plugin-creation.d.ts

@@ -0,0 +1,32 @@
+import { type CreationAcceptanceAuthorityRef } from '@dsh-enhanced/assistant-growth-contract';
+import type { CreationReviewConfig } from '@dsh-enhanced/assistant-verifier';
+import type { Config as ControlPlaneConfig, CreationCapabilityConfig, CreationCapabilityOwner } from '@dsh-enhanced/plugin-control-plane';
+import type { RsiAuthorityResources } from './rsi-authority-resources.js';
+import type { RsiCreationBuildEnvironment } from './rsi-creation-build.js';
+import type { NativeRsiCreationBuildEnvironment } from './rsi-native-runtime-bootstrap.js';
+export type SourceCreationGrant = NonNullable<NonNullable<ControlPlaneConfig['sourceJobs']>['creation']>;
+export interface RsiPluginCreationSetup {
+    reviews: CreationReviewConfig;
+    creation: SourceCreationGrant;
+    capabilities: CreationCapabilityConfig;
+    verifications: {
+        authority: CreationAcceptanceAuthorityRef;
+        publicKey: string;
+    };
+}
+/** Optional peers are loaded only for an opted-in creation setup. */
+export declare function getRsiPluginCreationValidators(): {
+    compileCreationReviewConfig: typeof import('@dsh-enhanced/assistant-verifier').compileCreationReviewConfig;
+    validateCreationCapabilityConfig: typeof import('@dsh-enhanced/plugin-control-plane').validateCreationCapabilityConfig;
+};
+/** Admission of a complete finite chain; no resource is created or reset here. */
+export declare function validateRsiPluginCreationSetup(input: unknown, expectedOwner: CreationCapabilityOwner, now?: number): RsiPluginCreationSetup;
+/** Compile one stable installation grant from the already prepared private identities. */
+export declare function createRsiPluginCreationSetup(input: {
+    resources: RsiAuthorityResources;
+    build: RsiCreationBuildEnvironment | NativeRsiCreationBuildEnvironment;
+    owner: CreationCapabilityOwner;
+    expiresAt: number;
+    now: number;
+}): RsiPluginCreationSetup;
+//# sourceMappingURL=rsi-plugin-creation.d.ts.map

package/lib/rsi-plugin-creation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-plugin-creation.d.ts","sourceRoot":"","sources":["../src/rsi-plugin-creation.ts"],"names":[],"mappings":"AAKA,OAAO,EAA0C,KAAK,8BAA8B,EAAE,MAAM,yCAAyC,CAAA;AACrI,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,IAAI,kBAAkB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACzI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAA;AAE1F,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;AAExG,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,YAAY,EAAE,wBAAwB,CAAA;IACtC,aAAa,EAAE;QAAE,SAAS,EAAE,8BAA8B,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAChF;AAwBD,qEAAqE;AACrE,wBAAgB,8BAA8B,IAAI;IAChD,2BAA2B,EAAE,cAAc,kCAAkC,EAAE,2BAA2B,CAAA;IAC1G,gCAAgC,EAAE,cAAc,oCAAoC,EAAE,gCAAgC,CAAA;CACvH,CASA;AAcD,kFAAkF;AAClF,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,uBAAuB,EACnG,GAAG,SAAa,GAAG,sBAAsB,CAiF1C;AAED,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,2BAA2B,GAAG,iCAAiC,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAC;IACzI,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAC/B,GAAG,sBAAsB,CA4CzB"}

package/lib/rsi-plugin-creation.js

@@ -0,0 +1,189 @@
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { validateCreationAcceptanceAuthorityRef } from '@dsh-enhanced/assistant-growth-contract';
+const limits = {
+    creates: 32, verifications: 32, adoptions: 32, cases: 4, tools: 8,
+    callsPerAdoption: 30, callRecords: 960, inputBytes: 65_536,
+    reviewInputBytes: 262_144, reviewOutputTokens: 8_192, reviewDurationMs: 300_000,
+    receiptTtlMs: 86_400_000, runnerDurationMs: 30_000,
+    reviewRuns: 160, adoptionRuns: 1_024,
+    retentionLifetimeMs: 30 * 86_400_000,
+};
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+function fail(message) { throw new Error(`rsi plugin creation: ${message}`); }
+const requirePeer = createRequire(import.meta.url);
+function installedPeer(name) {
+    try {
+        requirePeer.resolve(name);
+    }
+    catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND'
+            || error.code === 'ERR_MODULE_NOT_FOUND')
+            fail(`opted-in plugin creation requires installed peer ${name}`);
+        throw error;
+    }
+    return requirePeer(name);
+}
+/** Optional peers are loaded only for an opted-in creation setup. */
+export function getRsiPluginCreationValidators() {
+    const verifier = installedPeer('@dsh-enhanced/assistant-verifier');
+    const controlPlane = installedPeer('@dsh-enhanced/plugin-control-plane');
+    if (typeof verifier.compileCreationReviewConfig !== 'function'
+        || typeof controlPlane.validateCreationCapabilityConfig !== 'function') {
+        fail('installed creation validators are unavailable; update the verifier and control-plane peers');
+    }
+    return { compileCreationReviewConfig: verifier.compileCreationReviewConfig,
+        validateCreationCapabilityConfig: controlPlane.validateCreationCapabilityConfig };
+}
+function exact(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+        return false;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    return Reflect.ownKeys(value).length === fields.length
+        && Object.keys(descriptors).sort().join('\0') === [...fields].sort().join('\0')
+        && Object.values(descriptors).every(field => field.enumerable && 'value' in field);
+}
+function publicKeyAt(path) {
+    return createPublicKey(createPrivateKey(readFileSync(path))).export({ format: 'pem', type: 'spki' }).toString();
+}
+/** Admission of a complete finite chain; no resource is created or reset here. */
+export function validateRsiPluginCreationSetup(input, expectedOwner, now = Date.now()) {
+    if (!Number.isSafeInteger(now) || now < 0)
+        fail('invalid validation time');
+    if (!exact(expectedOwner, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId',
+        'principalVersion', 'workspace', 'agentPreset']))
+        fail('invalid expected owner');
+    if (!exact(input, ['reviews', 'creation', 'capabilities', 'verifications']))
+        fail('invalid setup fields');
+    const setup = input;
+    const validators = getRsiPluginCreationValidators();
+    const { config: reviews, authority, publicKey } = validators.compileCreationReviewConfig(setup.reviews);
+    validators.validateCreationCapabilityConfig(setup.capabilities);
+    const capabilities = structuredClone(setup.capabilities);
+    if (!isDeepStrictEqual(reviews.owner, expectedOwner) || !isDeepStrictEqual(capabilities.owner, expectedOwner)) {
+        fail('creation owner differs from current owner route');
+    }
+    if (!exact(setup.creation, ['id', 'expiresAt', 'maxCreates', 'namePrefix'])
+        || typeof setup.creation.id !== 'string'
+        || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u.test(setup.creation.id)
+        || !Number.isSafeInteger(setup.creation.expiresAt)
+        || setup.creation.expiresAt <= now
+        || setup.creation.maxCreates !== limits.creates)
+        fail('invalid finite source creation grant');
+    const creation = structuredClone(setup.creation);
+    const installationId = creation.id.startsWith('creation-source-') ? creation.id.slice('creation-source-'.length) : '';
+    if (!uuid.test(installationId)
+        || creation.namePrefix !== `owner-${installationId.slice(0, 8)}-`
+        || reviews.namePrefix !== creation.namePrefix || capabilities.namePrefix !== creation.namePrefix) {
+        fail('creation namespace differs');
+    }
+    if (reviews.expiresAt !== creation.expiresAt || capabilities.expiresAt !== creation.expiresAt
+        || reviews.runner.expiresAt !== creation.expiresAt || capabilities.runner.expiresAt !== creation.expiresAt) {
+        fail('creation authority expiry differs');
+    }
+    if (reviews.authorityId !== `creation-review-${installationId}`
+        || capabilities.authorityId !== `creation-adoption-${installationId}`
+        || reviews.keyId !== `${reviews.authorityId}-key` || capabilities.keyId !== `${capabilities.authorityId}-key`
+        || new Set([creation.id, reviews.authorityId, capabilities.authorityId, expectedOwner.authorityId]).size !== 4
+        || reviews.keyPath === capabilities.keyPath) {
+        fail('creation authorities must be independent');
+    }
+    const authorityRoot = dirname(dirname(reviews.keyPath));
+    if (reviews.keyPath !== join(authorityRoot, 'identities', 'review.pem')
+        || capabilities.keyPath !== join(authorityRoot, 'identities', 'adoption.pem')
+        || reviews.runner.stateRoot !== join(authorityRoot, 'state', 'creation-review-runner')
+        || capabilities.runner.stateRoot !== join(authorityRoot, 'state', 'creation-adoption-runner')) {
+        fail('creation private roots differ from prepared identities');
+    }
+    if (reviews.maxVerifications !== limits.verifications || reviews.maxCases !== limits.cases
+        || reviews.maxInputBytes !== limits.reviewInputBytes || reviews.maxOutputTokens !== limits.reviewOutputTokens
+        || reviews.maxDurationMs !== limits.reviewDurationMs || reviews.receiptTtlMs !== limits.receiptTtlMs
+        || capabilities.maxAdoptions !== limits.adoptions || capabilities.maxTools !== limits.tools
+        || capabilities.maxCallsPerAdoption !== limits.callsPerAdoption
+        || capabilities.maxCallRecords !== limits.callRecords || capabilities.maxInputBytes !== limits.inputBytes) {
+        fail('creation finite limits differ');
+    }
+    // Old manifests retain their original certificate-bound lifetime. A new
+    // installation explicitly grants bounded use after the authoring window.
+    if (capabilities.retention !== undefined
+        && capabilities.retention.maximumLifetimeMs !== limits.retentionLifetimeMs) {
+        fail('creation retention lifetime differs');
+    }
+    if (reviews.runner.maxRuns !== limits.reviewRuns || reviews.runner.maxDurationMs !== limits.runnerDurationMs
+        || reviews.runner.maxTotalDurationMs !== limits.reviewRuns * limits.runnerDurationMs
+        || reviews.runner.maxOutputBytes !== 262_144
+        || capabilities.runner.maxRuns !== limits.adoptionRuns || capabilities.runner.maxDurationMs !== limits.runnerDurationMs
+        || capabilities.runner.maxTotalDurationMs !== 86_400_000 || capabilities.runner.maxOutputBytes !== 65_536
+        || reviews.runner.maxRuns < reviews.maxVerifications * (reviews.maxCases + 1)
+        || capabilities.runner.maxRuns < capabilities.maxAdoptions + capabilities.maxCallRecords
+        || capabilities.maxCallRecords < capabilities.maxAdoptions * capabilities.maxCallsPerAdoption
+        || ('backend' in reviews.runner !== 'backend' in capabilities.runner)
+        || ('backend' in reviews.runner && 'backend' in capabilities.runner
+            ? reviews.runner.backend !== 'macos-seatbelt' || capabilities.runner.backend !== 'macos-seatbelt'
+                || !isDeepStrictEqual(reviews.runner.runtime, capabilities.runner.runtime)
+            : !('backend' in reviews.runner) && !('backend' in capabilities.runner)
+                && (reviews.runner.image !== capabilities.runner.image || reviews.runner.dockerPath !== capabilities.runner.dockerPath
+                    || reviews.runner.socketPath !== capabilities.runner.socketPath))) {
+        fail('creation runner limits cannot cover finite grants');
+    }
+    if (!exact(setup.verifications, ['authority', 'publicKey']))
+        fail('invalid creation verification fields');
+    validateCreationAcceptanceAuthorityRef(setup.verifications.authority);
+    if (!isDeepStrictEqual(setup.verifications.authority, authority)
+        || setup.verifications.publicKey !== publicKey)
+        fail('creation verification authority digest or key differs');
+    if (publicKeyAt(capabilities.keyPath) === publicKey)
+        fail('verification and adoption signing keys must be separate');
+    return { reviews, creation, capabilities, verifications: { authority, publicKey } };
+}
+/** Compile one stable installation grant from the already prepared private identities. */
+export function createRsiPluginCreationSetup(input) {
+    const { resources, build, owner, expiresAt, now } = input;
+    if (resources?.schemaVersion !== 1 || ![1, 2].includes(build?.schemaVersion)
+        || !uuid.test(resources.installationId)
+        || !Number.isSafeInteger(expiresAt) || expiresAt <= now)
+        fail('invalid installation or expiry');
+    const prefix = `owner-${resources.installationId.slice(0, 8)}-`;
+    const creation = { id: `creation-source-${resources.installationId}`, expiresAt,
+        maxCreates: limits.creates, namePrefix: prefix };
+    const reviews = {
+        authorityId: `creation-review-${resources.installationId}`, owner, namePrefix: prefix,
+        keyId: `creation-review-${resources.installationId}-key`, keyPath: resources.identities.review.keyPath,
+        expiresAt, maxVerifications: limits.verifications,
+        runner: { stateRoot: join(resources.stateRoot, 'creation-review-runner'),
+            ...(build.schemaVersion === 2 ? { backend: 'macos-seatbelt', runtime: build.runtime }
+                : { image: build.image, dockerPath: build.dockerPath, ...(build.socketPath ? { socketPath: build.socketPath } : {}) }),
+            expiresAt, maxRuns: limits.reviewRuns,
+            maxTotalDurationMs: limits.reviewRuns * limits.runnerDurationMs, maxDurationMs: limits.runnerDurationMs,
+            maxOutputBytes: 262_144 },
+        policy: 'Derive concrete held-out behavior cases from the current authenticated task and feedback. Independently check exact outputs and the checked source patch. Reject ambiguous behavior, unsafe scope, and missing evidence.',
+        maxInputBytes: limits.reviewInputBytes, maxOutputTokens: limits.reviewOutputTokens,
+        maxDurationMs: limits.reviewDurationMs, maxCases: limits.cases, receiptTtlMs: limits.receiptTtlMs,
+    };
+    const capabilities = {
+        authorityId: `creation-adoption-${resources.installationId}`,
+        keyId: `creation-adoption-${resources.installationId}-key`, keyPath: resources.identities.adoption.keyPath,
+        owner, namePrefix: prefix, expiresAt, maxAdoptions: limits.adoptions,
+        maxTools: limits.tools, maxCallsPerAdoption: limits.callsPerAdoption,
+        maxCallRecords: limits.callRecords, maxInputBytes: limits.inputBytes,
+        retention: { maximumLifetimeMs: limits.retentionLifetimeMs },
+        runner: { stateRoot: join(resources.stateRoot, 'creation-adoption-runner'),
+            ...(build.schemaVersion === 2 ? { backend: 'macos-seatbelt', runtime: build.runtime }
+                : { image: build.image, dockerPath: build.dockerPath, ...(build.socketPath ? { socketPath: build.socketPath } : {}) }),
+            expiresAt, maxRuns: limits.adoptionRuns,
+            maxTotalDurationMs: 86_400_000, maxDurationMs: limits.runnerDurationMs, maxOutputBytes: 65_536 },
+    };
+    const { compileCreationReviewConfig } = getRsiPluginCreationValidators();
+    const { authority, publicKey } = compileCreationReviewConfig(reviews);
+    const setup = validateRsiPluginCreationSetup({ reviews, creation, capabilities,
+        verifications: { authority, publicKey } }, owner, now);
+    if (setup.verifications.publicKey !== resources.identities.review.publicKeyPem
+        || publicKeyAt(setup.capabilities.keyPath) !== resources.identities.adoption.publicKeyPem) {
+        fail('prepared signing identities differ');
+    }
+    return setup;
+}
+//# sourceMappingURL=rsi-plugin-creation.js.map

package/lib/rsi-plugin-creation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-plugin-creation.js","sourceRoot":"","sources":["../src/rsi-plugin-creation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,sCAAsC,EAAuC,MAAM,yCAAyC,CAAA;AAgBrI,MAAM,MAAM,GAAG;IACb,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACjE,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM;IAC1D,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO;IAC/E,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM;IAClD,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK;IACpC,mBAAmB,EAAE,EAAE,GAAG,UAAU;CAC5B,CAAA;AACV,MAAM,IAAI,GAAG,wEAAwE,CAAA;AAErF,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC5F,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAClD,SAAS,aAAa,CAAI,IAAY;IACpC,IAAI,CAAC;QAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IACjC,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,kBAAkB;eAC1D,KAA+B,CAAC,IAAI,KAAK,sBAAsB;YAAE,IAAI,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAA;QACvI,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAM,CAAA;AAC/B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,8BAA8B;IAI5C,MAAM,QAAQ,GAAG,aAAa,CAAoD,kCAAkC,CAAC,CAAA;IACrH,MAAM,YAAY,GAAG,aAAa,CAAsD,oCAAoC,CAAC,CAAA;IAC7H,IAAI,OAAO,QAAQ,CAAC,2BAA2B,KAAK,UAAU;WACzD,OAAO,YAAY,CAAC,gCAAgC,KAAK,UAAU,EAAE,CAAC;QACzE,IAAI,CAAC,4FAA4F,CAAC,CAAA;IACpG,CAAC;IACD,OAAO,EAAE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACxE,gCAAgC,EAAE,YAAY,CAAC,gCAAgC,EAAE,CAAA;AACrF,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,MAAyB;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAClI,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;WACjD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;WAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,OAAO,IAAI,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,eAAe,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;AACjH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,8BAA8B,CAAC,KAAc,EAAE,aAAsC,EACnG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAC1E,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB;QAC3F,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAClF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;IACzG,MAAM,KAAK,GAAG,KAA+B,CAAA;IAC7C,MAAM,UAAU,GAAsD,8BAA8B,EAAE,CAAA;IACtG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACvG,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QAC9G,IAAI,CAAC,iDAAiD,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;WACtE,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;WACrC,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;WAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;WAC/C,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,GAAG;WAC/B,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;WACzB,QAAQ,CAAC,UAAU,KAAK,SAAS,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;WAC9D,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnG,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;WACxF,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,YAAY,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7G,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,mBAAmB,cAAc,EAAE;WAC1D,YAAY,CAAC,WAAW,KAAK,qBAAqB,cAAc,EAAE;WAClE,OAAO,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,WAAW,MAAM,IAAI,YAAY,CAAC,KAAK,KAAK,GAAG,YAAY,CAAC,WAAW,MAAM;WAC1G,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;WAC3G,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9C,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACvD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;WAClE,YAAY,CAAC,OAAO,KAAK,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC;WAC1E,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,wBAAwB,CAAC;WACnF,YAAY,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,wDAAwD,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK;WACrF,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,kBAAkB;WAC1G,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WACjG,YAAY,CAAC,YAAY,KAAK,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK;WACxF,YAAY,CAAC,mBAAmB,KAAK,MAAM,CAAC,gBAAgB;WAC5D,YAAY,CAAC,cAAc,KAAK,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,aAAa,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5G,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACvC,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS;WACnC,YAAY,CAAC,SAAS,CAAC,iBAAiB,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7E,IAAI,CAAC,qCAAqC,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,gBAAgB;WACvG,OAAO,CAAC,MAAM,CAAC,kBAAkB,KAAK,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB;WACjF,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO;WACzC,YAAY,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,gBAAgB;WACpH,YAAY,CAAC,MAAM,CAAC,kBAAkB,KAAK,UAAU,IAAI,YAAY,CAAC,MAAM,CAAC,cAAc,KAAK,MAAM;WACtG,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;WAC1E,YAAY,CAAC,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,YAAY,GAAG,YAAY,CAAC,cAAc;WACrF,YAAY,CAAC,cAAc,GAAG,YAAY,CAAC,YAAY,GAAG,YAAY,CAAC,mBAAmB;WAC1F,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,CAAC;WAClE,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,YAAY,CAAC,MAAM;YACjE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB;mBAC5F,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5E,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,YAAY,CAAC,MAAM,CAAC;mBAClE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,UAAU;uBACjH,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,mDAAmD,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACzG,sCAAsC,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;IACrE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC;WAC3D,KAAK,CAAC,aAAa,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC/G,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,IAAI,CAAC,yDAAyD,CAAC,CAAA;IACpH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAA;AACrF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;IACzD,IAAI,SAAS,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;WACvE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;WACpC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,SAAS,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAA;IAC/D,MAAM,QAAQ,GAAwB,EAAE,EAAE,EAAE,mBAAmB,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS;QAClG,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,MAAM,OAAO,GAAyB;QACpC,WAAW,EAAE,mBAAmB,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM;QACrF,KAAK,EAAE,mBAAmB,SAAS,CAAC,cAAc,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;QACtG,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,aAAa;QACjD,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,wBAAwB,CAAC;YACtE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAyB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC5F,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxH,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU;YACrC,kBAAkB,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB;YACvG,cAAc,EAAE,OAAO,EAAE;QAC3B,MAAM,EAAE,0NAA0N;QAClO,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,CAAC,kBAAkB;QAClF,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;KAClG,CAAA;IACD,MAAM,YAAY,GAA6B;QAC7C,WAAW,EAAE,qBAAqB,SAAS,CAAC,cAAc,EAAE;QAC5D,KAAK,EAAE,qBAAqB,SAAS,CAAC,cAAc,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO;QAC1G,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS;QACpE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;QACpE,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU;QACpE,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC5D,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAyB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC5F,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxH,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY;YACvC,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE;KACnG,CAAA;IACD,MAAM,EAAE,2BAA2B,EAAE,GAAG,8BAA8B,EAAE,CAAA;IACxE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,8BAA8B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;QAC5E,aAAa,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IACxD,IAAI,KAAK,CAAC,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY;WACzE,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5F,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/lib/rsi-profile.d.ts

@@ -2,14 +2,20 @@ import { type ActiveLarkOwnerBinding } from '@dsh-enhanced/assistant-delivery';
 import { type AssistantGrowthDriverConfig } from '@dsh-enhanced/assistant-growth-driver';
 import { type Config as ControlPlaneConfig } from '@dsh-enhanced/plugin-control-plane';
 import { type SourceReviewConfig } from '@dsh-enhanced/assistant-verifier';
+import type { RsiServiceEnvironments } from './rsi-service-setup.js';
+import { type RsiMemoryLearningSetup } from './rsi-memory-learning.js';
+import { type RsiPluginCreationSetup } from './rsi-plugin-creation.js';
 /** Private, owner supplied input for the two-host RSI overlay. */
 export interface RsiSetupManifest {
     schemaVersion: 1;
     targetProfile: string;
     coordinatorProfile: string;
+    serviceEnvironment?: RsiServiceEnvironments;
     controlPlane: ControlPlaneConfig;
     growthDriver: AssistantGrowthDriverConfig;
     sourceReviews: SourceReviewConfig;
+    memoryLearning?: RsiMemoryLearningSetup;
+    pluginCreation?: RsiPluginCreationSetup;
     coordinator: {
         budgetId: string;
         budgetAmount: number;
@@ -22,8 +28,25 @@ export interface RsiSetupManifest {
         source: number;
         observations: number;
         coordinator: number;
+        qualification?: number;
     };
 }
+/** Match the target compiler's exact embedded Personal Assistant options for Host attestation. */
+export declare function compileRsiPersonalAssistantOptions(input: {
+    effectiveConfig: Record<string, unknown>;
+    manifest: RsiSetupManifest;
+    scope: {
+        workspace: string;
+        preset: string;
+        principal: string;
+    };
+    budgetIds: {
+        reviews: string;
+        discovery: string;
+        source: string;
+        observations: string;
+    };
+}): Record<string, unknown>;
 /**
  * Read-only profile compiler. The caller owns private manifest I/O, lifecycle locks,
  * atomic writes and post-write DSH composition checks.

package/lib/rsi-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsi-profile.d.ts","sourceRoot":"","sources":["../src/rsi-profile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAC5H,OAAO,EAAmB,KAAK,2BAA2B,EAAE,MAAM,uCAAuC,CAAA;AACzG,OAAO,EAA+B,KAAK,MAAM,IAAI,kBAAkB,EAAE,MAAM,oCAAoC,CAAA;AACnH,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGtG,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,kBAAkB,CAAA;IAChC,YAAY,EAAE,2BAA2B,CAAA;IACzC,aAAa,EAAE,kBAAkB,CAAA;IACjC,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1E,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5H;AAoJD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAgFzT"}
+{"version":3,"file":"rsi-profile.d.ts","sourceRoot":"","sources":["../src/rsi-profile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,EAAmB,KAAK,2BAA2B,EAAE,MAAM,uCAAuC,CAAA;AACzG,OAAO,EAA+B,KAAK,MAAM,IAAI,kBAAkB,EAAE,MAAM,oCAAoC,CAAA;AACnH,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEpE,OAAO,EAAkC,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACtG,OAAO,EAAkC,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEtG,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;IAC3C,YAAY,EAAE,kBAAkB,CAAA;IAChC,YAAY,EAAE,2BAA2B,CAAA;IACzC,aAAa,EAAE,kBAAkB,CAAA;IACjC,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1E,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACpJ;AAoMD,kGAAkG;AAClG,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CACxF,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAmIzT"}