@dsh-enhanced/lark-channel 0.1.65 → 0.1.67

package/lib/rsi-linux-native-resources.js

@@ -0,0 +1,521 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, cp, lstat, mkdir, readdir, readlink, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { migrateLinuxVerifierRunnerState, prepareLinuxRepositoryHandoverState, prepareLinuxVerifierHandoverState, prepareLinuxVerifierStagingState, } from '@dsh-enhanced/assistant-isolation';
+import { rsiBuildResources as io } from './rsi-build.js';
+import { readRsiLocalUpdateSourceBuild } from './rsi-local-update-build.js';
+import { readRsiSourceWorkspace } from './rsi-source.js';
+import { readRsiReleaseBuildEnvironment } from './rsi-release-build.js';
+import { readRsiLocalUpdateLocked } from './rsi-local-update.js';
+import { openLinuxRsiNativeRelocatedFamily, openLinuxRsiNativeRelocatedFamilyAt, relocateLinuxRsiNativeFamily, openLinuxRsiNativeRelocatedBase, openLinuxRsiNativeRelocatedBaseAt, relocateLinuxRsiNativeBase, inspectLinuxRsiNativeBaseAt, } from './rsi-linux-native-relocation.js';
+import { compileRsiLinuxSourceBuild } from './rsi-linux-source-build.js';
+import { prepareRsiLinuxRunnerStates, validateRsiLinuxRunnerStates } from './rsi-linux-runner-states.js';
+export { 
+// Reviewed installer seams of the linux-native owner program transaction,
+// re-exported here so the installer allowlist only needs this module name.
+compileRsiLinuxSourceBuild, migrateLinuxVerifierRunnerState, prepareLinuxRepositoryHandoverState, prepareLinuxVerifierHandoverState, prepareLinuxVerifierStagingState, prepareRsiLinuxRunnerStates, validateRsiLinuxRunnerStates, };
+export { freezeLinuxRuntimeSource } from '@dsh-enhanced/assistant-isolation/native-resources';
+export { openLinuxRsiNativeRelocatedBase, openLinuxRsiNativeRelocatedBaseAt, inspectLinuxRsiNativeBaseAt };
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const HEX = /^[a-f0-9]{64}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const COHORT = 'rsi-local-cohorts';
+const DOCKER_KINDS = ['rsi-builds', 'rsi-release-builds', 'rsi-creation-builds'];
+const MAX_ENTRIES = 150_000;
+const MAX_FILE_BYTES = 268_435_456;
+const MAX_TOTAL_BYTES = 4_294_967_296;
+const MAX_RECEIPT_BYTES = 20_971_520;
+function fail(message) { throw new Error(`rsi Linux native resources: ${message}`); }
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const exact = (path) => typeof path === 'string' && isAbsolute(path)
+    && resolve(path) === path && !path.includes('\0');
+const inside = (root, path) => path === root || path.startsWith(root + sep);
+/** Include modes and directories: matching file bytes alone cannot prove a
+ * copied toolchain has retained its executable and private-directory contract. */
+async function inventory(root, signal) {
+    let size = 0;
+    const entries = [];
+    const visit = async (path) => {
+        signal.throwIfAborted();
+        const item = await lstat(path);
+        if (entries.length >= MAX_ENTRIES || item.isSymbolicLink() || (item.mode & 0o077) !== 0
+            || process.getuid && item.uid !== process.getuid())
+            fail(`unsafe resource entry: ${path}`);
+        if (item.isDirectory()) {
+            await io.directory(path);
+            entries.push({ path: relative(root, path), mode: item.mode & 0o777, sha256: null });
+            for (const name of (await readdir(path)).sort())
+                await visit(join(path, name));
+        }
+        else if (item.isFile() && item.nlink === 1) {
+            size += item.size;
+            if (item.size > MAX_FILE_BYTES || size > MAX_TOTAL_BYTES)
+                fail('resource tree exceeds size bound');
+            entries.push({ path: relative(root, path), mode: item.mode & 0o777,
+                sha256: hash(await io.readStable(path, MAX_FILE_BYTES, true)) });
+        }
+        else
+            fail(`resource is not a private regular file or directory: ${path}`);
+    };
+    await visit(root);
+    return entries;
+}
+function receipt(bytes) {
+    const value = JSON.parse(bytes.toString('utf8'));
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        fail('invalid native resource receipt');
+    const record = value;
+    const { receiptDigest, ...body } = record;
+    if (receiptDigest !== hash(JSON.stringify(body)))
+        fail('native resource receipt digest differs');
+    return record;
+}
+function encode(body) { return JSON.stringify({ ...body, receiptDigest: hash(JSON.stringify(body)) }); }
+function nativeBuild(preparation) {
+    const build = preparation.build ?? fail('preparation has no candidate build evidence');
+    const sourceBuild = build.sourceBuild;
+    if (sourceBuild.schemaVersion !== 3 || sourceBuild.backend !== 'linux-native') {
+        fail('candidate build is not a Linux native runtime');
+    }
+    const releaseBuild = build.releaseBuild;
+    if (releaseBuild.schemaVersion !== 2 || releaseBuild.backend !== 'linux-native') {
+        fail('candidate release is not a Linux native release build');
+    }
+    if (releaseBuild.sourceCommit !== sourceBuild.sourceCommit)
+        fail('candidate release source differs');
+    return { sourceBuild, releaseBuild };
+}
+async function readPreparation(input) {
+    const { logicalHome, stagePhysicalHome, profile } = input;
+    if (!exact(logicalHome) || !exact(stagePhysicalHome) || !exact(input.preparationRoot) || !PROFILE.test(profile)
+        || stagePhysicalHome === logicalHome || inside(logicalHome, stagePhysicalHome)
+        || inside(stagePhysicalHome, logicalHome)
+        || await realpath(logicalHome) !== logicalHome || await realpath(stagePhysicalHome) !== stagePhysicalHome
+        || inside(input.preparationRoot, stagePhysicalHome) || inside(stagePhysicalHome, input.preparationRoot)) {
+        fail('stage must be a distinct canonical stopped Home outside the preparation root');
+    }
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(600_000)]);
+    await io.directory(stagePhysicalHome);
+    const prepared = await readRsiLocalUpdateLocked({ dshHome: logicalHome, profile, root: input.preparationRoot, signal });
+    nativeBuild(prepared);
+    return { prepared, signal };
+}
+/** Replace the stage Home's cohort tree with the prepared candidate cohort,
+ * rebased onto the logical Home so no receipt ever records a disposable path.
+ * Only `rsi-local-cohorts` changes; the live Home and the prepared candidate
+ * Home are verified unchanged immediately before the rename swap. */
+async function stageCohort(input) {
+    const { prepared, logicalHome, stagePhysicalHome, profile, signal } = input;
+    await io.directory(join(logicalHome, COHORT));
+    await io.directory(join(stagePhysicalHome, COHORT));
+    await io.directory(join(prepared.candidateHome, COHORT));
+    const original = await inventory(join(logicalHome, COHORT, profile), signal);
+    if (!isDeepStrictEqual(original, await inventory(join(stagePhysicalHome, COHORT, profile), signal))) {
+        fail('copied original cohort differs');
+    }
+    const candidate = await inventory(join(prepared.candidateHome, COHORT, profile), signal);
+    const cohortRoot = join(logicalHome, COHORT, profile);
+    const originalCohort = receipt(await io.readStable(join(cohortRoot, 'receipt.json'), MAX_RECEIPT_BYTES, true));
+    if (originalCohort.receiptDigest !== prepared.originalCohortDigest
+        || typeof originalCohort.sourceRepository !== 'string' || !exact(originalCohort.sourceRepository)) {
+        fail('original cohort source differs');
+    }
+    if (inside(originalCohort.sourceRepository, stagePhysicalHome)
+        || inside(stagePhysicalHome, originalCohort.sourceRepository))
+        fail('stage overlaps upstream source repository');
+    const { receiptDigest: _oldDigest, ...cohortBody } = prepared.cohort;
+    const cohort = JSON.parse(encode({ ...cohortBody, root: cohortRoot,
+        sourceRepository: originalCohort.sourceRepository,
+        packages: prepared.cohort.packages.map(item => ({ ...item,
+            tarball: join(cohortRoot, 'artifacts', `${item.name.split('/')[1]}.tgz`) })) }));
+    const scratch = join(stagePhysicalHome, `.rsi-linux-native-cohort-${randomUUID()}`);
+    await mkdir(scratch, { mode: 0o700 });
+    let moved = false;
+    try {
+        const next = join(scratch, COHORT);
+        await cp(join(prepared.candidateHome, COHORT, profile), next, { recursive: true, dereference: false, verbatimSymlinks: true, errorOnExist: true, force: false });
+        if (!isDeepStrictEqual(await inventory(next, signal), candidate))
+            fail('cohort changed during copy');
+        const entry = candidate.find(item => item.path === 'receipt.json');
+        if (!entry || entry.sha256 === null)
+            fail('cohort receipt is missing from the inventory');
+        const bytes = JSON.stringify(cohort);
+        await writeFile(join(next, 'receipt.json'), bytes, { mode: entry.mode });
+        await chmod(join(next, 'receipt.json'), entry.mode);
+        const expected = candidate.map(item => item.path === 'receipt.json' ? { ...item, sha256: hash(bytes) } : item);
+        if (!isDeepStrictEqual(await inventory(next, signal), expected))
+            fail('rebased cohort differs');
+        if (!isDeepStrictEqual(await readRsiLocalUpdateLocked({ dshHome: logicalHome, profile,
+            root: input.preparationRoot, signal }), prepared))
+            fail('preparation changed during copy');
+        if (!isDeepStrictEqual(await inventory(join(logicalHome, COHORT, profile), signal), original)
+            || !isDeepStrictEqual(await inventory(join(stagePhysicalHome, COHORT, profile), signal), original)) {
+            fail('original cohort changed');
+        }
+        await rename(join(stagePhysicalHome, COHORT, profile), join(scratch, 'old'));
+        moved = true;
+        await rename(next, join(stagePhysicalHome, COHORT, profile));
+        await io.syncDirectory(join(stagePhysicalHome, COHORT));
+        await rm(scratch, { recursive: true });
+        return cohort;
+    }
+    catch (error) {
+        if (moved) {
+            await rm(join(stagePhysicalHome, COHORT, profile), { recursive: true });
+            await rename(join(scratch, 'old'), join(stagePhysicalHome, COHORT, profile));
+            await io.syncDirectory(join(stagePhysicalHome, COHORT));
+        }
+        await rm(scratch, { recursive: true });
+        throw error;
+    }
+}
+/** Remove one Docker-era build tree from the stopped stage Home. A linux-native
+ * stage must hold exactly one backend: `readRsiLocalUpdateSourceBuild` refuses a
+ * Home carrying both the Docker and the native receipts. */
+async function dropDockerTree(stagePhysicalHome, profile, kind) {
+    const root = join(stagePhysicalHome, kind);
+    const missing = (error) => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    };
+    if (await lstat(root).catch(missing) === undefined)
+        return;
+    await io.directory(root);
+    const path = join(root, profile);
+    const item = await lstat(path).catch(missing);
+    if (item === undefined)
+        return;
+    if (!item.isDirectory() || item.isSymbolicLink() || (item.mode & 0o077) !== 0
+        || process.getuid && item.uid !== process.getuid())
+        fail(`unsafe staged ${kind} tree`);
+    await rm(path, { recursive: true });
+    await io.syncDirectory(root);
+}
+/** Preparation-phase handover for a linux-native candidate. The disposable Home
+ * only receives the rebased cohort that the profile preparation reads; the
+ * native families are relocated later, in the stopped stage Home, so a
+ * preparation failure can never publish a half-built runtime. */
+export async function prepareLinuxRsiNativeResources(input) {
+    const { prepared, signal } = await readPreparation(input);
+    const cohort = await stageCohort({ prepared, logicalHome: input.logicalHome,
+        stagePhysicalHome: input.stagePhysicalHome, profile: input.profile,
+        preparationRoot: input.preparationRoot, signal });
+    return { cohort };
+}
+/** Stage-phase handover for a linux-native candidate: drop the Docker-era build
+ * trees, stage the rebased cohort, then relocate the independently verified
+ * native families into the stopped stage Home. The returned proof is the only
+ * record the cutover and every later verification read. */
+export async function stageLinuxRsiNativeResources(input) {
+    const { prepared, signal } = await readPreparation(input);
+    const { logicalHome, stagePhysicalHome, profile } = input;
+    for (const kind of DOCKER_KINDS)
+        await dropDockerTree(stagePhysicalHome, profile, kind);
+    const cohort = await stageCohort({ prepared, logicalHome, stagePhysicalHome, profile,
+        preparationRoot: input.preparationRoot, signal });
+    const relocation = await relocateLinuxRsiNativeFamily({ sourceHome: prepared.candidateHome,
+        physicalHome: stagePhysicalHome, logicalHome, profile, existingLogicalHome: logicalHome, signal });
+    const family = await openLinuxRsiNativeRelocatedFamily(relocation);
+    if (family.runtime.sourceCommit !== prepared.source.sourceCommit)
+        fail('relocated runtime source differs');
+    if (family.creationBuild.sourceCommit !== prepared.source.sourceCommit)
+        fail('relocated creation build source differs');
+    const proof = { schemaVersion: 1, backend: 'linux-native', logicalHome,
+        physicalHome: stagePhysicalHome, profile, preparationDigest: prepared.receiptDigest,
+        cohortDigest: cohort.receiptDigest, relocation };
+    await auditNativeResources(proof, stagePhysicalHome, family);
+    return { cohort, family, proof };
+}
+/** Verify a staged or already-cut-over native resource proof. `physicalHome` may
+ * be the sealed stage Home or the logical Home the trees were renamed into: the
+ * rename preserves the sealed dev/ino and content identity, and the cohort
+ * receipt always records logical paths. */
+export async function verifyLinuxRsiNativeResources(input) {
+    const { proof } = input;
+    if (!relocationProof(proof) || !exact(proof.logicalHome) || !exact(proof.physicalHome)
+        || !PROFILE.test(proof.profile) || !HEX.test(proof.preparationDigest) || !HEX.test(proof.cohortDigest)) {
+        fail('invalid native resource proof binding');
+    }
+    const physicalHome = input.physicalHome;
+    if (!exact(physicalHome) || await realpath(physicalHome) !== physicalHome) {
+        fail('invalid native resource physical Home');
+    }
+    if (physicalHome !== proof.physicalHome && physicalHome !== proof.logicalHome) {
+        fail('native resource proof does not describe this physical Home');
+    }
+    input.signal?.throwIfAborted();
+    // Re-hashes the relocated families from physical Home only; the logical Home is
+    // never read here, so post-cutover verification stays a pure stage/Home check.
+    const family = await openLinuxRsiNativeRelocatedFamilyAt(proof.relocation, physicalHome);
+    await auditNativeResources(proof, physicalHome, family);
+}
+function relocationProof(proof) {
+    const value = proof.relocation;
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    const relocation = value;
+    if (relocation.schemaVersion !== 1 || relocation.backend !== 'linux-native'
+        || relocation.logicalHome !== proof.logicalHome || relocation.physicalHome !== proof.physicalHome
+        || relocation.profile !== proof.profile)
+        return undefined;
+    return relocation;
+}
+/** Cheap, non-family checks shared by the stage handover and every later
+ * verification: the rebased cohort receipt and its packaged tarballs. */
+async function auditNativeResources(proof, physicalHome, family) {
+    const cohortRoot = join(proof.logicalHome, COHORT, proof.profile);
+    const stageRoot = join(physicalHome, COHORT, proof.profile);
+    if (physicalHome !== proof.physicalHome && physicalHome !== proof.logicalHome) {
+        fail('native resource proof does not describe this physical Home');
+    }
+    await io.directory(join(physicalHome, COHORT));
+    const cohort = receipt(await io.readStable(join(stageRoot, 'receipt.json'), MAX_RECEIPT_BYTES, true));
+    if (cohort.receiptDigest !== proof.cohortDigest)
+        fail('staged cohort receipt digest differs');
+    if (cohort.root !== cohortRoot || !Array.isArray(cohort.packages) || !COMMIT.test(String(cohort.sourceCommit))) {
+        fail('staged cohort receipt differs');
+    }
+    if (cohort.sourceCommit !== family.runtime.sourceCommit)
+        fail('staged cohort source differs');
+    for (const item of cohort.packages) {
+        if (item === null || typeof item !== 'object')
+            fail('staged cohort package differs');
+        const entry = item;
+        if (typeof entry.name !== 'string' || typeof entry.tarball !== 'string'
+            || typeof entry.sha256 !== 'string' || !HEX.test(entry.sha256))
+            fail('staged cohort package differs');
+        const expected = join(cohortRoot, 'artifacts', `${entry.name.split('/')[1]}.tgz`);
+        if (entry.tarball !== expected)
+            fail('staged cohort package path differs');
+        const digest = hash(await io.readStable(join(stageRoot, 'artifacts', basename(expected)), MAX_FILE_BYTES, true));
+        if (digest !== entry.sha256)
+            fail(`staged cohort package differs: ${entry.name}`);
+    }
+}
+const BASE_KINDS = ['rsi-linux-runtimes', 'rsi-release-builds', 'rsi-builds', COHORT];
+const OWNER_KINDS = ['rsi-linux-repository-runtimes', 'rsi-linux-creation-builds', 'rsi-creation-builds'];
+async function present(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Content comparison deliberately excludes dev/ino: a copied stage has fresh
+ * inodes, while the live stock readers still verify the original native pins. */
+async function baseInventory(root, signal) {
+    await io.directory(root);
+    const entries = [];
+    let bytes = 0;
+    const visit = async (path) => {
+        signal.throwIfAborted();
+        const item = await lstat(path);
+        if (entries.length >= MAX_ENTRIES || process.getuid && item.uid !== process.getuid()
+            || !item.isSymbolicLink() && item.mode & 0o022)
+            fail('unsafe pre-owner base entry');
+        const location = relative(root, path), mode = item.mode & 0o777;
+        if (item.isSymbolicLink()) {
+            if (item.nlink !== 1)
+                fail('pre-owner base link must be detached');
+            const link = await readlink(path);
+            if (isAbsolute(link) || !inside(root, resolve(dirname(path), link)) || !inside(root, await realpath(path))) {
+                fail('pre-owner base link escapes its tree');
+            }
+            const after = await lstat(path);
+            if (!after.isSymbolicLink() || !isDeepStrictEqual([item.dev, item.ino, item.uid, item.mode, item.nlink, item.size, item.mtimeMs, item.ctimeMs], [after.dev, after.ino, after.uid, after.mode, after.nlink, after.size, after.mtimeMs, after.ctimeMs])) {
+                fail('pre-owner base link identity changed during read');
+            }
+            entries.push({ path: location, mode, sha256: null, link });
+        }
+        else if (item.isDirectory()) {
+            entries.push({ path: location, mode, sha256: null });
+            for (const name of (await readdir(path)).sort())
+                await visit(join(path, name));
+        }
+        else if (item.isFile() && item.nlink === 1) {
+            bytes += item.size;
+            if (item.size > MAX_FILE_BYTES || bytes > MAX_TOTAL_BYTES)
+                fail('pre-owner base tree exceeds size bound');
+            entries.push({ path: location, mode, sha256: hash(await io.readStable(path, MAX_FILE_BYTES)) });
+        }
+        else
+            fail('pre-owner base entry is not a detached regular file/directory');
+    };
+    await visit(root);
+    return entries;
+}
+async function preOwnerFamilies(home, profile) {
+    for (const kind of OWNER_KINDS)
+        if (await present(join(home, kind, profile)))
+            fail('pre-owner Home contains an owner runtime family');
+    const authority = join(home, 'rsi-authorities', profile);
+    if (await present(authority)) {
+        await io.directory(authority);
+        for (const name of ['state', 'config', 'registry']) {
+            const path = join(authority, name);
+            if (await present(path)) {
+                await io.directory(path);
+                if ((await readdir(path)).length)
+                    fail('pre-owner authority is not empty');
+            }
+        }
+        const catalogPath = join(authority, 'catalog.json');
+        if (await present(catalogPath)) {
+            const catalog = JSON.parse((await io.readStable(catalogPath, MAX_RECEIPT_BYTES, true)).toString('utf8'));
+            if (!isDeepStrictEqual(catalog, { schemaVersion: 1, entries: [] }))
+                fail('pre-owner catalog is not empty');
+        }
+    }
+}
+async function originalBase(input, signal) {
+    const { logicalHome, stagePhysicalHome, profile } = input;
+    await preOwnerFamilies(logicalHome, profile);
+    await preOwnerFamilies(stagePhysicalHome, profile);
+    const native = await present(join(logicalHome, 'rsi-linux-runtimes', profile)), docker = await present(join(logicalHome, 'rsi-builds', profile));
+    if (native === docker)
+        fail('pre-owner original must have exactly one build backend');
+    // readRsiSourceWorkspace follows an authenticated maintenance chain when one
+    // exists; it does not replay the older bootstrap commit after maintenance.
+    const source = await readRsiSourceWorkspace({ dshHome: logicalHome, profile, signal });
+    const sourceBuild = await readRsiLocalUpdateSourceBuild({ dshHome: logicalHome, profile, source, signal });
+    const backend = sourceBuild.schemaVersion === 3 && sourceBuild.backend === 'linux-native' ? 'linux-native' : 'docker';
+    if ((backend === 'linux-native') !== native)
+        fail('original backend reader differs from its tree');
+    const releaseBuild = await readRsiReleaseBuildEnvironment({ dshHome: logicalHome, profile, build: sourceBuild, signal });
+    const trees = new Map();
+    for (const kind of BASE_KINDS) {
+        const live = join(logicalHome, kind, profile), stage = join(stagePhysicalHome, kind, profile);
+        const exists = await present(live);
+        if (exists !== await present(stage))
+            fail('copied original base layout differs');
+        if (!exists) {
+            trees.set(kind, null);
+            continue;
+        }
+        const original = await baseInventory(live, signal);
+        if (!isDeepStrictEqual(original, await baseInventory(stage, signal)))
+            fail('copied original base content differs');
+        trees.set(kind, original);
+    }
+    return { backend, sourceBuild, releaseBuild, trees };
+}
+async function verifyPreOwnerOriginal(input, frozen, signal) {
+    await preOwnerFamilies(input.logicalHome, input.profile);
+    const source = await readRsiSourceWorkspace({ dshHome: input.logicalHome, profile: input.profile, signal });
+    const build = await readRsiLocalUpdateSourceBuild({ dshHome: input.logicalHome, profile: input.profile, source, signal });
+    const release = await readRsiReleaseBuildEnvironment({ dshHome: input.logicalHome, profile: input.profile, build, signal });
+    if (!isDeepStrictEqual(build, frozen.sourceBuild) || !isDeepStrictEqual(release, frozen.releaseBuild))
+        fail('original base receipts changed during staging');
+    for (const [kind, before] of frozen.trees) {
+        const path = join(input.logicalHome, kind, input.profile);
+        if (before === null ? await present(path) : !await present(path) || !isDeepStrictEqual(before, await baseInventory(path, signal))) {
+            fail('original base trees changed during staging');
+        }
+    }
+}
+/** All writes target the disposable stage. Old profile trees (including the
+ * original cohort inode) remain under a private scratch until the final audit;
+ * a later cohort or preparation failure restores them as one transaction. */
+export async function stageLinuxRsiPreOwnerNativeResources(input) {
+    const { prepared, signal } = await readPreparation(input);
+    const { logicalHome, stagePhysicalHome, profile } = input;
+    const build = nativeBuild(prepared);
+    if (build.sourceBuild.sourceCommit !== prepared.source.sourceCommit)
+        fail('candidate runtime differs from preparation source');
+    await preOwnerFamilies(prepared.candidateHome, profile);
+    if (await present(join(prepared.candidateHome, 'rsi-builds', profile)))
+        fail('native candidate also contains Docker resources');
+    const original = await originalBase(input, signal);
+    const scratch = join(stagePhysicalHome, `.rsi-pre-owner-native-${randomUUID()}`);
+    await mkdir(scratch, { mode: 0o700 });
+    const moved = new Map(), missingParents = new Set();
+    let discarding = false;
+    try {
+        await writeFile(join(scratch, 'transaction.json'), JSON.stringify({ schemaVersion: 1, purpose: 'pre-owner-base-stage',
+            logicalHome, physicalHome: stagePhysicalHome, profile, preparationDigest: prepared.receiptDigest, originalBackend: original.backend,
+            trees: [...original.trees].map(([kind, entries]) => ({ kind, inventoryDigest: entries === null ? null : hash(JSON.stringify(entries)) })) }), { mode: 0o600, flag: 'wx' });
+        for (const kind of BASE_KINDS) {
+            const parent = join(stagePhysicalHome, kind), path = join(parent, profile), backup = join(scratch, kind);
+            if (!await present(parent))
+                missingParents.add(parent);
+            if (await present(path)) {
+                await io.directory(parent);
+                await rename(path, backup);
+                moved.set(path, backup);
+            }
+            else
+                moved.set(path, null);
+        }
+        // stageCohort owns its own swap; give it an old-content working copy while
+        // retaining the original stage tree/inode outside that helper's cleanup.
+        const oldCohort = moved.get(join(stagePhysicalHome, COHORT, profile));
+        if (!oldCohort)
+            fail('original staged cohort is missing');
+        await cp(oldCohort, join(stagePhysicalHome, COHORT, profile), { recursive: true, dereference: false, verbatimSymlinks: true, errorOnExist: true, force: false });
+        const relocation = await relocateLinuxRsiNativeBase({ sourceHome: prepared.candidateHome,
+            physicalHome: stagePhysicalHome, logicalHome, profile, existingLogicalHome: logicalHome, signal });
+        const family = await openLinuxRsiNativeRelocatedBase(relocation);
+        if (family.runtime.sourceCommit !== prepared.source.sourceCommit || family.release.sourceCommit !== prepared.source.sourceCommit)
+            fail('relocated base source differs');
+        const cohort = await stageCohort({ prepared, logicalHome, stagePhysicalHome, profile, preparationRoot: input.preparationRoot, signal });
+        const proof = { schemaVersion: 1, backend: 'linux-native', purpose: 'pre-owner-base', logicalHome,
+            physicalHome: stagePhysicalHome, profile, preparationDigest: prepared.receiptDigest, cohortDigest: cohort.receiptDigest,
+            originalBackend: original.backend, relocation };
+        await verifyLinuxRsiPreOwnerNativeResources({ proof, physicalHome: stagePhysicalHome, signal });
+        if (!isDeepStrictEqual(await readRsiLocalUpdateLocked({ dshHome: logicalHome, profile, root: input.preparationRoot, signal }), prepared))
+            fail('preparation changed after base staging');
+        await verifyPreOwnerOriginal(input, original, signal);
+        // Backups may disappear incrementally from this point. A cleanup failure
+        // must retain the verified candidate, never delete it and replay partial old trees.
+        discarding = true;
+        await rm(scratch, { recursive: true });
+        return { cohort, sourceBuild: family.runtime, releaseBuild: family.release, proof };
+    }
+    catch (error) {
+        if (discarding)
+            throw new Error(`rsi Linux native resources: pre-owner backup cleanup failed after candidate verification; preserved evidence: ${scratch}`, { cause: error });
+        try {
+            for (const [path, backup] of [...moved].reverse()) {
+                await rm(path, { recursive: true, force: true });
+                if (backup !== null)
+                    await rename(backup, path);
+                if (await present(dirname(path)))
+                    await io.syncDirectory(dirname(path));
+            }
+            for (const path of missingParents)
+                if (await present(path) && (await readdir(path)).length === 0)
+                    await rm(path, { recursive: true });
+            await rm(scratch, { recursive: true });
+        }
+        catch (rollback) {
+            throw new Error(`rsi Linux native resources: pre-owner rollback incomplete; preserved evidence: ${scratch}`, { cause: new AggregateError([error, rollback]) });
+        }
+        throw error;
+    }
+}
+export async function verifyLinuxRsiPreOwnerNativeResources(input) {
+    const { proof, physicalHome } = input;
+    const relocation = proof?.relocation;
+    if (!proof || proof.schemaVersion !== 1 || proof.backend !== 'linux-native' || proof.purpose !== 'pre-owner-base'
+        || !['docker', 'linux-native'].includes(proof.originalBackend) || !exact(proof.logicalHome) || !exact(proof.physicalHome)
+        || !PROFILE.test(proof.profile) || !HEX.test(proof.preparationDigest) || !HEX.test(proof.cohortDigest)
+        || !relocation || relocation.purpose !== 'pre-owner-base' || relocation.logicalHome !== proof.logicalHome
+        || relocation.physicalHome !== proof.physicalHome || relocation.profile !== proof.profile
+        || !exact(physicalHome) || await realpath(physicalHome) !== physicalHome
+        || physicalHome !== proof.physicalHome && physicalHome !== proof.logicalHome)
+        fail('invalid pre-owner native resource proof binding');
+    input.signal?.throwIfAborted();
+    await preOwnerFamilies(physicalHome, proof.profile);
+    for (const kind of ['rsi-builds', 'rsi-creation-builds'])
+        if (await present(join(physicalHome, kind, proof.profile)))
+            fail('pre-owner native Home retains Docker resources');
+    const family = await openLinuxRsiNativeRelocatedBaseAt(relocation, physicalHome);
+    await auditNativeResources(proof, physicalHome, family);
+}
+//# sourceMappingURL=rsi-linux-native-resources.js.map

package/lib/rsi-linux-native-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-native-resources.js","sourceRoot":"","sources":["../src/rsi-linux-native-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC9G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAAE,mCAAmC,EAAE,iCAAiC,EACvG,gCAAgC,GACjC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAGxD,OAAO,EAAE,6BAA6B,EAA+B,MAAM,6BAA6B,CAAA;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAAwC,MAAM,wBAAwB,CAAA;AAE7G,OAAO,EAAE,wBAAwB,EAAkC,MAAM,uBAAuB,CAAA;AAChG,OAAO,EACL,iCAAiC,EAAE,mCAAmC,EAAE,4BAA4B,EACpG,+BAA+B,EAAE,iCAAiC,EAAE,0BAA0B,EAC9F,2BAA2B,GAE5B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAA;AAExG,OAAO;AACL,0EAA0E;AAC1E,2EAA2E;AAC3E,0BAA0B,EAC1B,+BAA+B,EAC/B,mCAAmC,EACnC,iCAAiC,EACjC,gCAAgC,EAChC,2BAA2B,EAC3B,4BAA4B,GAC7B,CAAA;AACD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAA;AAE7F,OAAO,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,2BAA2B,EAAE,CAAA;AAE1G,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,MAAM,GAAG,mBAAmB,CAAA;AAClC,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,CAAU,CAAA;AACzF,MAAM,WAAW,GAAG,OAAO,CAAA;AAC3B,MAAM,cAAc,GAAG,WAAW,CAAA;AAClC,MAAM,eAAe,GAAG,aAAa,CAAA;AACrC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAEpC,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AACnG,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,MAAM,KAAK,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;OACxF,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACnD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AAkBpG;kFACkF;AAClF,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,MAAmB;IACxD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAClF,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAA;YACjB,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,IAAI,IAAI,GAAG,eAAe;gBAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;YAClG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK;gBAChE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;QACpE,CAAC;;YAAM,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAChH,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACzC,IAAI,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;IAChG,OAAO,MAAM,CAAA;AACf,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC;AAEvH,SAAS,WAAW,CAAC,WAAsC;IAIzD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,WAAW,CAAC,aAAa,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QAC9E,IAAI,CAAC,+CAA+C,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IACvC,IAAI,YAAY,CAAC,aAAa,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QAChF,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,YAAY,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACpG,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAE9B;IACC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;WAC1G,iBAAiB,KAAK,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC;WAC3E,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;WACtC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,iBAAiB;WACtG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1G,IAAI,CAAC,8EAA8E,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAA;IACvH,WAAW,CAAC,QAAQ,CAAC,CAAA;IACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;qEAGqE;AACrE,KAAK,UAAU,WAAW,CAAC,KAG1B;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACpG,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;IAC9G,IAAI,cAAc,CAAC,aAAa,KAAK,QAAQ,CAAC,oBAAoB;WAC7D,OAAO,cAAc,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpG,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;WACzD,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAClH,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,UAAU;QAChE,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI;YACvD,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmB,CAAA;IACtG,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,UAAU,EAAE,EAAE,CAAC,CAAA;IACnF,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrC,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAC1D,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACpG,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC;YAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACpG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC9G,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC/F,IAAI,CAAC,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO;YACnF,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAC5F,IAAI,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;eACxF,CAAC,iBAAiB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,yBAAyB,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAC5E,KAAK,GAAG,IAAI,CAAA;QACZ,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5D,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAA;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;YAC5E,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;4DAE4D;AAC5D,KAAK,UAAU,cAAc,CAAC,iBAAyB,EAAE,OAAe,EAAE,IAAY;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAa,EAAE;QAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC7C,MAAM,KAAK,CAAA;IACb,CAAC,CAAA;IACD,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAM;IAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAM;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WACxE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAA;IACxF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;iEAGiE;AACjE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAEpD;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACzE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;QAClE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAA;IACnD,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC;AAED;;;2DAG2D;AAC3D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAElD;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,MAAM,cAAc,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO;QAClF,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa;QACxF,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;IACpG,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,UAAU,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAC1G,IAAI,MAAM,CAAC,aAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACvH,MAAM,KAAK,GAAgC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW;QACjG,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa;QACnF,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,CAAA;IAClD,MAAM,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAClC,CAAC;AAED;;;2CAG2C;AAC3C,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAEnD;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;WACjF,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzG,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;QAC1E,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,YAAY,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,4DAA4D,CAAC,CAAA;IACpE,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACxF,MAAM,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAkC;IACzD,MAAM,KAAK,GAAI,KAAkC,CAAC,UAAU,CAAA;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,UAAU,GAAG,KAA+C,CAAA;IAClE,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,KAAK,cAAc;WACtE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC9F,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC3D,OAAO,UAA2C,CAAA;AACpD,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,oBAAoB,CAAC,KAAqG,EAAE,YAAoB,EAC7J,MAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3D,IAAI,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,YAAY,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,4DAA4D,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAA;IACrG,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC7F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAqB,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACpF,MAAM,KAAK,GAAG,IAA+B,CAAA;QAC7C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;eAClE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACjF,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAA;QAChH,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAkBD,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,CAAU,CAAA;AAC9F,MAAM,WAAW,GAAG,CAAC,+BAA+B,EAAE,2BAA2B,EAAE,qBAAqB,CAAU,CAAA;AAClH,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACpD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACpE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;iFACiF;AACjF,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,MAAmB;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,MAAM,OAAO,GAAqC,EAAE,CAAA;IACpD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;eAC/E,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;YAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAA;QAC/D,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;YAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC3G,IAAI,CAAC,sCAAsC,CAAC,CAAA;YAC9C,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAC/C,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAC5F,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACxG,IAAI,CAAC,kDAAkD,CAAC,CAAA;YAC1D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACpD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,KAAK,IAAI,IAAI,CAAC,IAAI,CAAA;YAClB,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,IAAI,KAAK,GAAG,eAAe;gBAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;YACzG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAA;QACjG,CAAC;;YAAM,IAAI,CAAC,+DAA+D,CAAC,CAAA;IAC9E,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC3D,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IACrI,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACxD,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAClC,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;YAAC,CAAC;QACnI,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACnD,IAAI,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;YACnH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAyB,EAAE,MAAmB;IAIxE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzD,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAChG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;IAChJ,IAAI,MAAM,KAAK,MAAM;QAAE,IAAI,CAAC,wDAAwD,CAAC,CAAA;IACrF,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,MAAM,WAAW,GAAG,MAAM,6BAA6B,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAA;IACrH,IAAI,CAAC,OAAO,KAAK,cAAc,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAClG,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;IACxH,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4D,CAAA;IACjF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,MAAM,KAAK,MAAM,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAC,SAAQ;QAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;QAClH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAyB,EAAE,MAAgD,EAC/G,MAAmB;IACnB,MAAM,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3G,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACzH,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC3H,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC5J,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClI,IAAI,CAAC,4CAA4C,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;6EAE6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAAyB;IAIlF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;IAC9H,MAAM,gBAAgB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACvD,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAC/H,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,UAAU,EAAE,EAAE,CAAC,CAAA;IAChF,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,EAAE,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAClF,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,sBAAsB;YACnH,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO;YACnI,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAC9I,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC;gBAAE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACtD,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAAC,CAAC;;gBACvG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5B,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;QACzD,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAC1D,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACpG,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa;YACtF,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;QACpG,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,UAAU,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACvK,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAA;QACvI,MAAM,KAAK,GAAwC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW;YACpI,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa;YACvH,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAA;QACjD,MAAM,qCAAqC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/F,IAAI,CAAC,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;QACxL,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QACrD,yEAAyE;QACzE,oFAAoF;QACpF,UAAU,GAAG,IAAI,CAAA;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAA;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7K,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAChD,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBAC/C,IAAI,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,cAAc;gBAAE,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrI,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kFAAkF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;QAChK,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAE3D;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IACrC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,CAAA;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB;WAC5G,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;WACtH,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;WACnG,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,gBAAgB,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WACtG,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WACtF,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,YAAY;WACrE,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,YAAY,KAAK,KAAK,CAAC,WAAW;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IACvI,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC;QAAE,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC5K,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IAChF,MAAM,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC"}

package/lib/rsi-linux-repository-bootstrap.d.ts

@@ -0,0 +1,17 @@
+import { type LinuxRuntime, type LinuxSystemSnapshot, type LinuxUserNamespaceMapping } from '@dsh-enhanced/assistant-isolation';
+import { type LinuxRsiBootstrapInput } from './rsi-linux-runtime-bootstrap.js';
+export interface LinuxRsiRepositoryBuildEnvironment {
+    schemaVersion: 4;
+    backend: 'linux-native';
+    sourceCommit: string;
+    lockSha256: string;
+    runtime: LinuxRuntime;
+    systemSnapshot: LinuxSystemSnapshot;
+    userNamespace: LinuxUserNamespaceMapping;
+}
+/** Separate schema4 capability; no schema3 runtime, owner, ledger or grant is rewritten. */
+export declare function prepareLinuxRsiRepositoryRuntime(input: LinuxRsiBootstrapInput): Promise<LinuxRsiRepositoryBuildEnvironment>;
+/** Reopen only the existing schema4 repository family. Missing or damaged
+ * receipts are errors; preparation and archive inputs are never consulted. */
+export declare function readLinuxRsiRepositoryRuntime(input: LinuxRsiBootstrapInput): Promise<LinuxRsiRepositoryBuildEnvironment>;
+//# sourceMappingURL=rsi-linux-repository-bootstrap.d.ts.map

package/lib/rsi-linux-repository-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-repository-bootstrap.d.ts","sourceRoot":"","sources":["../src/rsi-linux-repository-bootstrap.ts"],"names":[],"mappings":"AAMA,OAAO,EAC0E,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAC1H,KAAK,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,OAAO,EACL,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAEvE,MAAM,WAAW,kCAAkC;IACjD,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,mBAAmB,CAAA;IACnC,aAAa,EAAE,yBAAyB,CAAA;CACzC;AA6LD,4FAA4F;AAC5F,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kCAAkC,CAAC,CA0DjI;AAED;8EAC8E;AAC9E,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAU9H"}