@dsh-enhanced/lark-channel 0.1.65 → 0.1.67

package/lib/rsi-linux-repository-bootstrap.js

@@ -0,0 +1,317 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { constants, createReadStream } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual, promisify } from 'node:util';
+import { hashLinuxRuntimeTree, prepareLinuxSystemSnapshot, readLinuxUserNamespaceMapping, verifyLinuxRuntime, verifyLinuxSystemSnapshotRuntimeDependencies, verifyLinuxUserNamespaceMapping } from '@dsh-enhanced/assistant-isolation';
+import { NODE_ARCHIVES, NODE_VERSION, officialArchive, prepareLinuxRsiRuntime, readLinuxRsiRuntime } from './rsi-linux-runtime-bootstrap.js';
+const MAX_BYTES = 8 * 1024 * 1024 * 1024;
+const MAX_ENTRIES = 500_000;
+const MAX_NPM_BYTES = 64 * 1024 * 1024;
+const MAX_NPM_ENTRIES = 8192;
+const exec = promisify(execFile);
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const digest = (value) => sha(JSON.stringify(value));
+const canonical = (value) => typeof value === 'string' && isAbsolute(value)
+    && resolve(value) === value && ![...value].some(character => character.charCodeAt(0) < 32);
+const within = (path, root) => path === root || path.startsWith(root + '/');
+const stamp = (value) => JSON.stringify([value.dev, value.ino, value.uid, value.mode, value.size, value.mtimeMs, value.ctimeMs]);
+const env = { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C', COPYFILE_DISABLE: '1' };
+function fail(message) { throw new Error(`rsi Linux repository runtime: ${message}`); }
+async function privateDirectory(path) {
+    const info = await lstat(path);
+    if (!canonical(path) || await realpath(path) !== path || !info.isDirectory() || info.uid !== process.getuid?.()
+        || info.mode & 0o077)
+        fail('unsafe private directory');
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function sync(path) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Copy bytes rather than hardlinks; preserve only links that remain inside the clone. */
+async function cloneRuntime(source, target, signal) {
+    let bytes = 0, entries = 0;
+    const visit = async (path) => {
+        signal.throwIfAborted();
+        if (++entries > MAX_ENTRIES)
+            fail('runtime entry bound exceeded');
+        const before = await lstat(path), destination = join(target, relative(source, path));
+        if (before.uid !== process.getuid?.() || !before.isSymbolicLink() && before.mode & 0o022)
+            fail('unsafe base runtime entry');
+        if (before.isSymbolicLink()) {
+            const link = await readlink(path);
+            const resolved = await realpath(path);
+            if (isAbsolute(link) || !within(resolved, source) || !within(resolve(dirname(path), link), source))
+                fail('base runtime link escaped');
+            await symlink(link, destination);
+        }
+        else if (before.isDirectory()) {
+            await mkdir(destination, { mode: 0o755 });
+            await chmod(destination, 0o755);
+            for (const name of (await readdir(path)).sort())
+                await visit(join(path, name));
+        }
+        else if (before.isFile() && before.nlink === 1) {
+            if ((bytes += before.size) > MAX_BYTES)
+                fail('runtime byte bound exceeded');
+            const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                if (stamp(await fd.stat()) !== stamp(before) || await realpath(`/proc/self/fd/${fd.fd}`) !== path)
+                    fail('base runtime descriptor changed');
+                const output = await open(destination, 'wx', 0o600);
+                try {
+                    let copied = 0;
+                    for await (const raw of createReadStream(path, { fd: fd.fd, autoClose: false, highWaterMark: 65536 })) {
+                        signal.throwIfAborted();
+                        const chunk = raw;
+                        if ((copied += chunk.length) > before.size)
+                            fail('base runtime file grew');
+                        let written = 0;
+                        while (written < chunk.length) {
+                            const result = await output.write(chunk, written, chunk.length - written);
+                            if (!result.bytesWritten)
+                                fail('runtime copy stalled');
+                            written += result.bytesWritten;
+                        }
+                    }
+                    if (copied !== before.size || stamp(await fd.stat()) !== stamp(before))
+                        fail('base runtime file changed');
+                }
+                finally {
+                    await output.close();
+                }
+            }
+            finally {
+                await fd.close();
+            }
+            await chmod(destination, before.mode & 0o111 ? 0o555 : 0o444);
+        }
+        else
+            fail('special or hardlinked base runtime entry');
+        if (stamp(await lstat(path)) !== stamp(before))
+            fail('base runtime changed during clone');
+    };
+    await visit(source);
+}
+async function npmArchive(root, archive, stage, signal) {
+    const prefix = `node-${NODE_VERSION}-linux-${process.arch}/lib/node_modules/npm`;
+    const listing = await exec('/usr/bin/tar', ['-tzvf', archive, '--numeric-owner', prefix], {
+        cwd: stage, env, signal, timeout: 120_000, maxBuffer: 8 * 1024 * 1024,
+    });
+    let bytes = 0, entries = 0;
+    for (const line of listing.stdout.trimEnd().split('\n')) {
+        const entry = /^([dl-])[rwxstST-]{9}\s+[0-9]+\/[0-9]+\s+([0-9]+)\s+[0-9-]+\s+[0-9:]+\s+(.+)$/u.exec(line);
+        if (!entry || ++entries > MAX_NPM_ENTRIES || (bytes += Number(entry[2])) > MAX_NPM_BYTES)
+            fail('npm archive inventory exceeds bound');
+        const name = entry[3].split(' -> ')[0].replace(/\/$/u, '');
+        if (!name.startsWith(prefix) || name !== prefix && !name.startsWith(prefix + '/')
+            || name.split('/').some(part => !part || part === '.' || part === '..'))
+            fail('npm archive path escaped');
+        if (entry[1] === 'l') {
+            const link = entry[3].split(' -> ')[1];
+            if (!link || isAbsolute(link) || !within(resolve('/', dirname(name), link), '/' + prefix))
+                fail('npm archive link escaped');
+        }
+    }
+    if (!entries || !bytes)
+        fail('npm archive empty');
+    // The full archive is digest-checked before listing or extracting; only this
+    // fixed official subtree is selected, with ownership and permissions stripped.
+    await exec('/usr/bin/tar', ['-xzf', archive, '--no-same-owner', '--no-same-permissions', '--strip-components=1', '-C', root, prefix], { cwd: stage, env, signal, timeout: 120_000, maxBuffer: 1024 * 1024 });
+    const npmRoot = join(root, 'lib', 'node_modules', 'npm');
+    let actualBytes = 0, actualEntries = 0;
+    const normalize = async (path) => {
+        signal.throwIfAborted();
+        const info = await lstat(path);
+        if (++actualEntries > MAX_NPM_ENTRIES || info.uid !== process.getuid?.())
+            fail('npm extraction inventory differs');
+        if (info.isDirectory()) {
+            for (const child of (await readdir(path)).sort())
+                await normalize(join(path, child));
+            await chmod(path, 0o755);
+        }
+        else if (info.isFile() && info.nlink === 1) {
+            if ((actualBytes += info.size) > MAX_NPM_BYTES)
+                fail('npm extraction byte bound exceeded');
+            await chmod(path, info.mode & 0o111 ? 0o555 : 0o444);
+        }
+        else if (info.isSymbolicLink()) {
+            if (isAbsolute(await readlink(path)) || !within(await realpath(path), npmRoot))
+                fail('npm extraction link escaped');
+        }
+        else
+            fail('npm extraction special or linked file');
+    };
+    await normalize(npmRoot);
+    for (const path of [join(root, 'lib'), join(root, 'lib', 'node_modules')])
+        await chmod(path, 0o755);
+    if (actualBytes !== bytes || actualEntries !== entries)
+        fail('npm extraction inventory differs');
+    for (const name of ['npm', 'npx'])
+        await symlink(`../lib/node_modules/npm/bin/${name}-cli.js`, join(root, 'bin', name));
+    const manifest = JSON.parse(await readFile(join(npmRoot, 'package.json'), 'utf8'));
+    if (manifest.name !== 'npm' || !/^[0-9]+\.[0-9]+\.[0-9]+$/u.test(manifest.version))
+        fail('npm manifest differs');
+    for (const name of ['npm', 'npx']) {
+        const result = await exec(join(root, 'bin', 'node'), [join(npmRoot, 'bin', `${name}-cli.js`), '--version'], { cwd: stage, env, signal, timeout: 5000, maxBuffer: 4096 });
+        if (result.stdout.trim() !== manifest.version)
+            fail('npm executable version differs');
+    }
+    return manifest.version;
+}
+async function relocate(runtime, path) {
+    const info = await lstat(path);
+    const rewrite = (value) => {
+        if (!within(value, runtime.root.path))
+            fail('base runtime path escaped');
+        return join(path, relative(runtime.root.path, value));
+    };
+    return { ...runtime, root: { path, dev: info.dev, ino: info.ino, sha256: await hashLinuxRuntimeTree(path) },
+        nodePath: rewrite(runtime.nodePath), pnpmPath: rewrite(runtime.pnpmPath), nativePnpmRoot: rewrite(runtime.nativePnpmRoot),
+        nativePnpmPath: rewrite(runtime.nativePnpmPath), modulesPath: rewrite(runtime.modulesPath),
+        storePath: rewrite(runtime.storePath), cachePath: rewrite(runtime.cachePath) };
+}
+function environment(receipt) {
+    return { schemaVersion: 4, backend: 'linux-native', sourceCommit: receipt.sourceCommit, lockSha256: receipt.lockSha256,
+        runtime: receipt.runtime, systemSnapshot: receipt.systemSnapshot, userNamespace: receipt.userNamespace };
+}
+async function readExisting(final, input, base, mapping) {
+    await privateDirectory(final);
+    if ((await readdir(final)).sort().join() !== 'bootstrap.json,runtime,system')
+        fail('repository runtime inventory differs');
+    const path = join(final, 'bootstrap.json'), info = await lstat(path);
+    if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || info.mode & 0o077 || info.size > 1024 * 1024)
+        fail('unsafe repository receipt');
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let receipt;
+    try {
+        if (stamp(await fd.stat()) !== stamp(info))
+            fail('repository receipt changed');
+        receipt = JSON.parse(await fd.readFile({ encoding: 'utf8' }));
+        if (stamp(await fd.stat()) !== stamp(info) || stamp(await lstat(path)) !== stamp(info))
+            fail('repository receipt changed');
+    }
+    finally {
+        await fd.close();
+    }
+    const { receiptDigest, ...content } = receipt;
+    if (Object.keys(receipt).sort().join() !== 'backend,baseRuntimeDigest,dshHome,lockSha256,nodeArchiveDigest,npmVersion,ownerGid,ownerUid,profile,receiptDigest,runtime,runtimeDigest,schemaVersion,sourceCommit,sourceDigest,systemSnapshot,systemSnapshotDigest,userNamespace,userNamespaceDigest'
+        || receiptDigest !== digest(content) || receipt.schemaVersion !== 4 || receipt.backend !== 'linux-native'
+        || receipt.dshHome !== input.dshHome || receipt.profile !== input.profile || receipt.ownerUid !== process.getuid?.()
+        || receipt.ownerGid !== process.getgid?.() || receipt.sourceDigest !== digest(input.source)
+        || receipt.sourceCommit !== input.source.sourceCommit || receipt.lockSha256 !== base.lockSha256
+        || receipt.baseRuntimeDigest !== digest(base) || receipt.runtimeDigest !== digest(receipt.runtime)
+        || receipt.systemSnapshotDigest !== digest(receipt.systemSnapshot) || receipt.userNamespaceDigest !== digest(receipt.userNamespace)
+        || receipt.nodeArchiveDigest !== NODE_ARCHIVES[process.arch]
+        || !/^[0-9]+\.[0-9]+\.[0-9]+$/u.test(receipt.npmVersion) || !isDeepStrictEqual(receipt.userNamespace, mapping)
+        || receipt.runtime.root.path !== join(final, 'runtime') || receipt.systemSnapshot.root.path !== join(final, 'system')
+        || receipt.runtime.sourceCommit !== receipt.sourceCommit || receipt.runtime.lockSha256 !== receipt.lockSha256)
+        fail('repository receipt differs');
+    await verifyLinuxSystemSnapshotRuntimeDependencies(receipt.systemSnapshot, receipt.runtime, input.signal);
+    await verifyLinuxUserNamespaceMapping(receipt.userNamespace);
+    const npm = JSON.parse(await readFile(join(receipt.runtime.root.path, 'lib', 'node_modules', 'npm', 'package.json'), 'utf8'));
+    if (npm.version !== receipt.npmVersion)
+        fail('npm receipt version differs');
+    input.signal?.throwIfAborted();
+    return environment(receipt);
+}
+/** Separate schema4 capability; no schema3 runtime, owner, ledger or grant is rewritten. */
+export async function prepareLinuxRsiRepositoryRuntime(input) {
+    input.signal?.throwIfAborted();
+    if (!canonical(input.dshHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(input.profile)
+        || input.source.schemaVersion !== 1)
+        fail('invalid bootstrap identity');
+    await privateDirectory(input.dshHome);
+    const mapping = await readLinuxUserNamespaceMapping();
+    const parent = join(input.dshHome, 'rsi-linux-repository-runtimes');
+    await mkdir(parent, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+        throw error; });
+    await privateDirectory(parent);
+    const final = join(parent, input.profile);
+    if (await exists(final)) {
+        const base = await readLinuxRsiRuntime(input);
+        return await readExisting(final, input, base.runtime, mapping);
+    }
+    const base = await prepareLinuxRsiRuntime(input);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(1_200_000)]);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`)), stageInfo = await lstat(stage);
+    await chmod(stage, 0o700);
+    try {
+        const root = join(stage, 'runtime');
+        await verifyLinuxRuntime(base.runtime);
+        await cloneRuntime(base.runtime.root.path, root, signal);
+        const archiveDigest = NODE_ARCHIVES[process.arch];
+        const archive = await officialArchive(input.nodeArchivePath, `https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${process.arch}.tar.gz`, archiveDigest, 100_000_000, stage, signal);
+        const npmVersion = await npmArchive(root, archive, stage, signal);
+        await rm(archive);
+        const stagedRuntime = await relocate(base.runtime, root);
+        const snapshot = await prepareLinuxSystemSnapshot(join(stage, 'system'), signal, stagedRuntime);
+        await verifyLinuxSystemSnapshotRuntimeDependencies(snapshot, stagedRuntime, signal);
+        await verifyLinuxUserNamespaceMapping(mapping);
+        const latest = await readLinuxRsiRuntime(input);
+        if (!isDeepStrictEqual(latest, base))
+            fail('base runtime changed before commit');
+        signal.throwIfAborted();
+        const runtimePath = join(final, 'runtime');
+        const runtime = { ...stagedRuntime, root: { ...stagedRuntime.root, path: runtimePath },
+            nodePath: join(runtimePath, 'bin', 'node'), pnpmPath: join(runtimePath, 'pnpm', 'bin', 'pnpm.mjs'),
+            nativePnpmRoot: join(runtimePath, 'pnpm-native'), nativePnpmPath: join(runtimePath, 'pnpm-native', 'pnpm'),
+            modulesPath: join(runtimePath, 'node_modules'), storePath: join(runtimePath, 'store'), cachePath: join(runtimePath, 'cache') };
+        const systemSnapshot = { ...snapshot, root: { ...snapshot.root, path: join(final, 'system') } };
+        const content = { schemaVersion: 4, backend: 'linux-native', sourceCommit: base.sourceCommit,
+            lockSha256: base.lockSha256, runtime, systemSnapshot, userNamespace: mapping, dshHome: input.dshHome, profile: input.profile,
+            ownerUid: process.getuid(), ownerGid: process.getgid(), sourceDigest: digest(input.source), baseRuntimeDigest: digest(base.runtime),
+            runtimeDigest: digest(runtime), systemSnapshotDigest: digest(systemSnapshot), userNamespaceDigest: digest(mapping),
+            nodeArchiveDigest: archiveDigest, npmVersion };
+        await writeFile(join(stage, 'bootstrap.json'), JSON.stringify({ ...content, receiptDigest: digest(content) }) + '\n', { flag: 'wx', mode: 0o600 });
+        await sync(join(stage, 'bootstrap.json'));
+        await sync(root);
+        await sync(stage);
+        signal.throwIfAborted();
+        if (await exists(final))
+            fail('repository runtime appeared during preparation');
+        await rename(stage, final);
+        await sync(parent);
+        return await readExisting(final, input, base.runtime, mapping);
+    }
+    finally {
+        if (await exists(stage)) {
+            const current = await lstat(stage);
+            if (current.dev !== stageInfo.dev || current.ino !== stageInfo.ino || current.uid !== process.getuid?.())
+                fail('stage replaced; cleanup refused');
+            await rm(stage, { recursive: true, force: true });
+        }
+    }
+}
+/** Reopen only the existing schema4 repository family. Missing or damaged
+ * receipts are errors; preparation and archive inputs are never consulted. */
+export async function readLinuxRsiRepositoryRuntime(input) {
+    input.signal?.throwIfAborted();
+    if (!canonical(input.dshHome) || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(input.profile)
+        || input.source.schemaVersion !== 1)
+        fail('invalid bootstrap identity');
+    await privateDirectory(input.dshHome);
+    const parent = join(input.dshHome, 'rsi-linux-repository-runtimes');
+    await privateDirectory(parent);
+    const mapping = await readLinuxUserNamespaceMapping();
+    const base = await readLinuxRsiRuntime(input);
+    return readExisting(join(parent, input.profile), input, base.runtime, mapping);
+}
+//# sourceMappingURL=rsi-linux-repository-bootstrap.js.map

package/lib/rsi-linux-repository-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-repository-bootstrap.js","sourceRoot":"","sources":["../src/rsi-linux-repository-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAc,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5I,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,kBAAkB,EAC1G,4CAA4C,EAAE,+BAA+B,EAC7C,MAAM,mCAAmC,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,EACnE,MAAM,kCAAkC,CAAA;AAyBvE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,WAAW,GAAG,OAAO,CAAA;AAC3B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACtC,MAAM,eAAe,GAAG,IAAI,CAAA;AAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAChC,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AACrE,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC;OAChG,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;AAC5F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AACpG,MAAM,KAAK,GAAG,CAAC,KAAY,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;AAC/I,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAA;AAC1G,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAErG,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;WAC1G,IAAI,CAAC,IAAI,GAAG,KAAK;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;AAC1D,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;AAC5I,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,MAAmB;IAC7E,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,EAAE,OAAO,GAAG,WAAW;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QACpF,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC3H,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACrI,MAAM,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAClC,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzC,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS;gBAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC3E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACtE,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI;oBAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;gBAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnD,IAAI,CAAC;oBACH,IAAI,MAAM,GAAG,CAAC,CAAA;oBACd,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;wBACtG,MAAM,CAAC,cAAc,EAAE,CAAA;wBACvB,MAAM,KAAK,GAAG,GAAa,CAAA;wBAC3B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI;4BAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;wBAC1E,IAAI,OAAO,GAAG,CAAC,CAAA;wBACf,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;4BACzE,IAAI,CAAC,MAAM,CAAC,YAAY;gCAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;4BACtD,OAAO,IAAI,MAAM,CAAC,YAAY,CAAA;wBAChC,CAAC;oBACH,CAAC;oBACD,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;wBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBAC3G,CAAC;wBAAS,CAAC;oBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;gBAAC,CAAC;YACpC,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YAC9B,MAAM,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC/D,CAAC;;YAAM,IAAI,CAAC,0CAA0C,CAAC,CAAA;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC3F,CAAC,CAAA;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,KAAa,EAAE,MAAmB;IACzF,MAAM,MAAM,GAAG,QAAQ,YAAY,UAAU,OAAO,CAAC,IAAI,uBAAuB,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE;QACxF,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;KACtE,CAAC,CAAA;IACF,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzG,IAAI,CAAC,KAAK,IAAI,EAAE,OAAO,GAAG,eAAe,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACrI,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;eAC5E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC3G,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACvC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC7H,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACjD,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAClI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,WAAW,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACtD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,EAAE,aAAa,GAAG,eAAe,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAClH,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACpF,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa;gBAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;YAC1F,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACtD,CAAC;aAAM,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;QACrH,CAAC;;YAAM,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACtD,CAAC,CAAA;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnG,IAAI,WAAW,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAChG,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,+BAA+B,IAAI,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACvH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsC,CAAA;IACvH,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAChH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,CAAC,EACxG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,OAAO;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAqB,EAAE,IAAY;IACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE;QACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE;QACzG,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;QACzH,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1F,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAA;AAClF,CAAC;AACD,SAAS,WAAW,CAAC,OAAgB;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QACpH,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAA;AAC5G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,KAA6B,EAAE,IAAkB,EAC1F,OAAkC;IAClC,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,+BAA+B;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IAC1H,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IAC5J,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC9E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAY,CAAA;QACxE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAC5H,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;IAC9B,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,uPAAuP;WAC7R,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,cAAc;WACtG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;WACjH,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;WACxF,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;WAC5F,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;WAC/F,OAAO,CAAC,oBAAoB,KAAK,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;WAChI,OAAO,CAAC,iBAAiB,KAAK,aAAa,CAAC,OAAO,CAAC,IAAuB,CAAC;WAC5E,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;WAC3G,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;WAClH,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACnJ,MAAM,4CAA4C,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzG,MAAM,+BAA+B,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAA;IACpJ,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAC3E,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAA6B;IAClF,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WACrF,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACzE,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;IACjG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC7C,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9G,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;IACrG,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACnC,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,IAAuB,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,eAAe,EACzD,2BAA2B,YAAY,SAAS,YAAY,UAAU,OAAO,CAAC,IAAI,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACzI,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACjE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;QACjB,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAA;QAC/F,MAAM,4CAA4C,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;QACnF,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC/C,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAChF,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAiB,EAAE,GAAG,aAAa,EAAE,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;YAClG,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;YAClG,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC;YAC1G,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAA;QAChI,MAAM,cAAc,GAAwB,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAA;QACpH,MAAM,OAAO,GAAmC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC1H,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YAC5H,QAAQ,EAAE,OAAO,CAAC,MAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACrI,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC;YAClH,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;QAChD,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAClJ,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC/E,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9C,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;YAClC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;gBAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;YACjJ,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAA6B;IAC/E,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WACrF,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACzE,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAA;IACnE,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC7C,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAChF,CAAC"}

package/lib/rsi-linux-runner-states.d.ts

@@ -0,0 +1,20 @@
+import { type LinuxRunnerStateSeal } from '@dsh-enhanced/assistant-isolation';
+import type { RsiAuthorityResources } from './rsi-authority-resources.js';
+import type { RsiSetupManifest } from './rsi-profile.js';
+export interface RsiLinuxRunnerStates {
+    sourceBuild: LinuxRunnerStateSeal;
+    creationReview?: LinuxRunnerStateSeal;
+    creationAdoption?: LinuxRunnerStateSeal;
+    revisionReview?: LinuxRunnerStateSeal;
+    revisionRegression?: LinuxRunnerStateSeal;
+}
+type Scope = {
+    creation: boolean;
+    revision: boolean;
+};
+export declare function validateRsiLinuxRunnerStates(resources: RsiAuthorityResources, states: RsiLinuxRunnerStates, scope: Scope): RsiLinuxRunnerStates;
+/** No authority is issued here. Existing installations only inspect the exact
+ * references in their original manifest, including never-used revision ledgers. */
+export declare function prepareRsiLinuxRunnerStates(resources: RsiAuthorityResources, scope: Scope, previous?: RsiSetupManifest): Promise<RsiLinuxRunnerStates>;
+export {};
+//# sourceMappingURL=rsi-linux-runner-states.d.ts.map

package/lib/rsi-linux-runner-states.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-runner-states.d.ts","sourceRoot":"","sources":["../src/rsi-linux-runner-states.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoD,KAAK,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAC/H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGxD,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,oBAAoB,CAAA;IACjC,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,kBAAkB,CAAC,EAAE,oBAAoB,CAAA;CAC1C;AAQD,KAAK,KAAK,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAA;AAOrD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,oBAAoB,EACzG,KAAK,EAAE,KAAK,GAAG,oBAAoB,CASpC;AAED;mFACmF;AACnF,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAC9F,QAAQ,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6B5D"}

package/lib/rsi-linux-runner-states.js

@@ -0,0 +1,70 @@
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { inspectLinuxRunnerState, prepareLinuxRunnerState } from '@dsh-enhanced/assistant-isolation';
+import { rsiBuildResources as io } from './rsi-build.js';
+const roles = {
+    sourceBuild: ['linux-source-build-runner', 'repository'],
+    creationReview: ['creation-review-runner', 'verification'],
+    creationAdoption: ['creation-adoption-runner', 'verification'],
+    revisionReview: ['revision-review-runner', 'verification'],
+    revisionRegression: ['revision-regression-runner', 'verification'],
+};
+function fail(message) { throw new Error(`rsi Linux runner states: ${message}`); }
+function selected(scope) {
+    if (scope.revision && !scope.creation)
+        fail('revision requires creation');
+    return ['sourceBuild', ...(scope.creation ? ['creationReview', 'creationAdoption'] : []),
+        ...(scope.revision ? ['revisionReview', 'revisionRegression'] : [])];
+}
+export function validateRsiLinuxRunnerStates(resources, states, scope) {
+    const expected = selected(scope);
+    if (!states || Object.keys(states).sort().join() !== [...expected].sort().join())
+        fail('incomplete frozen state references');
+    for (const role of expected) {
+        const [name, kind] = roles[role], seal = states[role];
+        if (!seal || seal.path !== join(resources.stateRoot, 'native-runner-states', `${name}.json`))
+            fail('state reference path differs');
+        inspectLinuxRunnerState({ stateRoot: join(resources.stateRoot, name), stateSeal: seal, kind });
+    }
+    return structuredClone(states);
+}
+/** No authority is issued here. Existing installations only inspect the exact
+ * references in their original manifest, including never-used revision ledgers. */
+export async function prepareRsiLinuxRunnerStates(resources, scope, previous) {
+    if (previous) {
+        const build = previous.controlPlane.sourceBuild;
+        if (!build || !('backend' in build) || build.backend !== 'linux-native' || !build.stateSeal)
+            fail('missing original repository state reference');
+        const sealOf = (runner) => {
+            if (!runner || typeof runner !== 'object' || !Object.hasOwn(runner, 'stateSeal'))
+                fail('missing original verification state reference');
+            return runner.stateSeal;
+        };
+        return validateRsiLinuxRunnerStates(resources, { sourceBuild: build.stateSeal,
+            ...(scope.creation ? { creationReview: sealOf(previous.pluginCreation?.reviews.runner),
+                creationAdoption: sealOf(previous.pluginCreation?.capabilities.runner) } : {}),
+            ...(scope.revision ? { revisionReview: sealOf(previous.pluginRevision?.reviews.runner),
+                revisionRegression: sealOf(previous.pluginRevision?.regressions.runner) } : {}) }, scope);
+    }
+    const sealRoot = join(resources.stateRoot, 'native-runner-states');
+    const directory = async (path) => {
+        try {
+            await mkdir(path, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        await io.directory(path);
+    };
+    await io.directory(resources.stateRoot);
+    await directory(sealRoot);
+    const result = {};
+    for (const role of selected(scope)) {
+        const [name, kind] = roles[role], stateRoot = join(resources.stateRoot, name);
+        await directory(stateRoot);
+        result[role] = prepareLinuxRunnerState({ stateRoot, sealPath: join(sealRoot, `${name}.json`), kind, requireEmpty: true });
+    }
+    return validateRsiLinuxRunnerStates(resources, result, scope);
+}
+//# sourceMappingURL=rsi-linux-runner-states.js.map

package/lib/rsi-linux-runner-states.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-runner-states.js","sourceRoot":"","sources":["../src/rsi-linux-runner-states.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAA6B,MAAM,mCAAmC,CAAA;AAG/H,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AASxD,MAAM,KAAK,GAAG;IACZ,WAAW,EAAE,CAAC,2BAA2B,EAAE,YAAY,CAAC;IACxD,cAAc,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1D,gBAAgB,EAAE,CAAC,0BAA0B,EAAE,cAAc,CAAC;IAC9D,cAAc,EAAE,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1D,kBAAkB,EAAE,CAAC,4BAA4B,EAAE,cAAc,CAAC;CAC1D,CAAA;AAEV,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAChG,SAAS,QAAQ,CAAC,KAAY;IAC5B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,CAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,SAAgC,EAAE,MAA4B,EACzG,KAAY;IACZ,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAC5H,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,EAAE,GAAG,IAAI,OAAO,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAClI,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;mFACmF;AACnF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAgC,EAAE,KAAY,EAC9F,QAA2B;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAA;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;QAChJ,MAAM,MAAM,GAAG,CAAC,MAAe,EAAwB,EAAE;YACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;gBAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;YACvI,OAAQ,MAA8C,CAAC,SAAS,CAAA;QAClE,CAAC,CAAA;QACD,OAAO,4BAA4B,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS;YAC3E,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC;gBACpF,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC;gBACpF,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACtD,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAAC,CAAC;QAC1C,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;QAAC,CAAC;QACrF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAA;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IACvC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;IACzB,MAAM,MAAM,GAAkC,EAAE,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC7E,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3H,CAAC;IACD,OAAO,4BAA4B,CAAC,SAAS,EAAE,MAA8B,EAAE,KAAK,CAAC,CAAA;AACvF,CAAC"}

package/lib/rsi-linux-runtime-bootstrap.d.ts

@@ -0,0 +1,10 @@
+import { type LinuxRuntimeInput, type PreparedLinuxRuntime } from '@dsh-enhanced/assistant-isolation/native-resources';
+import { type RsiSourceWorkspace } from './rsi-source.js';
+export { NODE_VERSION, NODE_ARCHIVES, LinuxRsiRuntimeUnavailableError, officialArchive, extractExact } from '@dsh-enhanced/assistant-isolation/native-resources';
+export type LinuxRsiBuildEnvironment = PreparedLinuxRuntime;
+export interface LinuxRsiBootstrapInput extends Omit<LinuxRuntimeInput, 'source' | 'revalidateSource'> {
+    source: RsiSourceWorkspace;
+}
+export declare function prepareLinuxRsiRuntime(input: LinuxRsiBootstrapInput): Promise<LinuxRsiBuildEnvironment>;
+export declare function readLinuxRsiRuntime(input: LinuxRsiBootstrapInput): Promise<LinuxRsiBuildEnvironment>;
+//# sourceMappingURL=rsi-linux-runtime-bootstrap.d.ts.map

package/lib/rsi-linux-runtime-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-runtime-bootstrap.d.ts","sourceRoot":"","sources":["../src/rsi-linux-runtime-bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAG0B,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EACjF,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGjF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,+BAA+B,EACnE,eAAe,EAAE,YAAY,EAAE,MAAM,oDAAoD,CAAA;AAC3F,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,CAAA;AAC3D,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IACpG,MAAM,EAAE,kBAAkB,CAAA;CAC3B;AA0BD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAE7G;AACD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAE1G"}

package/lib/rsi-linux-runtime-bootstrap.js

@@ -0,0 +1,38 @@
+import { isDeepStrictEqual } from 'node:util';
+import { freezeLinuxRuntimeSource, prepareLinuxRuntime, readLinuxRuntime, LinuxRsiRuntimeUnavailableError, } from '@dsh-enhanced/assistant-isolation/native-resources';
+import { readRsiSourceWorkspace } from './rsi-source.js';
+// Existing RSI import paths, constants, error identity and schema-3 receipts stay compatible.
+export { NODE_VERSION, NODE_ARCHIVES, LinuxRsiRuntimeUnavailableError, officialArchive, extractExact } from '@dsh-enhanced/assistant-isolation/native-resources';
+async function adapted(input) {
+    input.signal?.throwIfAborted();
+    if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) {
+        throw new LinuxRsiRuntimeUnavailableError('Linux x64/arm64 required');
+    }
+    input = { ...input, source: structuredClone(input.source) };
+    const expected = input.source;
+    let frozen;
+    const revalidateSource = async () => {
+        const source = await readRsiSourceWorkspace({ dshHome: input.dshHome, profile: input.profile,
+            version: expected.version, ...(expected.origin.kind === 'local-head'
+                ? { sourceRepository: expected.origin.locator } : {}),
+            ...(input.signal ? { signal: input.signal } : {}) });
+        if (!isDeepStrictEqual(source, expected))
+            throw new Error('rsi Linux runtime: frozen source receipt changed');
+        const current = await freezeLinuxRuntimeSource({ kind: 'git-object', repository: expected.repository,
+            commit: expected.sourceCommit, version: expected.version, ...(input.signal ? { signal: input.signal } : {}) });
+        if (frozen && !isDeepStrictEqual(current, frozen))
+            throw new Error('rsi Linux runtime: frozen manifest changed during prepare');
+        frozen = current;
+    };
+    await revalidateSource();
+    // The callback reopens the independently authenticated RSI workspace and Git
+    // objects before/after shared preparation; it never compares only memory.
+    return { ...input, source: frozen, revalidateSource };
+}
+export async function prepareLinuxRsiRuntime(input) {
+    return prepareLinuxRuntime(await adapted(input));
+}
+export async function readLinuxRsiRuntime(input) {
+    return readLinuxRuntime(await adapted(input));
+}
+//# sourceMappingURL=rsi-linux-runtime-bootstrap.js.map

package/lib/rsi-linux-runtime-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-runtime-bootstrap.js","sourceRoot":"","sources":["../src/rsi-linux-runtime-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACL,wBAAwB,EAAE,mBAAmB,EAAE,gBAAgB,EAC/D,+BAA+B,GAEhC,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAA2B,MAAM,iBAAiB,CAAA;AAEjF,8FAA8F;AAC9F,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,+BAA+B,EACnE,eAAe,EAAE,YAAY,EAAE,MAAM,oDAAoD,CAAA;AAM3F,KAAK,UAAU,OAAO,CAAC,KAA6B;IAClD,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,+BAA+B,CAAC,0BAA0B,CAAC,CAAA;IACvE,CAAC;IACD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAA;IAC7B,IAAI,MAAgC,CAAA;IACpC,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YAC1F,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBAClE,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QAC7G,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;YAClG,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAChH,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC/H,MAAM,GAAG,OAAO,CAAA;IAClB,CAAC,CAAA;IACD,MAAM,gBAAgB,EAAE,CAAA;IACxB,6EAA6E;IAC7E,0EAA0E;IAC1E,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAO,EAAE,gBAAgB,EAAE,CAAA;AACxD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,OAAO,mBAAmB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;AAClD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA6B;IACrE,OAAO,gBAAgB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/lib/rsi-linux-source-build.d.ts

@@ -0,0 +1,28 @@
+import { type Config as ControlPlaneConfig, type CreationCapabilityOwner } from '@dsh-enhanced/plugin-control-plane';
+import type { RsiAuthorityResources } from './rsi-authority-resources.js';
+import type { LinuxV1CgroupRoots } from './rsi-linux-cgroup-roots.js';
+import type { LinuxRsiRepositoryBuildEnvironment } from './rsi-linux-repository-bootstrap.js';
+import type { RsiSourceWorkspace } from './rsi-source.js';
+import type { LinuxRunnerStateSeal } from '@dsh-enhanced/assistant-isolation';
+/** Prepared bytes and kernel roots, before any owner execution grant exists. */
+export interface RsiLinuxSourceBuildPreparation {
+    backend: 'linux-native';
+    repository: LinuxRsiRepositoryBuildEnvironment;
+    cgroupRoots: LinuxV1CgroupRoots;
+}
+type LinuxSourceBuild = Extract<NonNullable<ControlPlaneConfig['sourceBuild']>, {
+    backend: 'linux-native';
+}>;
+/** Compile a finite repository grant only after the owner and original expiry
+ * have been fixed. This does not prepare resources, issue authority or reset a ledger. */
+export declare function compileRsiLinuxSourceBuild(input: {
+    prepared: RsiLinuxSourceBuildPreparation;
+    resources: RsiAuthorityResources;
+    source: RsiSourceWorkspace;
+    owner: CreationCapabilityOwner;
+    now: number;
+    expiresAt: number;
+    stateSeal: LinuxRunnerStateSeal;
+}): LinuxSourceBuild;
+export {};
+//# sourceMappingURL=rsi-linux-source-build.d.ts.map

package/lib/rsi-linux-source-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-source-build.d.ts","sourceRoot":"","sources":["../src/rsi-linux-source-build.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,MAAM,IAAI,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAC7G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,qCAAqC,CAAA;AAC7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,kCAAkC,CAAA;IAC9C,WAAW,EAAE,kBAAkB,CAAA;CAChC;AAED,KAAK,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAAA;AAM5G;0FAC0F;AAC1F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,EAAE,8BAA8B,CAAA;IACxC,SAAS,EAAE,qBAAqB,CAAA;IAChC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,EAAE,uBAAuB,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,oBAAoB,CAAA;CAChC,GAAG,gBAAgB,CAgCnB"}

package/lib/rsi-linux-source-build.js

@@ -0,0 +1,43 @@
+import { join, isAbsolute, resolve } from 'node:path';
+import { controlPlaneDigest, validateSourceBuildConfig } from '@dsh-enhanced/plugin-control-plane';
+const sha = /^[a-f0-9]{64}$/u;
+const canonical = (value) => typeof value === 'string' && isAbsolute(value)
+    && resolve(value) === value && !/[\p{Cc}\\]/u.test(value);
+function fail(message) { throw new Error(`rsi Linux source build: ${message}`); }
+/** Compile a finite repository grant only after the owner and original expiry
+ * have been fixed. This does not prepare resources, issue authority or reset a ledger. */
+export function compileRsiLinuxSourceBuild(input) {
+    const { prepared, resources, source, owner, now, expiresAt } = input;
+    const repository = prepared.repository;
+    if (prepared.backend !== 'linux-native' || repository.schemaVersion !== 4 || repository.backend !== 'linux-native'
+        || resources.schemaVersion !== 1 || !/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u.test(resources.installationId)
+        || !canonical(resources.stateRoot) || resources.stateRoot !== join(resources.root, 'state')
+        || source.schemaVersion !== 1 || !/^[a-f0-9]{40}$/u.test(source.sourceCommit)
+        || repository.sourceCommit !== source.sourceCommit || repository.runtime.sourceCommit !== source.sourceCommit
+        || !sha.test(repository.lockSha256) || repository.runtime.lockSha256 !== repository.lockSha256
+        || !Number.isSafeInteger(now) || now < 1 || !Number.isSafeInteger(expiresAt) || expiresAt <= now
+        || !canonical(owner.workspace) || !sha.test(owner.authorityHash)
+        || !Number.isSafeInteger(owner.principalVersion) || owner.principalVersion < 1
+        || [owner.authorityId, owner.principalId, owner.principalRecordId, owner.agentPreset]
+            .some(value => typeof value !== 'string' || value.length < 1 || value.length > 256))
+        fail('prepared owner or repository differs');
+    const body = {
+        backend: 'linux-native', runtime: repository.runtime,
+        userNamespace: repository.userNamespace, systemSnapshot: repository.systemSnapshot,
+        cgroupRoots: prepared.cgroupRoots, stateRoot: join(resources.stateRoot, 'linux-source-build-runner'),
+        stateSeal: input.stateSeal,
+        expiresAt, maxRuns: 48, maxTotalDurationMs: 86_400_000,
+        timeoutMs: 1_800_000, outputBytes: 65_536, versioning: 'patch',
+        memoryMiB: 16_384, cpus: 8, pidsLimit: 1_024,
+        workspaceMiB: 8_192, temporaryMiB: 4_096, workspaceInodes: 1_000_000, temporaryInodes: 1_000_000,
+    };
+    const config = { ...structuredClone(body), authorityDigest: controlPlaneDigest({
+            protocol: 'dsh-rsi-linux-source-build-grant/v1', installationId: resources.installationId,
+            owner, source, limitsAndRuntime: body,
+        }) };
+    // Validate this component here. The complete Control Plane is validated after
+    // its durable sourceJobs and independent authorities have been composed.
+    validateSourceBuildConfig(config);
+    return config;
+}
+//# sourceMappingURL=rsi-linux-source-build.js.map

package/lib/rsi-linux-source-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-linux-source-build.js","sourceRoot":"","sources":["../src/rsi-linux-source-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EACa,MAAM,oCAAoC,CAAA;AAe7G,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC;OACvF,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3D,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAE/F;0FAC0F;AAC1F,MAAM,UAAU,0BAA0B,CAAC,KAQ1C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IACpE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACtC,IAAI,QAAQ,CAAC,OAAO,KAAK,cAAc,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,KAAK,cAAc;WAC7G,SAAS,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;WACzI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;WACxF,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;WAC1E,UAAU,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WAC1G,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU;WAC3F,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG;WAC7F,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;WAC7D,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC;WAC3E,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC;aAClF,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACrI,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,cAAuB,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC7D,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc;QAClF,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,2BAA2B,CAAC;QACpG,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU;QACtD,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAgB;QACvE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK;QAC5C,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS;KACjG,CAAA;IACD,MAAM,MAAM,GAAqB,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC;YAC/F,QAAQ,EAAE,qCAAqC,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc;YACzF,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI;SACtC,CAAC,EAAE,CAAA;IACJ,8EAA8E;IAC9E,yEAAyE;IACzE,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC"}

package/lib/rsi-local-install.d.ts

@@ -20,6 +20,8 @@ export interface RsiLocalProfileInput {
     bundles: readonly string[];
     dsh: Pick<InstalledRsiDsh, 'path' | 'pin'>;
     signal: AbortSignal;
+    /** Fresh disposable consumer only: native install resolves existing mounts before list can inspect them. */
+    initializeFromManifest?: true;
 }
 export interface RsiLocalProfilePorts {
     command: typeof io.command;