@dsh-enhanced/lark-channel 0.1.64 → 0.1.66

package/lib/rsi-linux-creation-build.js

@@ -0,0 +1,213 @@
+import { createHash } from 'node:crypto';
+import { chmod, lstat, mkdir, mkdtemp, readdir, rm, stat } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { linuxRuntimeDigest } from '@dsh-enhanced/assistant-isolation';
+import { rsiBuildResources as io } from './rsi-build.js';
+import { discoverLinuxCgroupRoots, RsiLinuxCgroupUnavailableError } from './rsi-linux-cgroup-roots.js';
+import { prepareLinuxRsiRepositoryRuntime, readLinuxRsiRepositoryRuntime } from './rsi-linux-repository-bootstrap.js';
+import { LinuxRsiRuntimeUnavailableError } from './rsi-linux-runtime-bootstrap.js';
+/** Missing host prerequisites (cgroup delegation, user-namespace subordinate
+ * allocations, the C compiler, the fixed runtime) stop installation as
+ * not-ready. Integrity and identity failures stay hard Error failures. */
+export class RsiLinuxCreationBuildUnavailableError extends Error {
+    code = 'rsi-linux-creation-build-unavailable';
+    constructor(message) { super(`rsi Linux creation build unavailable: ${message}`); }
+}
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const PEER_SPECIFIER = '@dsh-enhanced/assistant-verifier/linux-behavior-runtime';
+const SUBORDINATE_PATTERN = /^subordinate \S+ allocation is unavailable$/u;
+// Sorted exact receipt content (everything except receiptDigest itself).
+const CONTENT_KEYS = ['backend', 'behavior', 'behaviorDigest', 'buildRuntimeDigest', 'cgroupRoots', 'dshHome',
+    'lockSha256', 'preparationDigest', 'profile', 'repositoryRuntimeDigest', 'schemaVersion', 'sourceCommit',
+    'systemSnapshotDigest', 'userNamespaceDigest'].sort();
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const digest = (value) => sha(JSON.stringify(value));
+const canonical = (value) => isAbsolute(value) && resolve(value) === value && !value.includes('\0');
+function fail(message) { throw new Error(`rsi Linux creation build: ${message}`); }
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+const requirePeer = createRequire(import.meta.url);
+/** The verifier behavior runtime is an optional peer loaded only when Linux
+ * native creation is actually prepared; a missing peer is a fatal opt-in gap,
+ * not an environment not-ready condition. */
+function behaviorPeer() {
+    try {
+        requirePeer.resolve(PEER_SPECIFIER);
+    }
+    catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND'
+            || error.code === 'ERR_MODULE_NOT_FOUND') {
+            fail(`opted-in Linux plugin creation requires installed peer ${PEER_SPECIFIER}`);
+        }
+        throw error;
+    }
+    const peer = requirePeer(PEER_SPECIFIER);
+    if (typeof peer.prepareLinuxPluginBehaviorRuntime !== 'function'
+        || typeof peer.readLinuxPluginBehaviorDeploymentPreparation !== 'function'
+        || typeof peer.linuxPluginBehaviorRuntimeDigest !== 'function') {
+        fail('installed Linux behavior runtime peer is unavailable; update the assistant-verifier peer');
+    }
+    return peer;
+}
+/** Map missing host prerequisites to the not-ready error. Abort reasons,
+ * cgroup/runtime unavailable errors and integrity failures pass through. */
+async function environmentGap(label, signal, operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        if (error instanceof RsiLinuxCgroupUnavailableError || error instanceof LinuxRsiRuntimeUnavailableError)
+            throw error;
+        if (signal.aborted)
+            throw error;
+        const code = error.code;
+        const message = error.message ?? '';
+        if (code === 'ENOENT' || SUBORDINATE_PATTERN.test(message)) {
+            throw new RsiLinuxCreationBuildUnavailableError(`${label}: ${message}`);
+        }
+        throw error;
+    }
+}
+function project(receipt) {
+    return { schemaVersion: 3, backend: 'linux-native', sourceCommit: receipt.sourceCommit,
+        behavior: receipt.behavior, cgroupRoots: receipt.cgroupRoots, buildRuntimeDigest: receipt.buildRuntimeDigest };
+}
+async function validateIdentity(input) {
+    input.signal?.throwIfAborted();
+    if (!canonical(input.dshHome) || !PROFILE.test(input.profile) || !canonical(input.stateRoot)
+        || input.stateRoot === '/' || input.source.schemaVersion !== 1
+        || !COMMIT.test(input.source.sourceCommit))
+        fail('invalid creation bootstrap identity');
+    await io.directory(input.dshHome);
+    await io.directory(input.stateRoot);
+}
+async function replayExisting(input, final, repository, cgroupRoots, peer, signal) {
+    await io.directory(final);
+    if (!isDeepStrictEqual(await readdir(final), ['bootstrap.json']))
+        fail('behavior workspace incomplete or unexpected');
+    const receipt = JSON.parse((await io.readStable(join(final, 'bootstrap.json'), 65_536, true)).toString('utf8'));
+    const { receiptDigest, ...content } = receipt;
+    if (Object.keys(content).sort().join() !== CONTENT_KEYS.join()
+        || digest(content) !== receiptDigest || receipt.schemaVersion !== 3 || receipt.backend !== 'linux-native'
+        || receipt.dshHome !== input.dshHome || receipt.profile !== input.profile
+        || receipt.sourceCommit !== input.source.sourceCommit || receipt.lockSha256 !== repository.lockSha256
+        || !isDeepStrictEqual(receipt.cgroupRoots, cgroupRoots))
+        fail('Linux creation receipt differs');
+    const runtimeDigest = linuxRuntimeDigest(repository.runtime);
+    // The deployment reopen binds the retained observer even when the build-time
+    // base receipt is later retired; it never invokes the compiler or Docker.
+    const deployment = await environmentGap('reopen Linux behavior preparation', signal, () => peer.readLinuxPluginBehaviorDeploymentPreparation({ runtime: receipt.behavior, signal }));
+    if (receipt.repositoryRuntimeDigest !== runtimeDigest
+        || receipt.systemSnapshotDigest !== digest(repository.systemSnapshot)
+        || receipt.userNamespaceDigest !== digest(repository.userNamespace)
+        || receipt.buildRuntimeDigest !== deployment.baseRuntimeDigest
+        || receipt.buildRuntimeDigest !== runtimeDigest
+        || receipt.preparationDigest !== deployment.preparationDigest
+        || !isDeepStrictEqual(receipt.behavior, deployment.descriptor)
+        || receipt.behaviorDigest !== peer.linuxPluginBehaviorRuntimeDigest(deployment.descriptor)) {
+        fail('Linux creation receipt differs from the prepared repository or behavior runtime');
+    }
+    signal.throwIfAborted();
+    return project(receipt);
+}
+/** Caller holds the DSH_HOME lifecycle lock. Prepare or replay the immutable
+ * Linux native behavior runtime used for creation review and adoption. */
+export async function prepareLinuxRsiCreationBuildEnvironment(input) {
+    await validateIdentity(input);
+    const peer = behaviorPeer();
+    const behaviorRoot = join(input.stateRoot, 'linux-creation-behavior');
+    const parent = join(input.dshHome, 'rsi-linux-creation-builds');
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    const final = join(parent, input.profile);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(2_400_000)]);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    await chmod(stage, 0o700);
+    let claimed;
+    try {
+        // schema4: fresh readable clone of the schema3 base, npm layout, system
+        // snapshot and subordinate user-namespace mapping.
+        const repository = await environmentGap('prepare Linux repository runtime', signal, () => prepareLinuxRsiRepositoryRuntime({
+            dshHome: input.dshHome, profile: input.profile, source: input.source, signal,
+            ...(input.nodeArchivePath ? { nodeArchivePath: input.nodeArchivePath } : {}),
+            ...(input.pnpmArchivePath ? { pnpmArchivePath: input.pnpmArchivePath } : {}),
+            ...(input.pnpmExeArchivePath ? { pnpmExeArchivePath: input.pnpmExeArchivePath } : {}),
+            ...(input.pnpmNativeArchivePath ? { pnpmNativeArchivePath: input.pnpmNativeArchivePath } : {}),
+        }));
+        const cgroupRoots = await discoverLinuxCgroupRoots({ signal });
+        if (await exists(final))
+            return await replayExisting(input, final, repository, cgroupRoots, peer, signal);
+        // The single shared observer runtime; its sibling lock and rollback live
+        // in the verifier peer. A missing /usr/bin/cc is a not-ready host gap.
+        const descriptor = await environmentGap('compile Linux behavior runtime', signal, () => peer.prepareLinuxPluginBehaviorRuntime({ runtime: repository.runtime, root: behaviorRoot, signal }));
+        const deployment = await peer.readLinuxPluginBehaviorDeploymentPreparation({ runtime: descriptor, signal });
+        const runtimeDigest = linuxRuntimeDigest(repository.runtime);
+        if (!isDeepStrictEqual(deployment.descriptor, descriptor)
+            || deployment.baseRuntimeDigest !== runtimeDigest)
+            fail('behavior preparation is not bound to the repository runtime');
+        signal.throwIfAborted();
+        const content = {
+            schemaVersion: 3, backend: 'linux-native', sourceCommit: input.source.sourceCommit,
+            behavior: descriptor, cgroupRoots, dshHome: input.dshHome, profile: input.profile,
+            lockSha256: repository.lockSha256, buildRuntimeDigest: deployment.baseRuntimeDigest,
+            preparationDigest: deployment.preparationDigest,
+            behaviorDigest: peer.linuxPluginBehaviorRuntimeDigest(descriptor),
+            repositoryRuntimeDigest: runtimeDigest, systemSnapshotDigest: digest(repository.systemSnapshot),
+            userNamespaceDigest: digest(repository.userNamespace),
+        };
+        await mkdir(final, { mode: 0o700 });
+        const identity = await stat(final);
+        claimed = { dev: identity.dev, ino: identity.ino };
+        await io.writeExclusive(join(final, 'bootstrap.json'), Buffer.from(JSON.stringify({ ...content, receiptDigest: digest(content) })));
+        await io.syncDirectory(final);
+        await io.syncDirectory(parent);
+        return project({ ...content, receiptDigest: digest(content) });
+    }
+    catch (error) {
+        if (claimed) {
+            const current = await lstat(final).catch(() => undefined);
+            if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino
+                && (await readdir(final)).every(name => name === 'bootstrap.json'))
+                await rm(final, { recursive: true, force: true });
+        }
+        throw error;
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+        await io.syncDirectory(parent);
+    }
+}
+/** Verify an existing Linux creation family without preparing missing inputs.
+ * Fixed runtime integrity probes, read-only cgroup discovery and retained
+ * observer verification remain part of reopening the recorded receipts. */
+export async function readLinuxRsiCreationBuildEnvironment(input) {
+    await validateIdentity(input);
+    const peer = behaviorPeer();
+    const parent = join(input.dshHome, 'rsi-linux-creation-builds'), final = join(parent, input.profile);
+    const signal = input.signal ?? new AbortController().signal;
+    await io.directory(parent);
+    const repository = await readLinuxRsiRepositoryRuntime({
+        dshHome: input.dshHome, profile: input.profile, source: input.source, signal,
+    });
+    const cgroupRoots = await discoverLinuxCgroupRoots({ signal });
+    return await replayExisting(input, final, repository, cgroupRoots, peer, signal);
+}
+//# sourceMappingURL=rsi-linux-creation-build.js.map

package/lib/rsi-linux-creation-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-creation-build.js","sourceRoot":"","sources":["../src/rsi-linux-creation-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mCAAmC,CAAA;AAEzF,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAA2B,MAAM,6BAA6B,CAAA;AAC/H,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAC7B,MAAM,qCAAqC,CAAA;AACtF,OAAO,EAAE,+BAA+B,EAA+B,MAAM,kCAAkC,CAAA;AAsB/G;;0EAE0E;AAC1E,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IACrD,IAAI,GAAG,sCAAsC,CAAA;IACtD,YAAY,OAAe,IAAI,KAAK,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;CAC3F;AAsBD,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,cAAc,GAAG,yDAAyD,CAAA;AAChF,MAAM,mBAAmB,GAAG,8CAA8C,CAAA;AAC1E,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,SAAS;IAC3G,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,yBAAyB,EAAE,eAAe,EAAE,cAAc;IACxG,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAA;AACvD,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACrE,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAEpH,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AACjG,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;AAC5I,CAAC;AAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAClD;;6CAE6C;AAC7C,SAAS,YAAY;IACnB,IAAI,CAAC;QAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,kBAAkB;eAC1D,KAA+B,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACtE,IAAI,CAAC,0DAA0D,cAAc,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAA+B,CAAA;IACtE,IAAI,OAAO,IAAI,CAAC,iCAAiC,KAAK,UAAU;WAC3D,OAAO,IAAI,CAAC,4CAA4C,KAAK,UAAU;WACvE,OAAO,IAAI,CAAC,gCAAgC,KAAK,UAAU,EAAE,CAAC;QACjE,IAAI,CAAC,0FAA0F,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,IAAyB,CAAA;AAClC,CAAC;AAED;4EAC4E;AAC5E,KAAK,UAAU,cAAc,CAAI,KAAa,EAAE,MAAmB,EAAE,SAA2B;IAC9F,IAAI,CAAC;QAAC,OAAO,MAAM,SAAS,EAAE,CAAA;IAAC,CAAC;IAChC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,8BAA8B,IAAI,KAAK,YAAY,+BAA+B;YAAE,MAAM,KAAK,CAAA;QACpH,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAA;QAC/B,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,MAAM,OAAO,GAAI,KAAe,CAAC,OAAO,IAAI,EAAE,CAAA;QAC9C,IAAI,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,qCAAqC,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;QACpF,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAA;AAClH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAmC;IACjE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;WACvF,KAAK,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC;WAC3D,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACzF,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAmC,EAAE,KAAa,EAC9E,UAA8C,EAAE,WAA+B,EAC/E,IAAuB,EAAE,MAAmB;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACrH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IAC1H,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,EAAE;WACzD,MAAM,CAAC,OAAO,CAAC,KAAK,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc;WACtG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WACtE,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU;WAClG,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACjG,MAAM,aAAa,GAAG,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAC5D,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,mCAAmC,EAAE,MAAM,EACjF,GAAG,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IACjG,IAAI,OAAO,CAAC,uBAAuB,KAAK,aAAa;WAChD,OAAO,CAAC,oBAAoB,KAAK,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;WAClE,OAAO,CAAC,mBAAmB,KAAK,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;WAChE,OAAO,CAAC,kBAAkB,KAAK,UAAU,CAAC,iBAAiB;WAC3D,OAAO,CAAC,kBAAkB,KAAK,aAAa;WAC5C,OAAO,CAAC,iBAAiB,KAAK,UAAU,CAAC,iBAAiB;WAC1D,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;WAC3D,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,gCAAgC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,iFAAiF,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA;AACzB,CAAC;AAED;0EAC0E;AAC1E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAAmC;IAE/F,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;IAC/D,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACrF,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9G,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,CAAA;IACrE,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,OAAiD,CAAA;IACrD,IAAI,CAAC;QACH,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,kCAAkC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,gCAAgC,CAAC;YACzH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM;YAC5E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/F,CAAC,CAAC,CAAA;QACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9D,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACzG,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,gCAAgC,EAAE,MAAM,EAC9E,GAAG,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QAC5G,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,4CAA4C,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3G,MAAM,aAAa,GAAG,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;eACpD,UAAU,CAAC,iBAAiB,KAAK,aAAa;YAAE,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACxH,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,OAAO,GAAmC;YAC9C,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YAClF,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YACjF,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,kBAAkB,EAAE,UAAU,CAAC,iBAAiB;YACnF,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;YAC/C,cAAc,EAAE,IAAI,CAAC,gCAAgC,CAAC,UAAU,CAAC;YACjE,uBAAuB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;YAC/F,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;SACtD,CAAA;QACD,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QACtF,MAAM,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EACnD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9E,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;mBACnF,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC;gBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACzH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;AACjG,CAAC;AAED;;2EAE2E;AAC3E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAAmC;IAE5F,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACpG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAA;IAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACrD,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM;KAC7E,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9D,OAAO,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AAClF,CAAC"}

package/lib/rsi-linux-native-materialize.d.ts

@@ -0,0 +1,31 @@
+import type { RsiLinuxSourceBuildPreparation } from './rsi-linux-source-build.js';
+import { type LinuxRsiNativeRelocatedFamily, type LinuxRsiNativeRelocationProof } from './rsi-linux-native-relocation.js';
+export interface LinuxRsiNativeMaterializeInput {
+    /** Home holding the freshly prepared candidate families. */
+    candidateHome: string;
+    /** Private staged Home that will be renamed onto `logicalHome` later. */
+    stagePhysicalHome: string;
+    /** Absolute path the staged Home will occupy after the cutover. */
+    logicalHome: string;
+    /** Set when that path is already occupied by the live Home being cut over
+     * in place (the Docker -> Linux-native staging case). It must equal
+     * `logicalHome`; the relocation then stages beside the live Home instead of
+     * refusing an occupied logical Home. Replay ignores it. */
+    existingLogicalHome?: string;
+    profile: string;
+    /** Sealed proof from an earlier run over the same Homes, when replaying. */
+    relocation?: LinuxRsiNativeRelocationProof;
+    signal?: AbortSignal;
+}
+export interface LinuxRsiNativeMaterializeOutput {
+    relocation: LinuxRsiNativeRelocationProof;
+    family: LinuxRsiNativeRelocatedFamily;
+    sourceBuild: RsiLinuxSourceBuildPreparation;
+    /** Digest of the candidate Home's creation receipt, for equality with the
+     * digest the owner-program preparation recorded. */
+    candidateReceiptSha256: string;
+    /** Digest of the staged creation receipt, recorded in the transaction. */
+    receiptSha256: string;
+}
+export declare function materializeLinuxRsiNativeInStage(input: LinuxRsiNativeMaterializeInput): Promise<LinuxRsiNativeMaterializeOutput>;
+//# sourceMappingURL=rsi-linux-native-materialize.d.ts.map

package/lib/rsi-linux-native-materialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-materialize.d.ts","sourceRoot":"","sources":["../src/rsi-linux-native-materialize.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,EAEL,KAAK,6BAA6B,EAAE,KAAK,6BAA6B,EACvE,MAAM,kCAAkC,CAAA;AAmHzC,MAAM,WAAW,8BAA8B;IAC7C,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAA;IACzB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB;;;+DAG2D;IAC3D,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,UAAU,CAAC,EAAE,6BAA6B,CAAA;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,6BAA6B,CAAA;IACzC,MAAM,EAAE,6BAA6B,CAAA;IACrC,WAAW,EAAE,8BAA8B,CAAA;IAC3C;wDACoD;IACpD,sBAAsB,EAAE,MAAM,CAAA;IAC9B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CA8BjF"}

package/lib/rsi-linux-native-materialize.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { openLinuxRsiNativeRelocatedFamily, relocateLinuxRsiNativeFamily, } from './rsi-linux-native-relocation.js';
+/** Compose the relocation primitive into the stage seam the owner-program
+ * transaction needs: move the five Linux-native families from a candidate Home
+ * into the staged Home, then hand back the typed build environments, the
+ * prepared source build and the creation-receipt digests the caller compares
+ * against the candidate preparation.
+ *
+ * This runs strictly before the rename(2) cutover, so it never calls the stock
+ * readers (`readLinuxRsiRuntime`, `readLinuxRsiRepositoryRuntime`,
+ * `readLinuxRsiCreationBuildEnvironment`, `readRsiReleaseBuildEnvironment`):
+ * they probe the host or the logical Home and only accept a Home at its final
+ * path. The relocation proof itself is the pre-cutover acceptance gate; the
+ * stock readers remain the post-cutover acceptance test.
+ *
+ * The seam is replayable. A caller that already relocated this pair of Homes in
+ * an earlier process passes the sealed proof back in; the proof is re-verified
+ * against the staged Home instead of relocating a second time (a second
+ * relocation would fail on the existing destinations).
+ *
+ * When the caller is staging an in-place cutover, the logical Home is the live
+ * Home and already exists; `existingLogicalHome` attests that fact so the
+ * relocation stages beside it instead of refusing an occupied Home. The staged
+ * receipts still record the logical Home and the sealed proof is unchanged.
+ *
+ * It never cleans up. On any failure — including a crash or abort after the
+ * first copy — the staged Home holds an unsealed partial relocation and the
+ * sealed proof is gone, so a retry without that proof fails closed on the
+ * occupied destinations. The caller owns `stagePhysicalHome` as a disposable
+ * directory and must delete and recreate it before retrying. */
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const MAX_RECEIPT_BYTES = 4 * 1024 * 1024;
+const stamp = (info) => JSON.stringify([info.dev, info.ino, info.uid, info.mode, info.size,
+    info.mtimeMs, info.ctimeMs]);
+function fail(message) { throw new Error(`rsi Linux native materialize: ${message}`); }
+function sha256(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function canonicalHome(value, name) {
+    if (typeof value !== 'string' || !isAbsolute(value) || value !== resolve(value) || value === '/'
+        || [...value].some(character => character.charCodeAt(0) < 32))
+        fail(`invalid ${name}`);
+    return value;
+}
+function overlap(first, second) {
+    return first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+}
+function identity(input) {
+    const candidateHome = canonicalHome(input.candidateHome, 'candidate Home');
+    const stagePhysicalHome = canonicalHome(input.stagePhysicalHome, 'staged Home');
+    const logicalHome = canonicalHome(input.logicalHome, 'logical Home');
+    if (input.existingLogicalHome !== undefined) {
+        canonicalHome(input.existingLogicalHome, 'existing logical Home');
+        if (input.existingLogicalHome !== logicalHome)
+            fail('existing logical Home is not this logical Home');
+    }
+    if (typeof input.profile !== 'string' || !PROFILE.test(input.profile))
+        fail('invalid profile');
+    if (overlap(candidateHome, stagePhysicalHome) || overlap(candidateHome, logicalHome)
+        || overlap(stagePhysicalHome, logicalHome))
+        fail('candidate, staged and logical Homes must be disjoint');
+}
+/** Read one receipt exactly once, requiring the same owner-private, single-link,
+ * no-symlink shape the stock readers accept. Hashing and parsing the same buffer
+ * keeps the recorded digest bound to the parsed program identity. */
+async function readReceipt(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            fail(`missing creation receipt: ${path}`);
+        throw error;
+    }
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_RECEIPT_BYTES
+        || info.uid !== process.getuid?.() || info.mode & 0o077 || info.size === 0) {
+        fail(`unsafe creation receipt: ${path}`);
+    }
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        if (stamp(await fd.stat()) !== stamp(info))
+            fail(`creation receipt changed: ${path}`);
+        const bytes = await fd.readFile();
+        if (bytes.byteLength !== info.size || stamp(await fd.stat()) !== stamp(info)
+            || stamp(await lstat(path)) !== stamp(info))
+            fail(`creation receipt changed: ${path}`);
+        return { path, bytes, sha256: sha256(bytes) };
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function receiptSha256(path) { return (await readReceipt(path)).sha256; }
+/** The candidate receipt names the program being staged; reject a mismatch
+ * before spending minutes on the relocation copy. */
+function candidateReceipt(bytes, path, home, profile) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(bytes).toString('utf8'));
+    }
+    catch {
+        fail(`invalid creation receipt: ${path}`);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        fail(`invalid creation receipt: ${path}`);
+    const receipt = parsed;
+    if (receipt.schemaVersion !== 3 || receipt.backend !== 'linux-native'
+        || receipt.dshHome !== home || receipt.profile !== profile)
+        fail(`candidate creation receipt differs: ${path}`);
+}
+async function readCandidateReceipt(home, profile) {
+    const path = join(home, 'rsi-linux-creation-builds', profile, 'bootstrap.json');
+    const receipt = await readReceipt(path);
+    candidateReceipt(receipt.bytes, path, home, profile);
+    const record = JSON.parse(Buffer.from(receipt.bytes).toString('utf8'));
+    if (typeof record.sourceCommit !== 'string' || !COMMIT.test(record.sourceCommit)) {
+        fail(`candidate creation receipt lacks a source commit: ${path}`);
+    }
+    return { path, sha256: receipt.sha256, sourceCommit: record.sourceCommit };
+}
+export async function materializeLinuxRsiNativeInStage(input) {
+    identity(input);
+    input.signal?.throwIfAborted();
+    const { candidateHome, stagePhysicalHome, logicalHome, profile } = input;
+    const candidate = await readCandidateReceipt(candidateHome, profile);
+    input.signal?.throwIfAborted();
+    let relocation = input.relocation;
+    if (relocation === undefined) {
+        relocation = await relocateLinuxRsiNativeFamily({ sourceHome: candidateHome, physicalHome: stagePhysicalHome,
+            logicalHome, profile, ...(input.existingLogicalHome === undefined
+                ? {} : { existingLogicalHome: input.existingLogicalHome }),
+            ...(input.signal === undefined ? {} : { signal: input.signal }) });
+    }
+    else {
+        proofIdentity(relocation, input);
+    }
+    const family = await openLinuxRsiNativeRelocatedFamily(relocation);
+    input.signal?.throwIfAborted();
+    if (family.runtime.sourceCommit !== candidate.sourceCommit)
+        fail('staged program differs from candidate');
+    const receipt = await receiptSha256(join(stagePhysicalHome, 'rsi-linux-creation-builds', profile, 'bootstrap.json'));
+    return {
+        relocation,
+        family,
+        sourceBuild: { backend: 'linux-native', repository: family.repository, cgroupRoots: family.creationBuild.cgroupRoots },
+        candidateReceiptSha256: candidate.sha256,
+        receiptSha256: receipt,
+    };
+}
+function proofIdentity(proof, input) {
+    const record = proof;
+    if (record.schemaVersion !== 1 || record.backend !== 'linux-native')
+        fail('invalid replay relocation proof');
+    if (record.sourceHome !== input.candidateHome || record.physicalHome !== input.stagePhysicalHome
+        || record.logicalHome !== input.logicalHome || record.profile !== input.profile) {
+        fail('replay relocation proof does not describe this Home pair');
+    }
+}
+//# sourceMappingURL=rsi-linux-native-materialize.js.map

package/lib/rsi-linux-native-materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-materialize.js","sourceRoot":"","sources":["../src/rsi-linux-native-materialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGrD,OAAO,EACL,iCAAiC,EAAE,4BAA4B,GAEhE,MAAM,kCAAkC,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;gEA2BgE;AAEhE,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,KAAK,GAAG,CAAC,IAAW,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;IACvG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAE9B,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAErG,SAAS,MAAM,CAAC,KAAiB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAEtG,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG;WAC3F,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAqC;IACrD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IAC1E,MAAM,iBAAiB,GAAG,aAAa,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;IAC/E,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,aAAa,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;QACjE,IAAI,KAAK,CAAC,mBAAmB,KAAK,WAAW;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACvG,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC9F,IAAI,OAAO,CAAC,aAAa,EAAE,iBAAiB,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;WAC/E,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC;QAAE,IAAI,CAAC,sDAAsD,CAAC,CAAA;AAC5G,CAAC;AAID;;qEAEqE;AACrE,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC9C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACjG,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,iBAAiB;WAC3F,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACrF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAA;QACjC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;eACvE,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,IAAqB,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA,CAAC,CAAC;AAEvG;qDACqD;AACrD,SAAS,gBAAgB,CAAC,KAAiB,EAAE,IAAY,EAAE,IAAY,EAAE,OAAe;IACtF,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;IACpH,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IACrH,MAAM,OAAO,GAAG,MAAiC,CAAA;IACjD,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc;WAChE,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;AACnH,CAAC;AAID,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;IACvC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACjG,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAA;AAC5E,CAAC;AA+BD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACf,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAExE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACpE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAE9B,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB;YAC1G,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBAC/D,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,UAAU,CAAC,CAAA;IAClE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAEzG,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACpH,OAAO;QACL,UAAU;QACV,MAAM;QACN,WAAW,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;QACtH,sBAAsB,EAAE,SAAS,CAAC,MAAM;QACxC,aAAa,EAAE,OAAO;KACvB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAoC,EAAE,KAAqC;IAChG,MAAM,MAAM,GAAG,KAA2C,CAAA;IAC1D,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC5G,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,iBAAiB;WAC3F,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAClF,IAAI,CAAC,0DAA0D,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/lib/rsi-linux-native-relocation.d.ts

@@ -0,0 +1,120 @@
+import type { LinuxPluginBehaviorRuntime } from '@dsh-enhanced/assistant-verifier/linux-behavior-runtime';
+import type { LinuxRsiCreationBuildEnvironment } from './rsi-linux-creation-build.js';
+import type { LinuxRsiRepositoryBuildEnvironment } from './rsi-linux-repository-bootstrap.js';
+import type { LinuxRsiBuildEnvironment } from './rsi-linux-runtime-bootstrap.js';
+import type { NativeRsiReleaseBuildEnvironment } from './rsi-release-build.js';
+/** Receipt-relocation primitive for moving one prepared Linux-native DSH Home
+ * from a Docker volume onto a native filesystem without re-preparing it.
+ * Source receipts are authenticated before any byte is copied; the copied
+ * trees and the rewritten receipts are bound together in a sealed proof whose
+ * logical paths survive the later same-filesystem rename(2). */
+export interface LinuxRsiNativeRelocationInput {
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    profile: string;
+    /** Attests that `logicalHome` is the live Home already occupying its final
+     * path (the in-place Docker -> Linux-native cutover case). It must be the
+     * exact `logicalHome` value and resolve to itself; it then substitutes for
+     * the "logical Home already exists" refusal instead of weakening any other
+     * check, and the relocated receipts still record the logical Home. */
+    existingLogicalHome?: string;
+    signal?: AbortSignal;
+}
+export interface LinuxRsiNativeRelocationElement {
+    name: 'runtime' | 'repository-runtime' | 'system' | 'behavior-runtime' | 'release-toolchain' | 'release-store' | 'release-cache';
+    logicalPath: string;
+    physicalPath: string;
+    dev: number;
+    ino: number;
+    sha256: string;
+    entries: number;
+    bytes: number;
+}
+export interface LinuxRsiNativeRelocationProof {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    profile: string;
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    behaviorRootRelative: string;
+    elements: LinuxRsiNativeRelocationElement[];
+    digests: {
+        runtime: string;
+        repository: string;
+        behavior: string;
+        creation: string;
+        release: string;
+        relocation: string;
+    };
+}
+/** Relocate one prepared Linux-native DSH Home onto a fresh physical Home.
+ * The source is authenticated before copying and never modified. An
+ * `existingLogicalHome` attestation only replaces the "logical Home already
+ * exists" refusal; every other check and the proof shape stay the same. */
+export declare function relocateLinuxRsiNativeFamily(input: LinuxRsiNativeRelocationInput): Promise<LinuxRsiNativeRelocationProof>;
+/** Re-derive a relocation proof from its physical Home without ever reading the
+ * logical Home; the proof must still describe a byte-identical, un-opened copy. */
+export declare function verifyLinuxRsiNativeRelocation(proof: LinuxRsiNativeRelocationProof): Promise<void>;
+/** The prepared families a verified relocation proof stands for, projected back
+ * into their typed build-environment shapes. Callers get the same values the
+ * stock readers would produce after the rename(2) cutover, without any host
+ * probe or logical-Home read (both are only valid post-cutover). */
+export interface LinuxRsiNativeRelocatedFamily {
+    runtime: LinuxRsiBuildEnvironment;
+    repository: LinuxRsiRepositoryBuildEnvironment;
+    behavior: LinuxPluginBehaviorRuntime;
+    creationBuild: LinuxRsiCreationBuildEnvironment;
+    release: NativeRsiReleaseBuildEnvironment;
+}
+/** Verify a relocation proof and return its typed families in one pass, so the
+ * ~585 MB release trees are hashed once instead of twice. */
+export declare function openLinuxRsiNativeRelocatedFamily(proof: LinuxRsiNativeRelocationProof): Promise<LinuxRsiNativeRelocatedFamily>;
+/** Re-open a verified relocation at another physical Home; callers may only
+ * supply the proof's own physical Home or its logical Home.
+ *
+ * The one supported case is the rename(2) cutover: `rename` preserves dev/ino,
+ * so the staged trees keep their sealed content identity while their paths move
+ * under the live Home. Receipts record logical paths, so only the element and
+ * receipt roots change; the proof itself stays the sealed staged record and is
+ * never rewritten. */
+export declare function openLinuxRsiNativeRelocatedFamilyAt(proof: LinuxRsiNativeRelocationProof, physicalHome: string): Promise<LinuxRsiNativeRelocatedFamily>;
+/** A resource-only proof; this neither establishes pre-owner eligibility nor
+ * reads, creates or migrates owner authority. The outer installer owns that gate. */
+type BaseElementName = 'runtime' | 'release-toolchain' | 'release-store' | 'release-cache';
+export interface LinuxRsiNativeBaseRelocationProof {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    purpose: 'pre-owner-base';
+    profile: string;
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    elements: (Omit<LinuxRsiNativeRelocationElement, 'name'> & {
+        name: BaseElementName;
+    })[];
+    digests: {
+        runtime: string;
+        release: string;
+        relocation: string;
+    };
+}
+export interface LinuxRsiNativeRelocatedBase {
+    runtime: LinuxRsiBuildEnvironment;
+    release: NativeRsiReleaseBuildEnvironment;
+}
+/** Read existing receipts through their canonical logical Home spelling. Only
+ * same-inode moves are supported: ordinary copied runtime roots fail dev/ino.
+ * Release schema 2 carries content pins, not historical root inode fields. */
+export declare function inspectLinuxRsiNativeBaseAt(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function openLinuxRsiNativeRelocatedBase(proof: LinuxRsiNativeBaseRelocationProof): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function openLinuxRsiNativeRelocatedBaseAt(proof: LinuxRsiNativeBaseRelocationProof, physicalHome: string): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function relocateLinuxRsiNativeBase(input: LinuxRsiNativeRelocationInput): Promise<LinuxRsiNativeBaseRelocationProof>;
+export {};
+//# sourceMappingURL=rsi-linux-native-relocation.d.ts.map

package/lib/rsi-linux-native-relocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-relocation.d.ts","sourceRoot":"","sources":["../src/rsi-linux-native-relocation.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yDAAyD,CAAA;AAEzG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAA;AACrF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAA;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAChF,OAAO,KAAK,EAAE,gCAAgC,EAAyB,MAAM,wBAAwB,CAAA;AAErG;;;;gEAIgE;AAEhE,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf;;;;0EAIsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,SAAS,GAAG,oBAAoB,GAAG,QAAQ,GAAG,kBAAkB,GAClE,mBAAmB,GAAG,eAAe,GAAG,eAAe,CAAA;IAC3D,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,QAAQ,EAAE,+BAA+B,EAAE,CAAA;IAC3C,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;QACxF,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAo0BD;;;2EAG2E;AAC3E,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAuJ9E;AAkPD;mFACmF;AACnF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAExG;AAED;;;oEAGoE;AACpE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,wBAAwB,CAAA;IACjC,UAAU,EAAE,kCAAkC,CAAA;IAC9C,QAAQ,EAAE,0BAA0B,CAAA;IACpC,aAAa,EAAE,gCAAgC,CAAA;IAC/C,OAAO,EAAE,gCAAgC,CAAA;CAC1C;AAuCD;6DAC6D;AAC7D,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAa9E;AAED;;;;;;;sBAOsB;AACtB,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,6BAA6B,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAsBpG;AAED;qFACqF;AACrF,KAAK,eAAe,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,GAAG,eAAe,CAAA;AAC1F,MAAM,WAAW,iCAAiC;IAChD,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,gBAAgB,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,EAAE,CAAA;IACvF,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE;AACD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,wBAAwB,CAAA;IACjC,OAAO,EAAE,gCAAgC,CAAA;CAC1C;AAiGD;;8EAE8E;AAC9E,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAOvC;AAkED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAGpI;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,iCAAiC,EAC9F,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAI5D;AA4BD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CA8CjI"}