@jungjaehoon/mama-os 0.75.0 → 0.76.0

package/dist/tools/document-render.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.officeSandboxProfile = void 0;
+exports.createDocumentRenderer = createDocumentRenderer;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const file_delivery_js_1 = require("../api/file-delivery.js");
+const command_runner_js_1 = require("./command-runner.js");
+const office_render_js_1 = require("./office-render.js");
+const toolkit_state_js_1 = require("./toolkit-state.js");
+const backend_security_js_1 = require("../runtime/backend-security.js");
+var office_render_js_2 = require("./office-render.js");
+Object.defineProperty(exports, "officeSandboxProfile", { enumerable: true, get: function () { return office_render_js_2.officeSandboxProfile; } });
+// All callers and both backends share the daemon's host renderer; failures release the queue.
+let queue = Promise.resolve();
+function renderTempDirectory() {
+    (0, node_fs_1.mkdirSync)(backend_security_js_1.HOST_DOCUMENT_RENDER_ROOT, { recursive: true, mode: 0o700 });
+    const meta = (0, node_fs_1.lstatSync)(backend_security_js_1.HOST_DOCUMENT_RENDER_ROOT);
+    if (!meta.isDirectory() || meta.uid !== process.getuid?.())
+        throw new Error('Document render root must be a real directory owned by the daemon uid');
+    (0, node_fs_1.chmodSync)(backend_security_js_1.HOST_DOCUMENT_RENDER_ROOT, 0o700);
+    return (0, node_fs_1.realpathSync)((0, node_fs_1.mkdtempSync)((0, node_path_1.join)(backend_security_js_1.HOST_DOCUMENT_RENDER_ROOT, 'mama-office-render-')));
+}
+/** Publish bounded regular files without following links planted by an untrusted renderer/caller. */
+function publishFile(temp, output, name) {
+    const source = (0, file_delivery_js_1.openWorkspaceFile)(temp, (0, node_path_1.join)(temp, name), file_delivery_js_1.OWNER_FILE_MAX_UPLOAD_BYTES, true);
+    let target;
+    try {
+        if ((0, node_fs_1.realpathSync)(output) !== output)
+            throw new Error('Render output directory must not be a symlink');
+        const path = (0, node_path_1.join)(output, name);
+        target = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_CREAT |
+            node_fs_1.constants.O_EXCL |
+            node_fs_1.constants.O_WRONLY |
+            (process.platform === 'darwin' ? file_delivery_js_1.O_NOFOLLOW_ANY : node_fs_1.constants.O_NOFOLLOW), 0o600);
+        if (process.platform === 'linux' && (0, node_fs_1.readlinkSync)(`/proc/self/fd/${target}`) !== path)
+            throw new Error('Render output path changed');
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        while (position < source.size) {
+            const count = (0, node_fs_1.readSync)(source.fd, buffer, 0, Math.min(buffer.length, source.size - position), position);
+            if (!count)
+                throw new Error('Render output changed during publication');
+            let written = 0;
+            while (written < count)
+                written += (0, node_fs_1.writeSync)(target, buffer, written, count - written);
+            position += count;
+        }
+    }
+    finally {
+        (0, node_fs_1.closeSync)(source.fd);
+        if (target !== undefined)
+            (0, node_fs_1.closeSync)(target);
+    }
+}
+function createDocumentRenderer(options) {
+    const perform = async (workspace, input) => {
+        (0, office_render_js_1.requireOfficeSandbox)(options.platform);
+        const lease = await (0, toolkit_state_js_1.leaseDocumentToolkit)(options.toolsRoot);
+        const toolkit = lease.toolkit;
+        let fd;
+        let temp;
+        let output;
+        let completed = false;
+        try {
+            const resolved = (0, node_path_1.resolve)(workspace, input);
+            if ((0, node_fs_1.realpathSync)(resolved) !== resolved)
+                throw new Error('Document path must not pass through a symlink');
+            const file = (0, file_delivery_js_1.openWorkspaceFile)(workspace, resolved, options.maxBytes ?? file_delivery_js_1.OWNER_FILE_MAX_UPLOAD_BYTES, true);
+            fd = file.fd;
+            const extension = (0, node_path_1.extname)(file.path).toLowerCase();
+            temp = renderTempDirectory();
+            if (![
+                '.pptx',
+                '.docx',
+                '.xlsx',
+                '.ppt',
+                '.doc',
+                '.xls',
+                '.odt',
+                '.odp',
+                '.ods',
+                '.pdf',
+            ].includes(extension))
+                throw new Error('Render requires an office document or PDF extension');
+            // Keep the name inside the 255-byte component limit whatever the input's basename.
+            const stem = Buffer.from((0, node_path_1.basename)(file.path, (0, node_path_1.extname)(file.path)), 'utf8')
+                .subarray(0, 120)
+                .toString('utf8')
+                .replace(/\uFFFD+$/, '');
+            output = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_path_1.dirname)(file.path), `${stem}.render-`));
+            if ((0, node_fs_1.realpathSync)((0, node_path_1.dirname)(file.path)) !== (0, node_path_1.dirname)(file.path))
+                throw new Error('Document output directory changed');
+            const staged = (0, node_path_1.join)(temp, `document${extension}`);
+            // Hold and copy the validated descriptor, never reopen an agent-mutable input pathname.
+            const stagedFd = (0, node_fs_1.openSync)(staged, 'wx', 0o600);
+            try {
+                let position = 0;
+                const buffer = Buffer.allocUnsafe(64 * 1024);
+                while (position < file.size) {
+                    const count = (0, node_fs_1.readSync)(file.fd, buffer, 0, Math.min(buffer.length, file.size - position), position);
+                    if (!count)
+                        throw new Error('Document changed while staging');
+                    let written = 0;
+                    while (written < count)
+                        written += (0, node_fs_1.writeSync)(stagedFd, buffer, written, count - written);
+                    position += count;
+                }
+                if ((0, node_fs_1.fstatSync)(file.fd).size !== file.size)
+                    throw new Error('Document changed while staging');
+            }
+            finally {
+                (0, node_fs_1.closeSync)(stagedFd);
+            }
+            const env = (0, office_render_js_1.renderEnvironment)(toolkit.versionDir, toolkit.fontconfig, temp);
+            const deadline = Date.now() + (options.timeoutMs ?? 120_000);
+            const remaining = () => {
+                const ms = deadline - Date.now();
+                if (ms <= 0)
+                    throw new Error('Document render timed out');
+                return ms;
+            };
+            const run = options.run ?? command_runner_js_1.runCommand;
+            const shared = {
+                temp,
+                output: temp,
+                env,
+                run,
+                platform: options.platform,
+                deniedReadPaths: options.deniedReadPaths ?? [],
+            };
+            const pdf = extension === '.pdf' ? staged : (0, node_path_1.join)(temp, 'document.pdf');
+            if (['.pptx', '.docx', '.xlsx', '.odt', '.odp', '.ods'].includes(extension)) {
+                const inspector = (0, node_path_1.join)(temp, 'inspect-office-zip.py');
+                (0, node_fs_1.copyFileSync)((0, node_path_1.join)(toolkit_state_js_1.TOOLKIT_ASSETS, 'inspect-office-zip.py'), inspector);
+                await (0, office_render_js_1.sandboxedCommand)({
+                    ...shared,
+                    command: toolkit.python,
+                    args: ['-I', inspector, staged],
+                    timeoutMs: remaining(),
+                });
+            }
+            if (extension !== '.pdf') {
+                await (0, office_render_js_1.renderOffice)({
+                    ...shared,
+                    soffice: options.soffice ?? toolkit.soffice,
+                    input: staged,
+                    timeoutMs: remaining(),
+                });
+                if (!(0, node_fs_1.existsSync)(pdf))
+                    throw new Error('LibreOffice produced no PDF');
+            }
+            // Product code may be installed under the owner's HOME, denied to member renders.
+            // Stage this shipped host helper in the readable temp directory before sandboxing Python.
+            (0, node_fs_1.copyFileSync)((0, node_path_1.join)(toolkit_state_js_1.TOOLKIT_ASSETS, 'rasterize.py'), (0, node_path_1.join)(temp, 'rasterize.py'));
+            const raster = await (0, office_render_js_1.sandboxedCommand)({
+                ...shared,
+                command: toolkit.python,
+                args: ['-I', (0, node_path_1.join)(temp, 'rasterize.py'), pdf, temp, String(options.pageLimit ?? 50)],
+                timeoutMs: remaining(),
+            });
+            const data = JSON.parse(raster.stdout);
+            const limit = options.pageLimit ?? 50;
+            if (!Number.isInteger(data.pageCount) ||
+                data.pageCount < 1 ||
+                data.pageCount > limit ||
+                !Array.isArray(data.pages) ||
+                data.pages.length !== data.pageCount ||
+                !Array.isArray(data.fonts) ||
+                data.fonts.length !== data.pageCount ||
+                data.fonts.some((fonts) => !Array.isArray(fonts) || fonts.some((font) => typeof font !== 'string')))
+                throw new Error('Invalid rasterizer receipt or document page limit exceeded');
+            for (const page of data.pages) {
+                if (!/^page-\d{3}\.png$/.test(page))
+                    throw new Error('Invalid rasterizer output path');
+                publishFile(temp, output, page);
+            }
+            if (extension !== '.pdf')
+                publishFile(temp, output, 'document.pdf');
+            completed = true;
+            return {
+                pdf: extension === '.pdf'
+                    ? (0, node_path_1.relative)(workspace, file.path)
+                    : (0, node_path_1.relative)(workspace, (0, node_path_1.join)(output, 'document.pdf')),
+                pages: data.pages.map((page) => (0, node_path_1.relative)(workspace, (0, node_path_1.join)(output, page))),
+                pageCount: data.pageCount,
+                fonts: data.fonts,
+            };
+        }
+        finally {
+            if (fd !== undefined)
+                (0, node_fs_1.closeSync)(fd);
+            if (temp)
+                (0, node_fs_1.rmSync)(temp, { recursive: true, force: true });
+            lease.release();
+            if (!completed && output)
+                (0, node_fs_1.rmSync)(output, { recursive: true, force: true });
+        }
+    };
+    return {
+        render(workspace, input) {
+            const result = queue.then(() => perform(workspace, input));
+            queue = result.catch(() => { });
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=document-render.js.map

package/dist/tools/document-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-render.js","sourceRoot":"","sources":["../../src/tools/document-render.ts"],"names":[],"mappings":";;;AA0GA,wDA8JC;AAxQD,qCAgBiB;AACjB,yCAAgF;AAChF,8DAIiC;AACjC,2DAAqE;AACrE,yDAK4B;AAC5B,yDAA0E;AAC1E,wEAA2E;AAE3E,uDAA0D;AAAjD,wHAAA,oBAAoB,OAAA;AAsB7B,8FAA8F;AAC9F,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAEhD,SAAS,mBAAmB;IAC1B,IAAA,mBAAS,EAAC,+CAAyB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAA,mBAAS,EAAC,+CAAyB,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QACxD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,IAAA,mBAAS,EAAC,+CAAyB,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,IAAA,sBAAY,EAAC,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,+CAAyB,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,IAAA,oCAAiB,EAAC,IAAI,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,8CAA2B,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,IAAA,sBAAY,EAAC,MAAM,CAAC,KAAK,MAAM;YACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,GAAG,IAAA,kBAAQ,EACf,IAAI,EACJ,mBAAS,CAAC,OAAO;YACf,mBAAS,CAAC,MAAM;YAChB,mBAAS,CAAC,QAAQ;YAClB,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAc,CAAC,CAAC,CAAC,mBAAS,CAAC,UAAU,CAAC,EACzE,KAAK,CACN,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAA,sBAAY,EAAC,iBAAiB,MAAM,EAAE,CAAC,KAAK,IAAI;YAClF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,kBAAQ,EACpB,MAAM,CAAC,EAAE,EACT,MAAM,EACN,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,EAC/C,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACxE,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,OAAO,GAAG,KAAK;gBAAE,OAAO,IAAI,IAAA,mBAAS,EAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;YACvF,QAAQ,IAAI,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAA,mBAAS,EAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAA8B;IACnE,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAAE,KAAa,EAAiC,EAAE;QACxF,IAAA,uCAAoB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAA,uCAAoB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAsB,CAAC;QAC3B,IAAI,IAAwB,CAAC;QAC7B,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,IAAA,sBAAY,EAAC,QAAQ,CAAC,KAAK,QAAQ;gBACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,IAAA,oCAAiB,EAC5B,SAAS,EACT,QAAQ,EACR,OAAO,CAAC,QAAQ,IAAI,8CAA2B,EAC/C,IAAI,CACL,CAAC;YACF,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACnD,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAC7B,IACE,CAAC;gBACC,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,MAAM;aACP,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAErB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,mFAAmF;YACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;iBACtE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;iBAChB,QAAQ,CAAC,MAAM,CAAC;iBAChB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC3B,MAAM,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;YAClE,IAAI,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,SAAS,EAAE,CAAC,CAAC;YAClD,wFAAwF;YACxF,MAAM,QAAQ,GAAG,IAAA,kBAAQ,EAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC7C,OAAO,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAA,kBAAQ,EACpB,IAAI,CAAC,EAAE,EACP,MAAM,EACN,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,EAC7C,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;oBAC9D,IAAI,OAAO,GAAG,CAAC,CAAC;oBAChB,OAAO,OAAO,GAAG,KAAK;wBAAE,OAAO,IAAI,IAAA,mBAAS,EAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;oBACzF,QAAQ,IAAI,KAAK,CAAC;gBACpB,CAAC;gBACD,IAAI,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;oBACvC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACtD,CAAC;oBAAS,CAAC;gBACT,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,GAAG,GAAG,IAAA,oCAAiB,EAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,GAAG,EAAE;gBACrB,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC1D,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,8BAAU,CAAC;YACtC,MAAM,MAAM,GAAG;gBACb,IAAI;gBACJ,MAAM,EAAE,IAAI;gBACZ,GAAG;gBACH,GAAG;gBACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;aAC/C,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;gBACtD,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,iCAAc,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;gBACvE,MAAM,IAAA,mCAAgB,EAAC;oBACrB,GAAG,MAAM;oBACT,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;oBAC/B,SAAS,EAAE,SAAS,EAAE;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAA,+BAAY,EAAC;oBACjB,GAAG,MAAM;oBACT,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;oBAC3C,KAAK,EAAE,MAAM;oBACb,SAAS,EAAE,SAAS,EAAE;iBACvB,CAAC,CAAC;gBACH,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACvE,CAAC;YACD,kFAAkF;YAClF,0FAA0F;YAC1F,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,iCAAc,EAAE,cAAc,CAAC,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,EAAC;gBACpC,GAAG,MAAM;gBACT,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpF,SAAS,EAAE,SAAS,EAAE;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAyB,CAAC;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;YACtC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjC,IAAI,CAAC,SAAS,GAAG,CAAC;gBAClB,IAAI,CAAC,SAAS,GAAG,KAAK;gBACtB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS;gBACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS;gBACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CACnF;gBAED,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,SAAS,KAAK,MAAM;gBAAE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YACpE,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO;gBACL,GAAG,EACD,SAAS,KAAK,MAAM;oBAClB,CAAC,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;oBAChC,CAAC,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,IAAA,gBAAI,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,IAAA,gBAAI,EAAC,MAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACzE,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,IAAI,MAAM;gBAAE,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,MAAM,CAAC,SAAiB,EAAE,KAAa;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/document-toolkit.d.ts

@@ -0,0 +1,15 @@
+import { type CommandRunner } from './command-runner.js';
+import { type DocumentToolkit } from './toolkit-state.js';
+export { readDocumentToolkit } from './toolkit-state.js';
+export interface InstallToolkitOptions {
+    toolsRoot: string;
+    home?: string;
+    memberRoot?: string;
+    platform?: NodeJS.Platform;
+    run?: CommandRunner;
+    locate?: (name: string) => string | undefined;
+    write?: (line: string) => void;
+}
+/** Host-only, offline-testable provisioning. No daemon state, config rewrite or restart. */
+export declare function installDocumentToolkit(options: InstallToolkitOptions): Promise<DocumentToolkit>;
+//# sourceMappingURL=document-toolkit.d.ts.map

package/dist/tools/document-toolkit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-toolkit.d.ts","sourceRoot":"","sources":["../../src/tools/document-toolkit.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AA0SD,4FAA4F;AAC5F,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAqO1B"}