@dsh-enhanced/lark-channel 0.1.65 → 0.1.66

package/lib/rsi-linux-native-materialize.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { openLinuxRsiNativeRelocatedFamily, relocateLinuxRsiNativeFamily, } from './rsi-linux-native-relocation.js';
+/** Compose the relocation primitive into the stage seam the owner-program
+ * transaction needs: move the five Linux-native families from a candidate Home
+ * into the staged Home, then hand back the typed build environments, the
+ * prepared source build and the creation-receipt digests the caller compares
+ * against the candidate preparation.
+ *
+ * This runs strictly before the rename(2) cutover, so it never calls the stock
+ * readers (`readLinuxRsiRuntime`, `readLinuxRsiRepositoryRuntime`,
+ * `readLinuxRsiCreationBuildEnvironment`, `readRsiReleaseBuildEnvironment`):
+ * they probe the host or the logical Home and only accept a Home at its final
+ * path. The relocation proof itself is the pre-cutover acceptance gate; the
+ * stock readers remain the post-cutover acceptance test.
+ *
+ * The seam is replayable. A caller that already relocated this pair of Homes in
+ * an earlier process passes the sealed proof back in; the proof is re-verified
+ * against the staged Home instead of relocating a second time (a second
+ * relocation would fail on the existing destinations).
+ *
+ * When the caller is staging an in-place cutover, the logical Home is the live
+ * Home and already exists; `existingLogicalHome` attests that fact so the
+ * relocation stages beside it instead of refusing an occupied Home. The staged
+ * receipts still record the logical Home and the sealed proof is unchanged.
+ *
+ * It never cleans up. On any failure — including a crash or abort after the
+ * first copy — the staged Home holds an unsealed partial relocation and the
+ * sealed proof is gone, so a retry without that proof fails closed on the
+ * occupied destinations. The caller owns `stagePhysicalHome` as a disposable
+ * directory and must delete and recreate it before retrying. */
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const MAX_RECEIPT_BYTES = 4 * 1024 * 1024;
+const stamp = (info) => JSON.stringify([info.dev, info.ino, info.uid, info.mode, info.size,
+    info.mtimeMs, info.ctimeMs]);
+function fail(message) { throw new Error(`rsi Linux native materialize: ${message}`); }
+function sha256(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+function canonicalHome(value, name) {
+    if (typeof value !== 'string' || !isAbsolute(value) || value !== resolve(value) || value === '/'
+        || [...value].some(character => character.charCodeAt(0) < 32))
+        fail(`invalid ${name}`);
+    return value;
+}
+function overlap(first, second) {
+    return first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+}
+function identity(input) {
+    const candidateHome = canonicalHome(input.candidateHome, 'candidate Home');
+    const stagePhysicalHome = canonicalHome(input.stagePhysicalHome, 'staged Home');
+    const logicalHome = canonicalHome(input.logicalHome, 'logical Home');
+    if (input.existingLogicalHome !== undefined) {
+        canonicalHome(input.existingLogicalHome, 'existing logical Home');
+        if (input.existingLogicalHome !== logicalHome)
+            fail('existing logical Home is not this logical Home');
+    }
+    if (typeof input.profile !== 'string' || !PROFILE.test(input.profile))
+        fail('invalid profile');
+    if (overlap(candidateHome, stagePhysicalHome) || overlap(candidateHome, logicalHome)
+        || overlap(stagePhysicalHome, logicalHome))
+        fail('candidate, staged and logical Homes must be disjoint');
+}
+/** Read one receipt exactly once, requiring the same owner-private, single-link,
+ * no-symlink shape the stock readers accept. Hashing and parsing the same buffer
+ * keeps the recorded digest bound to the parsed program identity. */
+async function readReceipt(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            fail(`missing creation receipt: ${path}`);
+        throw error;
+    }
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_RECEIPT_BYTES
+        || info.uid !== process.getuid?.() || info.mode & 0o077 || info.size === 0) {
+        fail(`unsafe creation receipt: ${path}`);
+    }
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        if (stamp(await fd.stat()) !== stamp(info))
+            fail(`creation receipt changed: ${path}`);
+        const bytes = await fd.readFile();
+        if (bytes.byteLength !== info.size || stamp(await fd.stat()) !== stamp(info)
+            || stamp(await lstat(path)) !== stamp(info))
+            fail(`creation receipt changed: ${path}`);
+        return { path, bytes, sha256: sha256(bytes) };
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function receiptSha256(path) { return (await readReceipt(path)).sha256; }
+/** The candidate receipt names the program being staged; reject a mismatch
+ * before spending minutes on the relocation copy. */
+function candidateReceipt(bytes, path, home, profile) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(bytes).toString('utf8'));
+    }
+    catch {
+        fail(`invalid creation receipt: ${path}`);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        fail(`invalid creation receipt: ${path}`);
+    const receipt = parsed;
+    if (receipt.schemaVersion !== 3 || receipt.backend !== 'linux-native'
+        || receipt.dshHome !== home || receipt.profile !== profile)
+        fail(`candidate creation receipt differs: ${path}`);
+}
+async function readCandidateReceipt(home, profile) {
+    const path = join(home, 'rsi-linux-creation-builds', profile, 'bootstrap.json');
+    const receipt = await readReceipt(path);
+    candidateReceipt(receipt.bytes, path, home, profile);
+    const record = JSON.parse(Buffer.from(receipt.bytes).toString('utf8'));
+    if (typeof record.sourceCommit !== 'string' || !COMMIT.test(record.sourceCommit)) {
+        fail(`candidate creation receipt lacks a source commit: ${path}`);
+    }
+    return { path, sha256: receipt.sha256, sourceCommit: record.sourceCommit };
+}
+export async function materializeLinuxRsiNativeInStage(input) {
+    identity(input);
+    input.signal?.throwIfAborted();
+    const { candidateHome, stagePhysicalHome, logicalHome, profile } = input;
+    const candidate = await readCandidateReceipt(candidateHome, profile);
+    input.signal?.throwIfAborted();
+    let relocation = input.relocation;
+    if (relocation === undefined) {
+        relocation = await relocateLinuxRsiNativeFamily({ sourceHome: candidateHome, physicalHome: stagePhysicalHome,
+            logicalHome, profile, ...(input.existingLogicalHome === undefined
+                ? {} : { existingLogicalHome: input.existingLogicalHome }),
+            ...(input.signal === undefined ? {} : { signal: input.signal }) });
+    }
+    else {
+        proofIdentity(relocation, input);
+    }
+    const family = await openLinuxRsiNativeRelocatedFamily(relocation);
+    input.signal?.throwIfAborted();
+    if (family.runtime.sourceCommit !== candidate.sourceCommit)
+        fail('staged program differs from candidate');
+    const receipt = await receiptSha256(join(stagePhysicalHome, 'rsi-linux-creation-builds', profile, 'bootstrap.json'));
+    return {
+        relocation,
+        family,
+        sourceBuild: { backend: 'linux-native', repository: family.repository, cgroupRoots: family.creationBuild.cgroupRoots },
+        candidateReceiptSha256: candidate.sha256,
+        receiptSha256: receipt,
+    };
+}
+function proofIdentity(proof, input) {
+    const record = proof;
+    if (record.schemaVersion !== 1 || record.backend !== 'linux-native')
+        fail('invalid replay relocation proof');
+    if (record.sourceHome !== input.candidateHome || record.physicalHome !== input.stagePhysicalHome
+        || record.logicalHome !== input.logicalHome || record.profile !== input.profile) {
+        fail('replay relocation proof does not describe this Home pair');
+    }
+}
+//# sourceMappingURL=rsi-linux-native-materialize.js.map

package/lib/rsi-linux-native-materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-materialize.js","sourceRoot":"","sources":["../src/rsi-linux-native-materialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGrD,OAAO,EACL,iCAAiC,EAAE,4BAA4B,GAEhE,MAAM,kCAAkC,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;gEA2BgE;AAEhE,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,KAAK,GAAG,CAAC,IAAW,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;IACvG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAE9B,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAErG,SAAS,MAAM,CAAC,KAAiB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAEtG,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG;WAC3F,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAqC;IACrD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IAC1E,MAAM,iBAAiB,GAAG,aAAa,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;IAC/E,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,aAAa,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;QACjE,IAAI,KAAK,CAAC,mBAAmB,KAAK,WAAW;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACvG,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC9F,IAAI,OAAO,CAAC,aAAa,EAAE,iBAAiB,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;WAC/E,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC;QAAE,IAAI,CAAC,sDAAsD,CAAC,CAAA;AAC5G,CAAC;AAID;;qEAEqE;AACrE,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC9C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACjG,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,iBAAiB;WAC3F,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACrF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAA;QACjC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;eACvE,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,IAAqB,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA,CAAC,CAAC;AAEvG;qDACqD;AACrD,SAAS,gBAAgB,CAAC,KAAiB,EAAE,IAAY,EAAE,IAAY,EAAE,OAAe;IACtF,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;IACpH,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IACrH,MAAM,OAAO,GAAG,MAAiC,CAAA;IACjD,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc;WAChE,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;AACnH,CAAC;AAID,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;IACvC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACjG,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAA;AAC5E,CAAC;AA+BD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACf,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAExE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACpE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAE9B,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB;YAC1G,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBAC/D,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,UAAU,CAAC,CAAA;IAClE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAEzG,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACpH,OAAO;QACL,UAAU;QACV,MAAM;QACN,WAAW,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;QACtH,sBAAsB,EAAE,SAAS,CAAC,MAAM;QACxC,aAAa,EAAE,OAAO;KACvB,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAoC,EAAE,KAAqC;IAChG,MAAM,MAAM,GAAG,KAA2C,CAAA;IAC1D,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC5G,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,iBAAiB;WAC3F,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAClF,IAAI,CAAC,0DAA0D,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/lib/rsi-linux-native-relocation.d.ts

@@ -0,0 +1,120 @@
+import type { LinuxPluginBehaviorRuntime } from '@dsh-enhanced/assistant-verifier/linux-behavior-runtime';
+import type { LinuxRsiCreationBuildEnvironment } from './rsi-linux-creation-build.js';
+import type { LinuxRsiRepositoryBuildEnvironment } from './rsi-linux-repository-bootstrap.js';
+import type { LinuxRsiBuildEnvironment } from './rsi-linux-runtime-bootstrap.js';
+import type { NativeRsiReleaseBuildEnvironment } from './rsi-release-build.js';
+/** Receipt-relocation primitive for moving one prepared Linux-native DSH Home
+ * from a Docker volume onto a native filesystem without re-preparing it.
+ * Source receipts are authenticated before any byte is copied; the copied
+ * trees and the rewritten receipts are bound together in a sealed proof whose
+ * logical paths survive the later same-filesystem rename(2). */
+export interface LinuxRsiNativeRelocationInput {
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    profile: string;
+    /** Attests that `logicalHome` is the live Home already occupying its final
+     * path (the in-place Docker -> Linux-native cutover case). It must be the
+     * exact `logicalHome` value and resolve to itself; it then substitutes for
+     * the "logical Home already exists" refusal instead of weakening any other
+     * check, and the relocated receipts still record the logical Home. */
+    existingLogicalHome?: string;
+    signal?: AbortSignal;
+}
+export interface LinuxRsiNativeRelocationElement {
+    name: 'runtime' | 'repository-runtime' | 'system' | 'behavior-runtime' | 'release-toolchain' | 'release-store' | 'release-cache';
+    logicalPath: string;
+    physicalPath: string;
+    dev: number;
+    ino: number;
+    sha256: string;
+    entries: number;
+    bytes: number;
+}
+export interface LinuxRsiNativeRelocationProof {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    profile: string;
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    behaviorRootRelative: string;
+    elements: LinuxRsiNativeRelocationElement[];
+    digests: {
+        runtime: string;
+        repository: string;
+        behavior: string;
+        creation: string;
+        release: string;
+        relocation: string;
+    };
+}
+/** Relocate one prepared Linux-native DSH Home onto a fresh physical Home.
+ * The source is authenticated before copying and never modified. An
+ * `existingLogicalHome` attestation only replaces the "logical Home already
+ * exists" refusal; every other check and the proof shape stay the same. */
+export declare function relocateLinuxRsiNativeFamily(input: LinuxRsiNativeRelocationInput): Promise<LinuxRsiNativeRelocationProof>;
+/** Re-derive a relocation proof from its physical Home without ever reading the
+ * logical Home; the proof must still describe a byte-identical, un-opened copy. */
+export declare function verifyLinuxRsiNativeRelocation(proof: LinuxRsiNativeRelocationProof): Promise<void>;
+/** The prepared families a verified relocation proof stands for, projected back
+ * into their typed build-environment shapes. Callers get the same values the
+ * stock readers would produce after the rename(2) cutover, without any host
+ * probe or logical-Home read (both are only valid post-cutover). */
+export interface LinuxRsiNativeRelocatedFamily {
+    runtime: LinuxRsiBuildEnvironment;
+    repository: LinuxRsiRepositoryBuildEnvironment;
+    behavior: LinuxPluginBehaviorRuntime;
+    creationBuild: LinuxRsiCreationBuildEnvironment;
+    release: NativeRsiReleaseBuildEnvironment;
+}
+/** Verify a relocation proof and return its typed families in one pass, so the
+ * ~585 MB release trees are hashed once instead of twice. */
+export declare function openLinuxRsiNativeRelocatedFamily(proof: LinuxRsiNativeRelocationProof): Promise<LinuxRsiNativeRelocatedFamily>;
+/** Re-open a verified relocation at another physical Home; callers may only
+ * supply the proof's own physical Home or its logical Home.
+ *
+ * The one supported case is the rename(2) cutover: `rename` preserves dev/ino,
+ * so the staged trees keep their sealed content identity while their paths move
+ * under the live Home. Receipts record logical paths, so only the element and
+ * receipt roots change; the proof itself stays the sealed staged record and is
+ * never rewritten. */
+export declare function openLinuxRsiNativeRelocatedFamilyAt(proof: LinuxRsiNativeRelocationProof, physicalHome: string): Promise<LinuxRsiNativeRelocatedFamily>;
+/** A resource-only proof; this neither establishes pre-owner eligibility nor
+ * reads, creates or migrates owner authority. The outer installer owns that gate. */
+type BaseElementName = 'runtime' | 'release-toolchain' | 'release-store' | 'release-cache';
+export interface LinuxRsiNativeBaseRelocationProof {
+    schemaVersion: 1;
+    backend: 'linux-native';
+    purpose: 'pre-owner-base';
+    profile: string;
+    sourceHome: string;
+    physicalHome: string;
+    logicalHome: string;
+    elements: (Omit<LinuxRsiNativeRelocationElement, 'name'> & {
+        name: BaseElementName;
+    })[];
+    digests: {
+        runtime: string;
+        release: string;
+        relocation: string;
+    };
+}
+export interface LinuxRsiNativeRelocatedBase {
+    runtime: LinuxRsiBuildEnvironment;
+    release: NativeRsiReleaseBuildEnvironment;
+}
+/** Read existing receipts through their canonical logical Home spelling. Only
+ * same-inode moves are supported: ordinary copied runtime roots fail dev/ino.
+ * Release schema 2 carries content pins, not historical root inode fields. */
+export declare function inspectLinuxRsiNativeBaseAt(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function openLinuxRsiNativeRelocatedBase(proof: LinuxRsiNativeBaseRelocationProof): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function openLinuxRsiNativeRelocatedBaseAt(proof: LinuxRsiNativeBaseRelocationProof, physicalHome: string): Promise<LinuxRsiNativeRelocatedBase>;
+export declare function relocateLinuxRsiNativeBase(input: LinuxRsiNativeRelocationInput): Promise<LinuxRsiNativeBaseRelocationProof>;
+export {};
+//# sourceMappingURL=rsi-linux-native-relocation.d.ts.map

package/lib/rsi-linux-native-relocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-relocation.d.ts","sourceRoot":"","sources":["../src/rsi-linux-native-relocation.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yDAAyD,CAAA;AAEzG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAA;AACrF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAA;AAC7F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAChF,OAAO,KAAK,EAAE,gCAAgC,EAAyB,MAAM,wBAAwB,CAAA;AAErG;;;;gEAIgE;AAEhE,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf;;;;0EAIsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,SAAS,GAAG,oBAAoB,GAAG,QAAQ,GAAG,kBAAkB,GAClE,mBAAmB,GAAG,eAAe,GAAG,eAAe,CAAA;IAC3D,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,QAAQ,EAAE,+BAA+B,EAAE,CAAA;IAC3C,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;QACxF,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAo0BD;;;2EAG2E;AAC3E,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAuJ9E;AAkPD;mFACmF;AACnF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAExG;AAED;;;oEAGoE;AACpE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,wBAAwB,CAAA;IACjC,UAAU,EAAE,kCAAkC,CAAA;IAC9C,QAAQ,EAAE,0BAA0B,CAAA;IACpC,aAAa,EAAE,gCAAgC,CAAA;IAC/C,OAAO,EAAE,gCAAgC,CAAA;CAC1C;AAuCD;6DAC6D;AAC7D,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAa9E;AAED;;;;;;;sBAOsB;AACtB,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,6BAA6B,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAsBpG;AAED;qFACqF;AACrF,KAAK,eAAe,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,GAAG,eAAe,CAAA;AAC1F,MAAM,WAAW,iCAAiC;IAChD,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,gBAAgB,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,EAAE,CAAA;IACvF,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE;AACD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,wBAAwB,CAAA;IACjC,OAAO,EAAE,gCAAgC,CAAA;CAC1C;AAiGD;;8EAE8E;AAC9E,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAOvC;AAkED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAGpI;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,iCAAiC,EAC9F,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAI5D;AA4BD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CA8CjI"}