@dsh-enhanced/lark-channel 0.1.65 → 0.1.67

package/lib/rsi-scanner-retirement-transition.js

@@ -0,0 +1,320 @@
+import { createHash } from 'node:crypto';
+import { externalPrincipalId, ownerRouteAuthorityHash } from '@dsh-enhanced/assistant-delivery';
+const scannerPrefixes = {
+    'assistant-memory-learning': 'memory-scan-',
+    'assistant-growth-usage': 'usage-scan-',
+    'plugin-control-plane-task-observations': 'task-observation-scan-',
+    'plugin-control-plane-live-qualification': 'live-qualification-scan-',
+};
+export const scannerRetirementTransitionProtocol = 'lark-channel/scanner-retirement-transition/v1';
+export class ScannerRetirementTransitionError extends Error {
+    code;
+    constructor(code) {
+        super(`scanner retirement transition rejected: ${code}`);
+        this.code = code;
+        this.name = 'ScannerRetirementTransitionError';
+    }
+}
+const digestPattern = /^[a-f0-9]{64}$/u;
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+const jsonDigest = (value) => digest(JSON.stringify(value));
+const integer = (value, minimum = 0) => typeof value === 'number'
+    && Number.isSafeInteger(value) && value >= minimum;
+function reject(code) { throw new ScannerRetirementTransitionError(code); }
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(',')}}`;
+}
+function same(left, right) { return canonicalJson(left) === canonicalJson(right); }
+function freeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.values(value).forEach(freeze);
+        Object.freeze(value);
+    }
+    return value;
+}
+function uniqueMap(items, key, code) {
+    const result = new Map();
+    for (const item of items) {
+        const identity = key(item);
+        if (result.has(identity))
+            reject(code);
+        result.set(identity, item);
+    }
+    return result;
+}
+const markerKey = (marker) => JSON.stringify([marker.owner, marker.automationId]);
+const schemaKey = (entry) => JSON.stringify([entry.type, entry.name]);
+/** Reconstruct the exact scope insertion order passed by each production scanner runtime. */
+function ownerEvidence(proof) {
+    if (proof.protocol !== 'assistant-delivery/revoked-owner-route-snapshot/v1'
+        || ![23, 24, 25, 26, 27, 28, 29, 30, 31].includes(proof.schemaVersion)
+        || !integer(proof.frozenPrincipalVersion, 1) || !digestPattern.test(proof.snapshotDigest))
+        reject('invalid-proof');
+    const authority = proof.authority;
+    const authorityHash = ownerRouteAuthorityHash(authority);
+    // The public hash function validates the full authority and canonicalizes it.
+    // Rebuild canonical field order to reject noncanonical values while accepting
+    // arbitrary incoming JSON key order, without importing another bundle's internals.
+    const conversation = authority.conversation;
+    const principal = authority.principal;
+    const orderedAuthority = {
+        id: authority.id,
+        conversation: { channel: conversation.channel, account: conversation.account, tenant: conversation.tenant,
+            kind: conversation.kind, chat: conversation.chat, ...(conversation.thread === undefined ? {} : { thread: conversation.thread }) },
+        principal: { channel: principal.channel, account: principal.account, tenant: principal.tenant, user: principal.user },
+        workspace: authority.workspace, agentPreset: authority.agentPreset, policyRef: authority.policyRef,
+        minimumGeneration: authority.minimumGeneration,
+    };
+    if (jsonDigest(orderedAuthority) !== authorityHash)
+        reject('invalid-proof');
+    const state = proof.state;
+    if (state.status !== 'revoked' || state.authorityId !== authority.id || state.authorityHash !== authorityHash
+        || state.principalId !== externalPrincipalId(principal)
+        || typeof state.principalRecordId !== 'string' || !/^principal_[0-9a-f-]{8,}$/u.test(state.principalRecordId)
+        || !integer(state.principalVersion, 1) || state.principalVersion < proof.frozenPrincipalVersion)
+        reject('invalid-proof');
+    const orderedState = { status: 'revoked', authorityId: authority.id, authorityHash,
+        principalId: externalPrincipalId(principal), principalRecordId: state.principalRecordId, principalVersion: state.principalVersion };
+    if (!same(state, orderedState))
+        reject('invalid-proof');
+    const { snapshotDigest, ...unsigned } = proof;
+    if (digest(canonicalJson(unsigned)) !== snapshotDigest)
+        reject('invalid-proof');
+    return owner => jsonDigest({ protocol: 'scanner-owner-revoked/v1',
+        scope: { authorityId: authority.id, principalId: orderedState.principalId,
+            workspace: authority.workspace, agentPreset: authority.agentPreset,
+            ...(owner === 'assistant-memory-learning' ? { expectedOwner: { authorityHash,
+                    principalRecordId: orderedState.principalRecordId, principalVersion: proof.frozenPrincipalVersion } } : {}) },
+        state: orderedState });
+}
+function stableDefinition(record) {
+    const { status: _status, nextRunAt: _nextRunAt, updatedAt: _updatedAt, version: _version, ...stable } = record;
+    return stable;
+}
+/** Reproduce SQLite ADD COLUMN's insertion before the table constraints. */
+function addRunQuiescenceColumnSql(sql) {
+    if (sql === null)
+        return undefined;
+    let depth = 0;
+    // Skip quoted strings/identifiers and comments when finding structural commas.
+    const tokens = /'(?:''|[^'])*'|"(?:""|[^"])*"|`(?:``|[^`])*`|\[[^\]]*\]|--[^\n]*|\/\*[\s\S]*?\*\/|[(),]/gu;
+    for (const token of sql.matchAll(tokens)) {
+        if (token[0] === '(')
+            depth++;
+        if (token[0] === ')') {
+            depth--;
+            if (depth === 0)
+                return `${sql.slice(0, token.index)}, quiescent INTEGER CHECK(quiescent IN (0, 1))${sql.slice(token.index)}`;
+        }
+        if (token[0] === ',' && depth === 1
+            && /^\s*(?:CHECK|CONSTRAINT|FOREIGN\s+KEY|PRIMARY\s+KEY|UNIQUE)\b/iu.test(sql.slice(token.index + 1))) {
+            return `${sql.slice(0, token.index)}, quiescent INTEGER CHECK(quiescent IN (0, 1))${sql.slice(token.index)}`;
+        }
+    }
+    return undefined;
+}
+function verifySchema(before, after) {
+    const original = uniqueMap(before.schemaEntries, schemaKey, 'schema-changed');
+    const current = uniqueMap(after.schemaEntries, schemaKey, 'schema-changed');
+    const upgradesQuiescence = before.schemaVersion < 17 && after.schemaVersion === 17;
+    for (const [key, entry] of original) {
+        const updated = current.get(key);
+        if (upgradesQuiescence && entry.type === 'table' && entry.name === 'automation_runs') {
+            // Preserve every byte of the pre-existing SQL, including table constraints.
+            const expectedSql = addRunQuiescenceColumnSql(entry.sql);
+            if (typeof expectedSql !== 'string' || expectedSql === entry.sql
+                || !same({ ...entry, sql: expectedSql }, updated))
+                reject('schema-changed');
+        }
+        else if (!same(entry, updated))
+            reject('schema-changed');
+    }
+    if (before.schemaVersion === after.schemaVersion) {
+        if (original.size !== current.size || !same(before.schemaEntries, after.schemaEntries)
+            || before.schemaDigest !== after.schemaDigest)
+            reject('schema-changed');
+        return;
+    }
+    // Formal readers verify the exact retirement table/trigger SQL. Preserve the
+    // historical seven-identity v15->v16 allowance; upgrading to v17 additionally
+    // permits only the exact run quiescence column and immutable trigger.
+    const additions = before.schemaVersion === 15 ? [
+        { type: 'table', name: 'automation_system_retirements', table: 'automation_system_retirements', sql: '' },
+        { type: 'index', name: 'sqlite_autoindex_automation_system_retirements_1', table: 'automation_system_retirements', sql: null },
+        { type: 'index', name: 'sqlite_autoindex_automation_system_retirements_2', table: 'automation_system_retirements', sql: null },
+        { type: 'trigger', name: 'automation_retirements_no_update', table: 'automation_system_retirements', sql: '' },
+        { type: 'trigger', name: 'automation_retirements_no_delete', table: 'automation_system_retirements', sql: '' },
+        { type: 'trigger', name: 'automation_retired_no_activate_insert', table: 'automation_definitions', sql: '' },
+        { type: 'trigger', name: 'automation_retired_no_activate_update', table: 'automation_definitions', sql: '' },
+    ] : [];
+    if (upgradesQuiescence)
+        additions.push({ type: 'trigger', name: 'automation_run_quiescence_immutable',
+            table: 'automation_runs', sql: `CREATE TRIGGER automation_run_quiescence_immutable\n  BEFORE UPDATE OF quiescent ON automation_runs WHEN NEW.quiescent IS NOT OLD.quiescent\n  BEGIN SELECT RAISE(ABORT, 'run quiescence observation is immutable'); END` });
+    const allowed = new Map(additions.map(entry => [schemaKey(entry), entry]));
+    if (current.size !== original.size + allowed.size)
+        reject('schema-changed');
+    for (const [key, entry] of current) {
+        if (original.has(key))
+            continue;
+        const expected = allowed.get(key);
+        if (expected === undefined || entry.table !== expected.table
+            || (entry.name === 'automation_run_quiescence_immutable' && entry.sql !== expected.sql)
+            || (expected.sql === null ? entry.sql !== null : typeof entry.sql !== 'string' || entry.sql.length === 0))
+            reject('schema-changed');
+        allowed.delete(key);
+    }
+    if (allowed.size !== 0)
+        reject('schema-changed');
+}
+/**
+ * Freeze the exact operations before any staged service is mounted. Inputs have
+ * the same trusted-reader and independently derived configuration requirements
+ * as transition verification. These tuples confer no permission: the writer must
+ * use the formal Automations service and retain them unchanged across retries.
+ */
+export function prepareScannerRetirementOperations(input) {
+    try {
+        const { before, ownerProof } = input;
+        if (before.protocol !== 'assistant-automations/retirement-snapshot/v1'
+            || ![15, 16, 17].includes(before.schemaVersion) || before.inFlightCount !== 0
+            || !digestPattern.test(before.snapshotDigest))
+            reject('invalid-proof');
+        const evidenceForOwner = ownerEvidence(ownerProof);
+        if (!Array.isArray(input.targets) || input.targets.length > 4)
+            reject('invalid-targets');
+        const originals = uniqueMap(before.records, record => record.id, 'definitions-changed');
+        const oldMarkers = uniqueMap(before.retirements, markerKey, 'retirements-changed');
+        if (before.schemaVersion === 15 && oldMarkers.size !== 0)
+            reject('retirements-changed');
+        const owners = new Set();
+        return freeze(input.targets.map((inputTarget) => {
+            const target = { owner: inputTarget.owner, automationId: inputTarget.automationId };
+            const prefix = Object.hasOwn(scannerPrefixes, target.owner) ? scannerPrefixes[target.owner] : undefined;
+            if (!same(target, inputTarget) || prefix === undefined || typeof target.automationId !== 'string'
+                || !new RegExp(`^${prefix}[a-f0-9]{64}$`, 'u').test(target.automationId) || owners.has(target.owner))
+                reject('invalid-targets');
+            owners.add(target.owner);
+            const record = originals.get(target.automationId);
+            if (record === undefined || record.owner !== target.owner || record.runningTaskCount !== 0
+                || !['active', 'paused'].includes(record.status) || !integer(record.version, 1)
+                || !digestPattern.test(record.definitionHash))
+                reject('definitions-changed');
+            if (oldMarkers.has(markerKey(target)))
+                reject('retirements-changed');
+            const evidenceDigest = evidenceForOwner(target.owner);
+            return { ...target, definitionHash: record.definitionHash, expectedVersion: record.version,
+                operationId: `owner-revoked:${jsonDigest([target.owner, target.automationId, record.definitionHash, record.version, evidenceDigest])}`,
+                reason: 'owner-revoked', evidenceDigest };
+        }));
+    }
+    catch (error) {
+        if (error instanceof ScannerRetirementTransitionError)
+            throw error;
+        return reject('invalid-proof');
+    }
+}
+/**
+ * Pure verification of a preselected retirement change; grants no write or execution permission.
+ * Both snapshots and ownerProof MUST come from the formal trusted local readers.
+ * The parent installer MUST independently derive exact targets from frozen effective
+ * configuration and bind that configuration, owner route and transaction to this call.
+ * For Memory, ownerProof.frozenPrincipalVersion MUST equal the frozen learning
+ * grant owner.principalVersion; its expectedOwner scope uses that grant version,
+ * while the observed revoked state can be at a later durable principal version.
+ * A matching scanner prefix does not prove that a definition belongs to that config.
+ * Digests are consistency checks after trusted reads, never external authenticity signatures.
+ */
+export function verifyScannerRetirementTransition(input) {
+    try {
+        const { before, after, ownerProof } = input;
+        if (before.protocol !== 'assistant-automations/retirement-snapshot/v1' || after.protocol !== before.protocol
+            || ![15, 16, 17].includes(before.schemaVersion) || ![16, 17].includes(after.schemaVersion)
+            || after.schemaVersion < before.schemaVersion
+            || before.inFlightCount !== 0 || after.inFlightCount !== 0
+            || !digestPattern.test(before.snapshotDigest) || !digestPattern.test(after.snapshotDigest))
+            reject('invalid-proof');
+        const operations = prepareScannerRetirementOperations(input);
+        const targets = input.targets.map(target => ({ owner: target.owner, automationId: target.automationId }));
+        const selected = uniqueMap(targets, target => target.automationId, 'invalid-targets');
+        const originals = uniqueMap(before.records, record => record.id, 'definitions-changed');
+        const current = uniqueMap(after.records, record => record.id, 'definitions-changed');
+        if (originals.size !== current.size)
+            reject('definitions-changed');
+        for (const [id, record] of originals) {
+            const updated = current.get(id);
+            if (updated === undefined || record.runningTaskCount !== 0 || updated.runningTaskCount !== 0
+                || record.immutableDigest !== updated.immutableDigest)
+                reject('definitions-changed');
+            if (!selected.has(id) && !same(record, updated))
+                reject('definitions-changed');
+        }
+        const oldMarkers = uniqueMap(before.retirements, markerKey, 'retirements-changed');
+        const newMarkers = uniqueMap(after.retirements, markerKey, 'retirements-changed');
+        uniqueMap(after.retirements, marker => marker.operationId, 'retirements-changed');
+        if ((before.schemaVersion === 15 && oldMarkers.size !== 0)
+            || newMarkers.size !== oldMarkers.size + targets.length)
+            reject('retirements-changed');
+        for (const [key, marker] of oldMarkers)
+            if (!same(marker, newMarkers.get(key)))
+                reject('retirements-changed');
+        const receipts = targets.map((target, index) => {
+            const operation = operations[index];
+            const { evidenceDigest } = operation;
+            const record = originals.get(target.automationId);
+            const updated = current.get(target.automationId);
+            if (record === undefined || updated === undefined || record.owner !== target.owner
+                || (record.status !== 'active' && record.status !== 'paused') || record.runningTaskCount !== 0
+                || updated.runningTaskCount !== 0 || !integer(record.version, 1) || !integer(updated.version, 2)
+                || updated.version !== record.version + 1 || updated.status !== 'paused' || Object.hasOwn(updated, 'nextRunAt')
+                || !same(stableDefinition(record), stableDefinition(updated)))
+                reject('definitions-changed');
+            const key = markerKey(target);
+            const marker = newMarkers.get(key);
+            if (oldMarkers.has(key) || marker === undefined || !integer(marker.retiredAt)
+                || updated.updatedAt !== marker.retiredAt)
+                reject('retirements-changed');
+            const expected = {
+                ...operation, definitionVersion: updated.version, automationStatus: 'paused', retiredAt: marker.retiredAt,
+            };
+            if (!same(marker, expected))
+                reject('retirements-changed');
+            return { ...target, evidenceDigest, markerDigest: digest(canonicalJson(expected)) };
+        });
+        const history = uniqueMap(before.historyTables, table => table.name, 'history-changed');
+        const updatedHistory = uniqueMap(after.historyTables, table => table.name, 'history-changed');
+        if (history.size !== updatedHistory.size)
+            reject('history-changed');
+        for (const [index, table] of before.historyTables.entries()) {
+            const updated = updatedHistory.get(table.name);
+            if (after.historyTables[index]?.name !== table.name)
+                reject('history-changed');
+            if (before.schemaVersion < 17 && after.schemaVersion === 17 && table.name === 'automation_runs') {
+                // Only the trusted reader can compute this old-column projection. The
+                // new nullable column must carry no retrospectively signed observations.
+                if (!updated || updated.rowCount !== table.rowCount || updated.legacyDigest !== table.digest
+                    || updated.nonNullQuiescentCount !== 0
+                    || Object.keys(table).sort().join(',') !== 'digest,name,rowCount'
+                    || Object.keys(updated).sort().join(',') !== 'digest,legacyDigest,name,nonNullQuiescentCount,rowCount')
+                    reject('history-changed');
+            }
+            else if (!same(table, updated))
+                reject('history-changed');
+        }
+        verifySchema(before, after);
+        receipts.sort((left, right) => left.owner < right.owner ? -1 : left.owner > right.owner ? 1 : 0);
+        const unsigned = { protocol: scannerRetirementTransitionProtocol, beforeSnapshotDigest: before.snapshotDigest,
+            afterSnapshotDigest: after.snapshotDigest, ownerProofSnapshotDigest: ownerProof.snapshotDigest, targets: receipts };
+        return freeze({ ...unsigned, receiptDigest: digest(canonicalJson(unsigned)) });
+    }
+    catch (error) {
+        if (error instanceof ScannerRetirementTransitionError)
+            throw error;
+        return reject('invalid-proof');
+    }
+}
+//# sourceMappingURL=rsi-scanner-retirement-transition.js.map

package/lib/rsi-scanner-retirement-transition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-scanner-retirement-transition.js","sourceRoot":"","sources":["../src/rsi-scanner-retirement-transition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAG/F,MAAM,eAAe,GAAG;IACtB,2BAA2B,EAAE,cAAc;IAC3C,wBAAwB,EAAE,aAAa;IACvC,wCAAwC,EAAE,wBAAwB;IAClE,yCAAyC,EAAE,0BAA0B;CAC7D,CAAA;AAiBV,MAAM,CAAC,MAAM,mCAAmC,GAAG,+CAAwD,CAAA;AAc3G,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,IAA0C;QAC7D,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAA;QADrC,SAAI,GAAJ,IAAI,CAAsC;QAE7D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAA;IAChD,CAAC;CACF;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AACvC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1F,MAAM,UAAU,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5E,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,OAAO,GAAG,CAAC,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;OACtF,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,CAAA;AAEpD,SAAS,MAAM,CAAC,IAA0C,IAAW,MAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACvH,CAAC;AACD,SAAS,IAAI,CAAC,IAAa,EAAE,KAAc,IAAa,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAC7G,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,SAAS,CAAI,KAAmB,EAAE,GAAwB,EAAE,IAA0C;IAC7G,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,MAA+C,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;AAClI,MAAM,SAAS,GAAG,CAAC,KAAsC,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;AAE9G,6FAA6F;AAC7F,SAAS,aAAa,CAAC,KAAgC;IACrD,IAAI,KAAK,CAAC,QAAQ,KAAK,oDAAoD;WACtE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;WACnE,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IACpH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACjC,MAAM,aAAa,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAA;IACxD,8EAA8E;IAC9E,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAA;IACrC,MAAM,gBAAgB,GAAG;QACvB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,YAAY,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM;YACvG,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE;QACnI,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;QACrH,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS;QAClG,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAA;IACD,IAAI,UAAU,CAAC,gBAAgB,CAAC,KAAK,aAAa;QAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa;WACxG,KAAK,CAAC,WAAW,KAAK,mBAAmB,CAAC,SAAS,CAAC;WACpD,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAC1G,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,sBAAsB;QAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAC1H,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,SAAkB,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa;QACzF,WAAW,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAA;IACrI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;QAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IACvD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,KAAK,cAAc;QAAE,MAAM,CAAC,eAAe,CAAC,CAAA;IAC/E,OAAO,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,0BAA0B;QAC/D,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW;YACvE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW;YAClE,GAAG,CAAC,KAAK,KAAK,2BAA2B,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,aAAa;oBAC1E,iBAAiB,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACjH,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4C;IACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAA;IAC9G,OAAO,MAAM,CAAA;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,yBAAyB,CAAC,GAAkB;IACnD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAClC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,+EAA+E;IAC/E,MAAM,MAAM,GAAG,2FAA2F,CAAA;IAC1G,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,KAAK,EAAE,CAAA;YACP,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAA;QAC/H,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;eAC9B,iEAAiE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAA;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,MAAoC,EAAE,KAAmC;IAC7F,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC7E,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,CAAA;IAClF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACrF,4EAA4E;YAC5E,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACxD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,KAAK,CAAC,GAAG;mBAC3D,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC/E,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC;eACjF,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,SAAS,GAAsC,MAAM,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,EAAE;QACzG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kDAAkD,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,IAAI,EAAE;QAC9H,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kDAAkD,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,IAAI,EAAE;QAC9H,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,EAAE;QAC9G,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kCAAkC,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE,EAAE,EAAE;QAC9G,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,uCAAuC,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,EAAE;QAC5G,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,uCAAuC,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,EAAE;KAC7G,CAAC,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,kBAAkB;QAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qCAAqC;YACnG,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,0NAA0N,EAAE,CAAC,CAAA;IAC9P,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC3E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;eACvD,CAAC,KAAK,CAAC,IAAI,KAAK,qCAAqC,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;eACpF,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACrI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAsD;IAEtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,8CAA8C;eACjE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;eAC1E,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YAAE,MAAM,CAAC,eAAe,CAAC,CAAA;QACxE,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACxF,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAA;QACvF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAA;QAClF,IAAI,MAAM,CAAC,aAAa,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;QAChC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAoC,EAAE,EAAE;YACvE,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAA;YAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACvG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;mBAC5F,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM,eAAe,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;YACjI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACxB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACjD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB,KAAK,CAAC;mBACrF,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;mBAC5E,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC9E,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YACpE,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrD,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO;gBACxF,WAAW,EAAE,iBAAiB,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE;gBACtI,MAAM,EAAE,eAAwB,EAAE,cAAc,EAAE,CAAA;QACtD,CAAC,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gCAAgC;YAAE,MAAM,KAAK,CAAA;QAClE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAuC;IACvF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,8CAA8C,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;eACvG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;eACvF,KAAK,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa;eAC1C,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;eACvD,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,MAAM,CAAC,eAAe,CAAC,CAAA;QACrH,MAAM,UAAU,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAA;QAC5D,MAAM,OAAO,GAA8B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;QACpI,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAA;QACrF,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAA;QACvF,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAA;QACpF,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAClE,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,KAAK,CAAC;mBACvF,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YACtF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAA;QACjF,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;eACrD,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACxF,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC7G,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAE,CAAA;YACpC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;YACpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAChD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;mBAC7E,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,CAAC;mBAC3F,OAAO,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;mBAC7F,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;mBAC5G,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC9F,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;YAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;mBACxE,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC1E,MAAM,QAAQ,GAAgC;gBAC5C,GAAG,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;aAC1G,CAAA;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC1D,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAA;QACrF,CAAC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACvF,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9C,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;gBAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;YAC9E,IAAI,MAAM,CAAC,aAAa,GAAG,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAChG,sEAAsE;gBACtE,yEAAyE;gBACzE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;uBACvF,OAAO,CAAC,qBAAqB,KAAK,CAAC;uBACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,sBAAsB;uBAC9D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,yDAAyD;oBAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;YACrI,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;QAC7D,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC3B,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChG,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,mCAAmC,EAAE,oBAAoB,EAAE,MAAM,CAAC,cAAc;YAC3G,mBAAmB,EAAE,KAAK,CAAC,cAAc,EAAE,wBAAwB,EAAE,UAAU,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QACrH,OAAO,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gCAAgC;YAAE,MAAM,KAAK,CAAA;QAClE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}

package/lib/rsi-setup.d.ts

@@ -20,7 +20,14 @@ export interface RsiSetupArgs {
     dockerPath?: string;
     prepareAuthorities?: boolean;
     installOwner?: boolean;
+    /** Read-only onboarding wait: poll until the owner's first Lark DM binding exists. */
+    waitOwnerDm?: boolean;
+    timeoutSeconds?: number;
     ackExistingAutomations?: boolean;
+    /** Fresh-install-only ordinary-use learning assembly; retries preserve the stored opt-in. */
+    enableOrdinaryUseLearning?: boolean;
+    intakeProvider?: string;
+    intakeModel?: string;
     /** Installer's pre-stop source and destination inventories; never parsed from CLI. */
     expectedAutomationInventories?: RsiAutomationInventories;
     installLocalCohort?: boolean;
@@ -59,5 +66,22 @@ export declare function configureRsiSetupLocked(args: RsiSetupArgs, ports?: RsiS
     mode: string;
     profiles: readonly string[];
 }>;
+export interface OwnerDmWaitResult {
+    mode: 'ready' | 'timeout' | 'ambiguous';
+    bindings: number;
+}
+/**
+ * Onboarding helper: read-only poll of the delivery database until the owner's
+ * first Lark DM has produced exactly one active owner binding. It never creates
+ * or widens a binding; owner authorization stays with the Lark DSH-CONNECT flow.
+ * A missing database is "not yet" because the Host creates it on first message.
+ */
+export declare function waitForOwnerDmBinding(input: {
+    profile: string;
+    dshHome: string;
+    timeoutMs: number;
+    intervalMs?: number;
+    signal?: AbortSignal;
+}, ports?: Pick<RsiSetupPorts, 'dump' | 'snapshot'>, sleep?: (ms: number, signal?: AbortSignal) => Promise<void>, now?: () => number): Promise<OwnerDmWaitResult>;
 export declare function runRsiSetup(argv?: readonly string[]): Promise<void>;
 //# sourceMappingURL=rsi-setup.d.ts.map

package/lib/rsi-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsi-setup.d.ts","sourceRoot":"","sources":["../src/rsi-setup.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACa,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAS9G,OAAO,EAA6B,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAA;AA6BtE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU9E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;IAChI,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACpE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACpE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,sFAAsF;IACtF,6BAA6B,CAAC,EAAE,wBAAwB,CAAA;IACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AACD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAkFvE;AA4FD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACnF,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACrF,OAAO,EAAE,OAAO,kBAAkB,CAAA;IAClC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/J,mBAAmB,EAAE,OAAO,6BAA6B,CAAA;IACzD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IACtD,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrG,cAAc,IAAI,IAAI,CAAA;IACtB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvI;AAED,eAAO,MAAM,aAAa,EAAE,aAgC3B,CAAA;AAED,kFAAkF;AAClF,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5J;AAED,yFAAyF;AACzF,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EzL;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAExJ;AAED,iFAAiF;AACjF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAiG9J;AAED,wBAAsB,WAAW,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkHhG"}
+{"version":3,"file":"rsi-setup.d.ts","sourceRoot":"","sources":["../src/rsi-setup.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACa,KAAK,wBAAwB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAU9G,OAAO,EAA6B,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAA;AA6BtE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU9E;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;IAChI,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACpE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACpE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,sFAAsF;IACtF,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAC9C,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,6FAA6F;IAC7F,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sFAAsF;IACtF,6BAA6B,CAAC,EAAE,wBAAwB,CAAA;IACxD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAChD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AACD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAiHvE;AA4FD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACnF,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACrF,OAAO,EAAE,OAAO,kBAAkB,CAAA;IAClC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/J,mBAAmB,EAAE,OAAO,6BAA6B,CAAA;IACzD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IACtD,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrG,cAAc,IAAI,IAAI,CAAA;IACtB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvI;AAED,eAAO,MAAM,aAAa,EAAE,aAgC3B,CAAA;AAED,kFAAkF;AAClF,wBAAsB,iCAAiC,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5J;AAED,yFAAyF;AACzF,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EzL;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAExJ;AAED,iFAAiF;AACjF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,GAAE,aAA6B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAiG9J;AAED,MAAM,WAAW,iBAAiB;IAAG,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAEhG;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC/F,EAAE,KAAK,GAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,CAAiB,EAClE,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAGvD,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY5D;AAED,wBAAsB,WAAW,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJhG"}

package/lib/rsi-setup.js

@@ -14,6 +14,7 @@ import { installDshResidentService } from './resident.js';
 import { prepareRsiSourceWorkspace } from './rsi-source.js';
 import { prepareRsiBuildEnvironment, RsiBuildUnavailableError } from './rsi-build.js';
 import { prepareRsiReleaseBuildEnvironment, RsiReleaseBuildUnavailableError } from './rsi-release-build.js';
+import { prepareLinuxRsiRuntime, LinuxRsiRuntimeUnavailableError } from './rsi-linux-runtime-bootstrap.js';
 import { prepareRsiAuthorityRuntime } from './rsi-authority-runtime.js';
 import { prepareRsiAuthorityResources } from './rsi-authority-resources.js';
 import { version } from './version.js';
@@ -92,8 +93,18 @@ export function parseRsiSetupArgs(argv) {
             result.prepareAuthorities = true;
         else if (key === '--install-owner')
             result.installOwner = true;
+        else if (key === '--wait-owner-dm')
+            result.waitOwnerDm = true;
+        else if (key === '--timeout-seconds') {
+            const value = argv[++i];
+            if (!value || !/^[1-9][0-9]{0,4}$/u.test(value) || Number(value) > 3600)
+                fail('--timeout-seconds requires an integer from 1 to 3600');
+            result.timeoutSeconds = Number(value);
+        }
         else if (key === '--ack-existing-automations')
             result.ackExistingAutomations = true;
+        else if (key === '--enable-ordinary-use-learning')
+            result.enableOrdinaryUseLearning = true;
         else if (key === '--install-local-cohort')
             result.installLocalCohort = true;
         else if (key === '--prepare-local-update')
@@ -108,7 +119,8 @@ export function parseRsiSetupArgs(argv) {
         }
         else if (key === '--optional-build')
             result.optionalBuild = true;
-        else if (key === '--manifest' || key === '--dsh-home' || key === '--profile' || key === '--source-repository' || key === '--docker-path') {
+        else if (key === '--manifest' || key === '--dsh-home' || key === '--profile' || key === '--source-repository' || key === '--docker-path'
+            || key === '--intake-provider' || key === '--intake-model') {
             const value = argv[++i];
             if (!value || value.startsWith('--'))
                 fail(`${key} needs a value`);
@@ -120,6 +132,10 @@ export function parseRsiSetupArgs(argv) {
                 result.sourceRepository = value;
             else if (key === '--docker-path')
                 result.dockerPath = value;
+            else if (key === '--intake-provider')
+                result.intakeProvider = value;
+            else if (key === '--intake-model')
+                result.intakeModel = value;
             else
                 result.dshHome = value;
         }
@@ -128,6 +144,27 @@ export function parseRsiSetupArgs(argv) {
     }
     if (result.help)
         return result;
+    if (result.enableOrdinaryUseLearning && !result.installOwner)
+        fail('--enable-ordinary-use-learning requires --install-owner');
+    if ((result.intakeProvider === undefined) !== (result.intakeModel === undefined))
+        fail('--intake-provider and --intake-model must be provided together');
+    if ((result.intakeProvider !== undefined || result.intakeModel !== undefined) && result.enableOrdinaryUseLearning !== true) {
+        fail('--intake-provider/--intake-model require --enable-ordinary-use-learning');
+    }
+    if (result.timeoutSeconds !== undefined && !result.waitOwnerDm)
+        fail('--timeout-seconds requires --wait-owner-dm');
+    if (result.waitOwnerDm) {
+        if (result.manifestPath || result.apply || result.rollback || result.start || result.confirmStopped || result.installOwner
+            || result.prepareSource || result.prepareBuild || result.prepareAuthorities || result.optionalBuild || result.dockerPath
+            || result.sourceRepository || result.ackExistingAutomations || result.installLocalCohort || result.bundles
+            || result.prepareLocalUpdate || result.addMemoryLearning || result.enableOrdinaryUseLearning
+            || result.intakeProvider || result.intakeModel) {
+            fail('owner DM wait cannot be combined with other operations');
+        }
+        if (!isAbsolute(result.dshHome) || !result.profile || !profilePattern.test(result.profile))
+            fail('owner DM wait requires --profile and absolute DSH_HOME');
+        return result;
+    }
     if (result.addMemoryLearning && !result.prepareLocalUpdate)
         fail('--add-memory-learning requires --prepare-local-update');
     if (result.ackExistingAutomations && (!result.installOwner && !result.apply || result.rollback
@@ -136,12 +173,18 @@ export function parseRsiSetupArgs(argv) {
     if (result.prepareLocalUpdate) {
         if (result.installLocalCohort || result.installOwner || result.prepareSource || result.prepareBuild
             || result.prepareAuthorities || result.manifestPath || result.apply || result.rollback || result.start
-            || result.confirmStopped || result.optionalBuild || result.dockerPath || result.bundles)
+            || result.confirmStopped || result.optionalBuild || result.bundles)
             fail('local update preparation cannot be combined with other operations');
         if (!isAbsolute(result.dshHome) || !result.profile || !profilePattern.test(result.profile))
             fail('local update preparation requires --profile and absolute DSH_HOME');
         if (result.sourceRepository && !isAbsolute(result.sourceRepository))
             fail('--source-repository must be absolute');
+        // Linux defaults to the native runtime; an explicit absolute --docker-path
+        // keeps a legacy image receipt replayable during coexistence.
+        if (result.dockerPath && process.platform === 'darwin')
+            fail('--docker-path is not supported by macOS native build preparation');
+        if (result.dockerPath && !isAbsolute(result.dockerPath))
+            fail('--docker-path must be absolute');
         return result;
     }
     if (result.bundles && !result.installLocalCohort)
@@ -662,12 +705,60 @@ export async function configureRsiSetupLocked(args, ports = rsiSetupPorts) {
         return { mode: args.start ? 'services-started' : 'configured', profiles: pair };
     })();
 }
+/**
+ * Onboarding helper: read-only poll of the delivery database until the owner's
+ * first Lark DM has produced exactly one active owner binding. It never creates
+ * or widens a binding; owner authorization stays with the Lark DSH-CONNECT flow.
+ * A missing database is "not yet" because the Host creates it on first message.
+ */
+export async function waitForOwnerDmBinding(input, ports = rsiSetupPorts, sleep = (ms, signal) => new Promise((resolveSleep, reject) => {
+    const timer = setTimeout(resolveSleep, ms);
+    signal?.addEventListener('abort', () => { clearTimeout(timer); reject(signal.reason); }, { once: true });
+}), now = Date.now) {
+    const effective = ports.dump(input.profile, input.dshHome);
+    const deadline = now() + input.timeoutMs, interval = input.intervalMs ?? 3_000;
+    let bindings = 0;
+    for (;;) {
+        input.signal?.throwIfAborted();
+        try {
+            bindings = (await ports.snapshot(effective, input.dshHome)).bindings.length;
+        }
+        catch {
+            bindings = 0;
+        }
+        if (bindings === 1)
+            return { mode: 'ready', bindings };
+        if (bindings > 1)
+            return { mode: 'ambiguous', bindings };
+        if (now() >= deadline)
+            return { mode: 'timeout', bindings };
+        await sleep(Math.min(interval, Math.max(0, deadline - now())), input.signal);
+    }
+}
 export async function runRsiSetup(argv = process.argv.slice(2)) {
     const args = parseRsiSetupArgs(argv);
     if (args.help) {
-        process.stdout.write('Usage: dsh-rsi-setup --manifest <private.json> [--dsh-home <absolute>] [--apply --confirm-hosts-stopped [--ack-existing-automations] [--start] | --rollback --confirm-hosts-stopped]\n       dsh-rsi-setup --prepare-source --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>]\n       dsh-rsi-setup --prepare-build --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--docker-path <absolute>] [--optional-build]\n       dsh-rsi-setup --prepare-authorities --profile <name> [--dsh-home <absolute>]\n       dsh-rsi-setup --install-owner --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--ack-existing-automations]\n       dsh-rsi-setup --install-local-cohort --profile <name> --source-repository <local-absolute> --bundle <slug> [--bundle <slug> ...] [--dsh-home <absolute>]\n--ack-existing-automations acknowledges active or paused durable rows when enabling or switching an Automation scheduler; accepted only with --install-owner or --apply, and does not bypass inventory drift checks.\nDefault: validate installed profiles and finite authority configuration without changing profiles.\nSource preparation creates a private checkout and release repository for the installed version. Build preparation also prepares private authority tools, signing identities and local release storage on Linux, creates an offline image and exports a pinned native release toolchain/store/cache; --optional-build reports which build prerequisites are unavailable. Authority preparation alone needs neither Docker nor a source checkout and does not issue grants or start Hosts.\n');
+        process.stdout.write('Usage: dsh-rsi-setup --manifest <private.json> [--dsh-home <absolute>] [--apply --confirm-hosts-stopped [--ack-existing-automations] [--start] | --rollback --confirm-hosts-stopped]\n       dsh-rsi-setup --prepare-source --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>]\n       dsh-rsi-setup --prepare-build --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--docker-path <absolute>] [--optional-build]\n       dsh-rsi-setup --prepare-authorities --profile <name> [--dsh-home <absolute>]\n       dsh-rsi-setup --install-owner --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--ack-existing-automations] [--enable-ordinary-use-learning [--intake-provider <id> --intake-model <id>]]\n       dsh-rsi-setup --wait-owner-dm --profile <name> [--dsh-home <absolute>] [--timeout-seconds <1-3600>]\n       dsh-rsi-setup --install-local-cohort --profile <name> --source-repository <local-absolute> --bundle <slug> [--bundle <slug> ...] [--dsh-home <absolute>]\n--ack-existing-automations acknowledges active or paused durable rows when enabling or switching an Automation scheduler; accepted only with --install-owner or --apply, and does not bypass inventory drift checks.\n--enable-ordinary-use-learning is accepted only with --install-owner and only on a fresh profile: it emits the observe-only intake evaluator (rules plus the Delivery or explicit provider/model) and the flagged memory grants. A retry preserves the stored opt-in and never expands an existing installation; no admission, revision key or Growth failure pin is added.\nDefault: validate installed profiles and finite authority configuration without changing profiles.\nSource preparation creates a private checkout and release repository for the installed version. Build preparation also prepares private authority tools, signing identities and local release storage on Linux, prepares a pinned native offline runtime by default and exports its release toolchain/store/cache (--docker-path instead prepares the legacy offline image); --optional-build reports which build prerequisites are unavailable. Authority preparation alone needs neither Docker nor a source checkout and does not issue grants or start Hosts.\n');
         process.stdout.write('macOS: --prepare-build installs a pinned private Node and frozen manifest-only dependencies for offline Seatbelt checks; --docker-path is rejected and --optional-build does not suppress native preparation failure. --install-owner configures a native launchd Host with finite memory learning and verified plugin creation. Source replacement/release remains Linux-only.\n');
-        process.stdout.write('       dsh-rsi-setup --prepare-local-update --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--add-memory-learning]\nPrepare local update source and tarballs outside the active Home; does not install or activate them. --add-memory-learning explicitly prepares the disabled learner bundle for a verified pre-owner installation.\n');
+        process.stdout.write('       dsh-rsi-setup --prepare-local-update --profile <name> [--dsh-home <absolute>] [--source-repository <local-absolute>] [--add-memory-learning] [--docker-path <absolute>]\nPrepare local update source and tarballs outside the active Home; does not install or activate them. Linux builds with the native runtime by default; --docker-path keeps the legacy image builder. --add-memory-learning explicitly prepares the disabled learner bundle for a verified pre-owner installation.\n');
+        return;
+    }
+    if (args.waitOwnerDm) {
+        const controller = new AbortController();
+        const cancel = () => controller.abort(new Error('owner DM wait interrupted'));
+        process.once('SIGINT', cancel);
+        process.once('SIGTERM', cancel);
+        try {
+            const result = await waitForOwnerDmBinding({ profile: args.profile, dshHome: args.dshHome,
+                timeoutMs: (args.timeoutSeconds ?? 600) * 1_000, signal: controller.signal });
+            process.stdout.write(`${JSON.stringify(result)}\n`);
+            if (result.mode !== 'ready')
+                process.exitCode = 3;
+        }
+        finally {
+            process.off('SIGINT', cancel);
+            process.off('SIGTERM', cancel);
+        }
         return;
     }
     if (args.prepareLocalUpdate) {
@@ -680,7 +771,8 @@ export async function runRsiSetup(argv = process.argv.slice(2)) {
             const { readRsiLocalCohort } = await import('./rsi-local-cohort.js');
             const sourceRepository = args.sourceRepository ?? (await readRsiLocalCohort({ dshHome: args.dshHome, profile: args.profile })).sourceRepository;
             const prepared = await prepareRsiLocalUpdate({ dshHome: args.dshHome, profile: args.profile, sourceRepository,
-                ...(args.addMemoryLearning ? { rootExtension: 'memory-learning' } : {}), signal: controller.signal });
+                ...(args.addMemoryLearning ? { rootExtension: 'memory-learning' } : {}),
+                ...(args.dockerPath ? { dockerPath: args.dockerPath } : {}), signal: controller.signal });
             process.stdout.write(`${JSON.stringify({ mode: prepared.mode, root: prepared.root, profile: prepared.profile,
                 sourceCommit: prepared.source.sourceCommit, version: prepared.cohort.version,
                 packages: prepared.cohort.packages.length, receiptDigest: prepared.receiptDigest,
@@ -723,7 +815,10 @@ export async function runRsiSetup(argv = process.argv.slice(2)) {
                 ? (await import('./rsi-native-install.js')).installNativeRsiOwnerDeployment
                 : (await import('./rsi-install.js')).installRsiOwnerDeployment;
             const result = await install({ dshHome: args.dshHome, profile: args.profile,
-                sourceRepository: args.sourceRepository, ackExistingAutomations: args.ackExistingAutomations, signal: controller.signal });
+                sourceRepository: args.sourceRepository, ackExistingAutomations: args.ackExistingAutomations, signal: controller.signal,
+                enableOrdinaryUseLearning: args.enableOrdinaryUseLearning === true,
+                ...(args.intakeProvider !== undefined ? { intakeProvider: args.intakeProvider } : {}),
+                ...(args.intakeModel !== undefined ? { intakeModel: args.intakeModel } : {}) });
             process.stdout.write(`${JSON.stringify(result)}\n`);
             process.stderr.write(result.mode === 'ready' ? (process.platform === 'darwin'
                 ? '原生 macOS 学习已启动并通过就绪检查：持久记忆、新工具独立验证与动态采用。\n'
@@ -769,6 +864,25 @@ export async function runRsiSetup(argv = process.argv.slice(2)) {
                         return { ...provisioned, sourceBuild: build.sourceBuild, creationBuild: nativeRsiCreationBuild(build),
                             capabilities: ['native-memory-learning', 'verified-plugin-creation', 'dynamic-tool-adoption'] };
                     }
+                    // Linux prepares the schema 3 native runtime by default: no Docker
+                    // CLI, daemon, socket or image is involved. An explicit --docker-path
+                    // keeps the legacy image path available during migration coexistence.
+                    if (process.platform === 'linux' && !args.dockerPath) {
+                        const build = await prepareLinuxRsiRuntime({ dshHome: args.dshHome, profile: args.profile, source,
+                            signal: controller.signal });
+                        try {
+                            const release = await prepareRsiReleaseBuildEnvironment({ dshHome: args.dshHome, profile: args.profile,
+                                build, signal: controller.signal });
+                            return { ...provisioned, sourceBuild: build, releaseBuild: release };
+                        }
+                        catch (error) {
+                            controller.signal.throwIfAborted();
+                            if (!args.optionalBuild || !(error instanceof RsiReleaseBuildUnavailableError))
+                                throw error;
+                            process.stderr.write(`自迭代发布构建环境未就绪：${error.message}。已保留源码、验证运行时与原生工具链。\n`);
+                            return { ...provisioned, sourceBuild: build, releaseBuildUnavailable: error.message };
+                        }
+                    }
                     const build = await prepareRsiBuildEnvironment({ dshHome: args.dshHome, profile: args.profile, source,
                         dockerPath: args.dockerPath, signal: controller.signal });
                     try {
@@ -786,7 +900,8 @@ export async function runRsiSetup(argv = process.argv.slice(2)) {
                 }
                 catch (error) {
                     controller.signal.throwIfAborted();
-                    if (!args.optionalBuild || !(error instanceof RsiBuildUnavailableError))
+                    if (!args.optionalBuild
+                        || !(error instanceof RsiBuildUnavailableError || error instanceof LinuxRsiRuntimeUnavailableError))
                         throw error;
                     process.stderr.write(`自迭代构建环境未就绪：${error.message}。已保留源码准备结果。\n`);
                     return { ...provisioned, buildUnavailable: error.message };